x-pack/filebeat/input/entityanalytics/provider/okta: add user group membership support

[efd6]

Proposed commit message

See title.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

To test the internal package, you will need to obtain an okta account and then run the following in that package's directory:

$ OKTA_HOST=dev-<REDACTED>-admin.okta.com OKTA_TOKEN=<REDACTED> go test -log_response -v -run Test$

Replacing the redacted parts with the appropriate values.

This should result in output similar to the following. In particular, the output for Test/none/my_groups.

=== RUN   Test
=== RUN   Test/none
=== RUN   Test/none/me
    okta_test.go:83: user: {"id":"<REDACTED>","status":"ACTIVE","created":"1066-10-13T20:57:12Z","activated":"0001-01-01T00:00:00Z","statusChanged":"1066-10-13T04:37:39Z","lastLogin":"1066-10-13T02:50:06Z","lastUpdated":"1066-10-13T04:37:39Z","passwordChanged":"1066-10-13T04:37:39Z","type":{"id":"<REDACTED>"},"profile":{"login":"efd6@github.oktaidp","email":"harold.godwinson@angeland.co","firstName":"Harold","lastName":"Godwinson"},"credentials":{"password":{},"recovery_question":{},"provider":{"type":"OKTA","name":"OKTA"}},"_links":{"changePassword":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/credentials/change_password","method":"POST"},"changeRecoveryQuestion":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/credentials/change_recovery_question","method":"POST"},"deactivate":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/lifecycle/deactivate","method":"POST"},"expirePassword":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/lifecycle/expire_password","method":"POST"},"forgotPassword":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/credentials/forgot_password","method":"POST"},"resetPassword":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/lifecycle/reset_password","method":"POST"},"schema":{"href":"https://dev-<REDACTED>.okta.com/api/v1/meta/schemas/user/<REDACTED>"},"self":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>"},"suspend":{"href":"https://dev-<REDACTED>.okta.com/api/v1/users/<REDACTED>/lifecycle/suspend","method":"POST"},"type":{"href":"https://dev-<REDACTED>.okta.com/api/v1/meta/types/user/<REDACTED>"}}}
=== RUN   Test/none/my_groups
    okta_test.go:111: groups: [{"id":"<REDACTED>","profile":{"description":"All users in your organization","name":"Everyone"}}]
<more>

Related issues

• Closes [Filebeat] Okta Entity Analytics - Enrich users with group info #39814

Use cases

Screenshots

Logs

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[ShourieG]

Worth resolving the linting errors here or do you think it's mostly noise ?

[andrewkroh]

LGTM. 🐎

So the implication of adding group enrichment with their API design is that we need to make an additional API call for each user, right?

[efd6]

That's correct. I did consider adding a config flag for that, but figured that it would be almost always wanted. If you think we should make this configurable, I'm happy to add that.

[efd6]

The linter noise is noise.

[andrewkroh]

I don't think it's necessary. I'd rather wait and add address this if it becomes a problem.

[andrewkroh]

@efd6 I just thought of one more thing this needs, and that is to mention that the input interacts with the groups API in https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-entity-analytics.html#_api_interactions_2.

[efd6]

That documentation is still strictly correct. We are going through /api/v1/users.

beats/x-pack/filebeat/input/entityanalytics/provider/okta/internal/okta/okta.go

Line 242 in 68371a0

const endpoint = "/api/v1/users"

[andrewkroh]

Perfect. 😆