Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[filbeat][azure-blob-storage] - Adding support for Microsoft Entra ID RBAC authentication #40879

Merged
merged 12 commits into from
Oct 1, 2024

Conversation

ShourieG
Copy link
Contributor

@ShourieG ShourieG commented Sep 18, 2024

Type of change

  • Enhancement
  • Docs

Proposed commit message

Added support for Microsoft Entra ID RBAC authentication.
Added mock tests by injecting the gock transport layer in the azure client.
Added some config tests with the new config options.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

No Impact

Live Testing

Live testing was performed using our internal Azure dev environment.
Process followed:

  1. Fresh storage account and container created and then uploaded with dummy files.
  2. New service principle app created.
  3. blobOwner role granted to service app via Entra ID IAM configs.
  4. client_id, tenant_id and client_secret of the service app used to poll poll the blob storage.
  5. Records were output to a local file with success.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Testing

We performed live testing internally using an active azure account and the new authentication system is working properly after assigning the service principal app with the blobOwner permission level.

Use cases

Screenshots

Screenshot 2024-09-19 at 6 29 07 PM Screenshot 2024-09-19 at 6 30 46 PM

Logs

@ShourieG ShourieG self-assigned this Sep 18, 2024
@ShourieG ShourieG requested a review from a team as a code owner September 18, 2024 09:00
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 18, 2024
Copy link
Contributor

mergify bot commented Sep 18, 2024

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @ShourieG? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

Copy link
Contributor

mergify bot commented Sep 18, 2024

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

@mergify mergify bot added the backport-8.x Automated backport to the 8.x branch with mergify label Sep 18, 2024
@ShourieG ShourieG added Team:Security-Service Integrations Security Service Integrations Team and removed backport-8.x Automated backport to the 8.x branch with mergify labels Sep 18, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 18, 2024
@mergify mergify bot added the backport-8.x Automated backport to the 8.x branch with mergify label Sep 18, 2024
@ShourieG ShourieG marked this pull request as draft September 18, 2024 09:22
Copy link
Contributor

mergify bot commented Sep 18, 2024

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b abs/rbac upstream/abs/rbac
git merge upstream/main
git push upstream abs/rbac

@ShourieG ShourieG marked this pull request as ready for review September 19, 2024 12:37
@ShourieG ShourieG requested a review from a team as a code owner September 19, 2024 12:37
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits only

@ShourieG ShourieG merged commit c5d376c into elastic:main Oct 1, 2024
22 checks passed
@ShourieG ShourieG deleted the abs/rbac branch October 1, 2024 11:17
mergify bot pushed a commit that referenced this pull request Oct 1, 2024
… RBAC authentication (#40879)

* Added support for Microsoft Entra ID RBAC authentication.

(cherry picked from commit c5d376c)
ShourieG pushed a commit that referenced this pull request Oct 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-8.x Automated backport to the 8.x branch with mergify enhancement Filebeat Filebeat input:azure-blob-storage Team:Security-Service Integrations Security Service Integrations Team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[filebeat][azure-blob-storage] - Add support for authorization via Microsoft Entra ID / RBAC
4 participants