entityanalytics_okta: map group fields and add test infrastructure

elastic · Sep 3, 2024 · 81b794f · 81b794f
1 parent d5f7252
commit 81b794f
Show file tree

Hide file tree

Showing 8 changed files with 258 additions and 4 deletions.
diff --git a/packages/entityanalytics_okta/_dev/deploy/docker/files/config.yml b/packages/entityanalytics_okta/_dev/deploy/docker/files/config.yml
@@ -4,16 +4,202 @@ rules:
     responses:
       - status_code: 200
         body: |
-          [{"id":"00ub0oNGTSWTBKOLGLNR","status":"ACTIVE","created":"2013-06-24T16:39:18.000Z","activated":"2013-06-24T16:39:19.000Z","statusChanged":"2013-06-24T16:39:19.000Z","lastLogin":"2013-06-24T17:39:19.000Z","lastUpdated":"2013-07-02T21:36:25.344Z","passwordChanged":"2013-07-02T21:36:25.344Z","profile":{"firstName":"Isaac","lastName":"Brock","email":"[email protected]","login":"[email protected]","mobilePhone":"555-415-1337"},"credentials":{"password":{"value":"tlpWENT2m"},"recovery_question":{"question":"Who's a major player in the cowboy scene?","answer":"Annie Oakley"},"provider":{"type":"OKTA","name":"OKTA"}}}]
+          {{ minify_json `
+          [
+              {
+                  "id": "00ub0oNGTSWTBKOLGLNR",
+                  "status": "ACTIVE",
+                  "created": "2013-06-24T16:39:18.000Z",
+                  "activated": "2013-06-24T16:39:19.000Z",
+                  "statusChanged": "2013-06-24T16:39:19.000Z",
+                  "lastLogin": "2013-06-24T17:39:19.000Z",
+                  "lastUpdated": "2013-07-02T21:36:25.344Z",
+                  "passwordChanged": "2013-07-02T21:36:25.344Z",
+                  "profile": {
+                      "firstName": "Isaac",
+                      "lastName": "Brock",
+                      "email": "[email protected]",
+                      "login": "[email protected]",
+                      "mobilePhone": "555-415-1337"
+                  },
+                  "credentials": {
+                      "password": {
+                          "value": "tlpWENT2m"
+                      },
+                      "recovery_question": {
+                          "question": "Who's a major player in the cowboy scene?",
+                          "answer": "Annie Oakley"
+                      },
+                      "provider": {
+                          "type": "OKTA",
+                          "name": "OKTA"
+                      }
+                  }
+              }
+          ]
+          `}}
+  - path: /api/v1/users/00ub0oNGTSWTBKOLGLNR/groups
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {{ minify_json `
+          [
+              {
+                  "id": "ODc3ZTBjNGZjY2Y4YmRi",
+                  "profile": {
+                      "description": "All users in your organization",
+                      "name": "Everyone"
+                  }
+              }
+          ]
+          `}}
   - path: /api/v1/devices
     methods: ["GET"]
     responses:
       - status_code: 200
         body: |
-          [{"id":"guo4a5u7YAHhjXrMK0g5","status":"CREATED","created":"2019-10-02T18:03:07.000Z","lastUpdated":"2019-10-02T18:03:07.000Z","profile":{"displayName":"Example Device name 1","platform":"WINDOWS","serialNumber":"XXDDRFCFRGF3M8MD6D","sid":"S-1-11-111","registered":true,"secureHardwarePresent":false,"diskEncryptionType":"ALL_INTERNAL_VOLUMES"},"resourceType":"UDDevice","resourceDisplayName":{"value":"Example Device name 1","sensitive":false},"resourceAlternateId":null,"resourceId":"guo4a5u7YAHhjXrMK0g4","_links":{"activate":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4/lifecycle/activate","hints":{"allow":["POST"]}},"self":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4","hints":{"allow":["GET","PATCH","PUT"]}},"users":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4/users","hints":{"allow":["GET"]}}}},{"id":"guo4a5u7YAHhjXrMK0g5","status":"ACTIVE","created":"2023-06-21T23:24:02.000Z","lastUpdated":"2023-06-21T23:24:02.000Z","profile":{"displayName":"Example Device name 2","platform":"ANDROID","manufacturer":"Google","model":"Pixel 6","osVersion":"13:2023-05-05","registered":true,"secureHardwarePresent":true,"diskEncryptionType":"USER"},"resourceType":"UDDevice","resourceDisplayName":{"value":"Example Device name 2","sensitive":false},"resourceAlternateId":null,"resourceId":"guo4a5u7YAHhjXrMK0g5","_links":{"activate":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5/lifecycle/activate","hints":{"allow":["POST"]}},"self":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5","hints":{"allow":["GET","PATCH","PUT"]}},"users":{"href":"https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5/users","hints":{"allow":["GET"]}}}}]
+          {{ minify_json `
+          [
+              {
+                  "id": "guo4a5u7YAHhjXrMK0g5",
+                  "status": "CREATED",
+                  "created": "2019-10-02T18:03:07.000Z",
+                  "lastUpdated": "2019-10-02T18:03:07.000Z",
+                  "profile": {
+                      "displayName": "Example Device name 1",
+                      "platform": "WINDOWS",
+                      "serialNumber": "XXDDRFCFRGF3M8MD6D",
+                      "sid": "S-1-11-111",
+                      "registered": true,
+                      "secureHardwarePresent": false,
+                      "diskEncryptionType": "ALL_INTERNAL_VOLUMES"
+                  },
+                  "resourceType": "UDDevice",
+                  "resourceDisplayName": {
+                      "value": "Example Device name 1",
+                      "sensitive": false
+                  },
+                  "resourceAlternateId": null,
+                  "resourceId": "guo4a5u7YAHhjXrMK0g4",
+                  "_links": {
+                      "activate": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4/lifecycle/activate",
+                          "hints": {
+                              "allow": [
+                                  "POST"
+                              ]
+                          }
+                      },
+                      "self": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4",
+                          "hints": {
+                              "allow": [
+                                  "GET",
+                                  "PATCH",
+                                  "PUT"
+                              ]
+                          }
+                      },
+                      "users": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g4/users",
+                          "hints": {
+                              "allow": [
+                                  "GET"
+                              ]
+                          }
+                      }
+                  }
+              },
+              {
+                  "id": "guo4a5u7YAHhjXrMK0g5",
+                  "status": "ACTIVE",
+                  "created": "2023-06-21T23:24:02.000Z",
+                  "lastUpdated": "2023-06-21T23:24:02.000Z",
+                  "profile": {
+                      "displayName": "Example Device name 2",
+                      "platform": "ANDROID",
+                      "manufacturer": "Google",
+                      "model": "Pixel 6",
+                      "osVersion": "13:2023-05-05",
+                      "registered": true,
+                      "secureHardwarePresent": true,
+                      "diskEncryptionType": "USER"
+                  },
+                  "resourceType": "UDDevice",
+                  "resourceDisplayName": {
+                      "value": "Example Device name 2",
+                      "sensitive": false
+                  },
+                  "resourceAlternateId": null,
+                  "resourceId": "guo4a5u7YAHhjXrMK0g5",
+                  "_links": {
+                      "activate": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5/lifecycle/activate",
+                          "hints": {
+                              "allow": [
+                                  "POST"
+                              ]
+                          }
+                      },
+                      "self": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5",
+                          "hints": {
+                              "allow": [
+                                  "GET",
+                                  "PATCH",
+                                  "PUT"
+                              ]
+                          }
+                      },
+                      "users": {
+                          "href": "https://{yourOktaDomain}/api/v1/devices/guo4a5u7YAHhjXrMK0g5/users",
+                          "hints": {
+                              "allow": [
+                                  "GET"
+                              ]
+                          }
+                      }
+                  }
+              }
+          ]
+          `}}
   - path: /api/v1/devices/guo4a5u7YAHhjXrMK0g5/users
     methods: ["GET"]
     responses:
       - status_code: 200
         body: |-
-          [{"id":"00ub0oNGTSWTBKOLGLNR","status":"ACTIVE","created":"2013-06-24T16:39:18.000Z","activated":"2013-06-24T16:39:19.000Z","statusChanged":"2013-06-24T16:39:19.000Z","lastLogin":"2013-06-24T17:39:19.000Z","lastUpdated":"2013-07-02T21:36:25.344Z","passwordChanged":"2013-07-02T21:36:25.344Z","profile":{"firstName":"Isaac","lastName":"Brock","email":"[email protected]","login":"[email protected]","mobilePhone":"555-415-1337"},"credentials":{"password":{"value":"tlpWENT2m"},"recovery_question":{"question":"Who's a major player in the cowboy scene?","answer":"Annie Oakley"},"provider":{"type":"OKTA","name":"OKTA"}}}]
+          {{ minify_json `
+          [
+              {
+                  "id": "00ub0oNGTSWTBKOLGLNR",
+                  "status": "ACTIVE",
+                  "created": "2013-06-24T16:39:18.000Z",
+                  "activated": "2013-06-24T16:39:19.000Z",
+                  "statusChanged": "2013-06-24T16:39:19.000Z",
+                  "lastLogin": "2013-06-24T17:39:19.000Z",
+                  "lastUpdated": "2013-07-02T21:36:25.344Z",
+                  "passwordChanged": "2013-07-02T21:36:25.344Z",
+                  "profile": {
+                      "firstName": "Isaac",
+                      "lastName": "Brock",
+                      "email": "[email protected]",
+                      "login": "[email protected]",
+                      "mobilePhone": "555-415-1337"
+                  },
+                  "credentials": {
+                      "password": {
+                          "value": "tlpWENT2m"
+                      },
+                      "recovery_question": {
+                          "question": "Who's a major player in the cowboy scene?",
+                          "answer": "Annie Oakley"
+                      },
+                      "provider": {
+                          "type": "OKTA",
+                          "name": "OKTA"
+                      }
+                  }
+              }
+          ]
+          `}}
diff --git a/packages/entityanalytics_okta/changelog.yml b/packages/entityanalytics_okta/changelog.yml
@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "1.5.0"
+  changes:
+    - description: Add support for group membership mapping.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/10973
+    - description: Add system testing support for group membership.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/10973
 - version: "1.4.0"
   changes:
     - description: Add support for request trace logging.

diff --git a/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json
@@ -44,6 +44,15 @@
                     "recovery_question": {}
                 }
             },
+            "groups": [
+                {
+                    "id": "OGYzMDMwYjFmODBiNjli",
+                    "profile": {
+                        "description": "All users in your organization",
+                        "name": "Everyone"
+                    }
+                }
+            ],
             "user": {
                 "id": "00u5tvodynDjUCNKn697"
             },

diff --git a/...ges/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json-expected.json b/...ges/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json-expected.json
@@ -19,6 +19,15 @@
                 "version": "8.11.0"
             },
             "entityanalytics_okta": {
+                "groups": [
+                    {
+                        "id": "OGYzMDMwYjFmODBiNjli",
+                        "profile": {
+                            "description": "All users in your organization",
+                            "name": "Everyone"
+                        }
+                    }
+                ],
                 "user": {
                     "activated": "2013-06-24T16:39:19.000Z",
                     "created": "2013-06-24T16:39:18.000Z",
@@ -117,6 +126,14 @@
                     "postal_code": "94107",
                     "region_name": "CA"
                 },
+                "group": {
+                    "id": [
+                        "OGYzMDMwYjFmODBiNjli"
+                    ],
+                    "name": [
+                        "Everyone"
+                    ]
+                },
                 "id": "00u5tvodynDjUCNKn697",
                 "name": "[email protected]",
                 "organization": {

diff --git a/packages/entityanalytics_okta/data_stream/user/elasticsearch/ingest_pipeline/default.yml b/packages/entityanalytics_okta/data_stream/user/elasticsearch/ingest_pipeline/default.yml
@@ -207,6 +207,27 @@ processors:
       target_field: entityanalytics_okta.user.type
       tag: rename_user_type
       ignore_missing: true
+  - rename:
+      field: groups
+      target_field: entityanalytics_okta.groups
+      tag: rename_user_groups
+      ignore_missing: true
+  - foreach:
+      field: entityanalytics_okta.groups
+      if: ctx.entityanalytics_okta?.groups != null
+      processor:
+        append:
+          field: user.group.id
+          value: '{{{_ingest._value.id}}}'
+          allow_duplicates: false
+  - foreach:
+      field: entityanalytics_okta.groups
+      if: ctx.entityanalytics_okta?.groups != null
+      processor:
+        append:
+          field: user.group.name
+          value: '{{{_ingest._value.profile.name}}}'
+          allow_duplicates: false
   - rename:
       field: okta.transitioningToStatus
       target_field: entityanalytics_okta.user.transitioning_to_status

diff --git a/packages/entityanalytics_okta/data_stream/user/fields/fields.yml b/packages/entityanalytics_okta/data_stream/user/fields/fields.yml
@@ -154,3 +154,14 @@
         - name: type
           type: flattened
           description: user type that determines the schema for the user's profile.
+    - name: groups
+      type: group
+      fields:
+        - name: id
+          type: keyword
+          description: The ID for the group.
+        - name: profile.*
+          type: object
+          description: Group profile details.
+          object_type: keyword
+          object_type_mapping_type: '*'
diff --git a/packages/entityanalytics_okta/docs/README.md b/packages/entityanalytics_okta/docs/README.md
@@ -274,6 +274,8 @@ An example event for `user` looks as following:
 | data_stream.dataset | Data stream dataset. | constant_keyword |
 | data_stream.namespace | Data stream namespace. | constant_keyword |
 | data_stream.type | Data stream type. | constant_keyword |
+| entityanalytics_okta.groups.id | The ID for the group. | keyword |
+| entityanalytics_okta.groups.profile.\* | Group profile details. | object |
 | entityanalytics_okta.user._embedded | embedded resources related to the user. | flattened |
 | entityanalytics_okta.user._links | link relations for the user's current status. | flattened |
 | entityanalytics_okta.user.activated | timestamp when transition to ACTIVE status completed. | date |

diff --git a/packages/entityanalytics_okta/manifest.yml b/packages/entityanalytics_okta/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: entityanalytics_okta
 title: Okta Entity Analytics
-version: "1.4.0"
+version: "1.5.0"
 description: "Collect User Identities from Okta with Elastic Agent."
 type: integration
 categories: