1

I am setting up a selenium grid (3.1.0) which serves different teams. Before publishing the grid URL to the teams, I want to make some security measures as below

  1. The grid connection should require an authentication to register the node to the hub. (to avoid external registrations)

  2. Also, authentication required to reach grid(credentials has to be passed through capabilities).

Currently, infra is

Hub: Linux RHEL7 Node: windows 10 Selenium: 3.1.0

Please help me to get some ideas.

FYI: I tried to rebuild the selenium project, I thought it is a complex attempt with a lot of time investment, any open source solutions are suggestible.

Thanks

2 Answers 2

1

To the best of my knowledge there's nothing out there, which will let you do it. That being said, you can build this on your own.

To achieve your first requirement viz.,

The grid connection should require an authentication to register the node to hub. (to avoid external registrations)

Here's how you do it (For the sake of ease, I am copy pasting my answer from another question on SO from here)

  • Create a new marker interface (lets call it as Registrable)
  • Create a new class whose contents duplicate the contents of org.openqa.grid.selenium.proxy.DefaultRemoteProxy (I like to call this approach as CLASSPATH overriding but am sure there's a much more elegant name for this ) such that this new class also is called DefaultRemoteProxy and it resides in the same package org.openqa.grid.selenium.proxy but in your test project.
  • Now inside the constructor add an edit check as shown below.
  • Now create an uber jar out of this project so that it can be used to spin off the Hub.

Here's how Registrable would look like

public interface Registrable {}

Here's how the modified constructor of DefaultRemoteProxy would look like :

public DefaultRemoteProxy(RegistrationRequest request, Registry registry) {
 super(request, registry);
 if (!(this instanceof Registrable)) {
  throw new UnsupportedOperationException("Cannot proceed further");
 }
 pollingInterval = config.nodePolling != null ? config.nodePolling : DEFAULT_POLLING_INTERVAL;
 unregisterDelay = config.unregisterIfStillDownAfter != null ? config.unregisterIfStillDownAfter : DEFAULT_UNREGISTER_DELAY;
 downPollingLimit = config.downPollingLimit != null ? config.downPollingLimit : DEFAULT_DOWN_POLLING_LIMIT;
}

Now you can tweak your custom proxy such that it implements the Registrable interface. So anyone trying to register their node using DefaultRemoteProxy would constantly fail because DefaultRemoteProxy doesn't implement Registrable interface. This would basically prevent people from trying to register their nodes with your hub without this custom proxy implementation.

To achieve your second requirement viz.,

Also authentication required to reach grid(credentials has to be passed through capabilities).

You can do it as follows :

  • Your users would need to add some custom keys to their DesiredCapabilities when instantiating RemoteWebDriver instance. These custom keys could actually be a username/password combination which users could pass in.
  • On the Grid side, you would need to create a custom proxy implementation wherein your override the method org.openqa.grid.internal.BaseRemoteProxy#hasCapability and within it you can inspect the incoming requestedCapability to check if it has the keys (the credentials) and validate them (perhaps against a database or some other data source of your choice) , and if it doesn't then you have this method return false. If the keys exist and are valid, then you delegate the capability matching to a call to super.hasCapability().

That way, if the incoming capabilities don't have the authentication mechanism that you are looking for, the Grid would reject the new session request saying it doesn't match the capabilities of the Grid.

That should do the trick for you.

1
  • For the second question, do you know if there is a way to implement Basic Http Authentication in grid so that I don't have to pass the credentials in DesiredCapability instead I'd do username:[email protected]:4444/wd/hub ? Nov 28, 2017 at 1:51
0

You can always put an API gateway in front of the stack, such as Apigee

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.