Validate identity alias-linking and refactor#265
Merged
Conversation
Reworks `identity_population` from a setup-only MVP into a dual-mode target controlled by `link_userpass_auth` (default `false`). When enabled, setup now creates both userpass users and entity aliases, performs a one-shot login resolution check against the expected entity ID, and the attack phase sends randomized userpass login POSTs instead of a fixed health-check placeholder. The auth-link helper was expanded to support user creation and shared password generation, while unused alias bookkeeping APIs were removed from related targets. Docs and fixture config were updated to reflect the new flag, behavior, and example usage.
Refactors identity population setup to reduce redundant state and tighten intent: removes unused fields, uses `identityIDFromResponse` for entity ID parsing, and clarifies progress/completion logging. It also streamlines identity auth-link helper comments, adds a TODO in group-read about unused alias traffic, and rewrites the identity population docs to focus on current behavior and configuration.
Move login-resolution probing into the identity auth link helper and reuse it across identity population and group-read setup. The group-read target now performs a single fail-fast login check when aliases are created, and the population target uses the shared helper instead of duplicating the logic.
Adds focused unit tests for `identityAuthLinkHelper.validateLoginResolution`, covering success, mismatch, missing auth data, login failure, probe-user provisioning, and missing userpass mount handling. Also adds Docker fixture tests for `identity_group_read` and `identity_population` to verify real Vault setup succeeds when alias/login-resolution validation is enabled. Updates identity login target body construction to use `fmt.Appendf` for cleaner byte-slice formatting.
Rename `linkEntityAuth` -> `linkEntity` and `validateLoginResolution` -> `validateLogin` for brevity. Extract `generatePassword` helper, always generate password upfront instead of conditionally. Reorder user creation before alias creation in `linkEntity`. Add TODO comments for future refactoring. Update tests to match new method names and assert password is not clobbered.
Add configurable sampled login checks for identity population and group-read setup, plus cleanup for temporary validation users. Document the new `validation_samples` setting and add tests for the sampling helper.
Replaced `link_userpass_auth` with `link_auth` across the identity population target config, logs, docs, and fixtures to simplify naming. Also moved `sampleIndices` from the identity population file into the shared identity auth link helper and relocated its tests accordingly, keeping behavior the same while improving helper reuse and test organization.
Refactor identity population setup to separate entity creation from attack construction, and marshal the userpass login payload once during setup instead of rebuilding it for every request.
Cleans up identity target and helper comments/TODOs, renames login-validation tests for clarity, and strengthens sampleIndices tests to ensure results vary across calls and cover the full range. It also removes the redundant IdentityPopulation.linkAuth field and makes Target() rely directly on config.LinkAuth, avoiding state drift between setup and runtime behavior.
There was a problem hiding this comment.
Pull request overview
This PR improves the identity benchmarks by turning alias-linking into a verifiable, end-to-end auth flow (userpass login → token → entity resolution), and by letting identity_population generate realistic login traffic rather than a placeholder health check.
Changes:
- Added shared identity↔auth linking + validation helpers (
linkEntity,validateLogin,sampleIndices) and unit tests for the helpers. - Updated
identity_populationto optionally link entities to userpass users/aliases, validate alias resolution via sampled logins, and use logins as the attack workload. - Updated
identity_group_readto validate alias resolution via sampled logins and to clean up probe users created for validation; added Docker acceptance tests and updated fixtures/docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test-fixtures/target_identity_test.go | Adds Docker acceptance tests for identity fixtures to ensure setup + validation passes. |
| test-fixtures/configs/identity_population.hcl | Updates fixture to use link_auth = true and reflect the new login-based workload. |
| docs/tests/identity-population.md | Updates documentation for new parameters and login-based behavior. |
| benchmarktests/target_identity_population.go | Refactors setup, adds auth linking + sampled login validation, and switches attack workload to userpass logins when enabled. |
| benchmarktests/target_identity_group_read.go | Adds sampled login-resolution validation and cleanup of temporary probe users. |
| benchmarktests/identity_auth_link_helper.go | Introduces shared helper utilities for linking entities to auth and validating login resolution. |
| benchmarktests/identity_auth_link_helper_test.go | Adds unit tests for login validation and sampling logic. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
105
to
+111
| if strings.TrimSpace(i.config.UserpassMount) == "" { | ||
| return fmt.Errorf("userpass_mount cannot be empty") | ||
| } | ||
|
|
||
| if i.config.ValidationSamples <= 0 { | ||
| return fmt.Errorf("validation_samples must be greater than 0") | ||
| } |
Comment on lines
94
to
+99
| if testConfig.Config.CreateAliases && testConfig.Config.UserpassMount == "" { | ||
| return fmt.Errorf("userpass_mount cannot be empty when create_aliases is true") | ||
| } | ||
| if testConfig.Config.ValidationSamples <= 0 { | ||
| return fmt.Errorf("validation_samples must be greater than 0") | ||
| } |
Comment on lines
+34
to
+35
| - When `link_auth = true`, setup logs in against a random sample of created users (see `validation_samples`) and fails if any login does not resolve to that user's entity, confirming the alias mapping is correct. | ||
| - Cleanup is deferred in this MVP; created entities are not removed automatically. |
Monkeychip
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validate identity alias linking with real auth flows and make
identity_populationgenerate login traffic.Previously, identity targets created entities and aliases but never verified that alias → entity → user resolution worked. This PR adds validation by performing real userpass logins and confirming they resolve to the expected entity.
identity_populationcan now use those logins as its attack workload.Changes
Added
link_authtoidentity_population:sys/healthattack workload with randomized login requests.link_userpass_authtolink_auth.Added login-resolution validation to
identity_populationandidentity_group_read:validation_samplesoption (default:100, capped atentity_count).Added shared
identity_auth_link_helperutilities:linkEntityvalidateLoginsampleIndicesUpdated
identity_group_read:identity_population.Refactored
identity_population:Setupfor readability.Added
TODO(refactor-pr)markers for follow-up cleanup and naming improvements.Validation
Verified build and test suite:
go build ./...go vet ./benchmarktests/ ./test-fixtures/go test ./benchmarktests/Added unit tests for:
validateLoginsampleIndicesAdded Docker acceptance tests:
TestIdentityPopulation_DockerTestIdentityGroupRead_DockerManually stress-tested both targets against a local Vault instance.
Updated
docs/tests/identity-population.mdand theidentity_populationfixture configuration.Notes
No new dependencies were introduced. Follow-up refactoring (helper consolidation, naming cleanup, setup parallelization, and target consolidation evaluation) is tracked via
TODO(refactor-pr)comments.