From 1b1e1348b5f3d063bb2877ffff23ae2d5802e854 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Date: Thu, 7 May 2020 17:02:30 +0200
Subject: [PATCH] Add Login Selector functional tests.

---
 test/functional/page_objects/common_page.ts   |   6 +-
 test/functional/page_objects/index.ts         |   4 +-
 .../{shield_page.ts => login_page.ts}         |   6 +-
 .../components/login_form/login_form.tsx      |   1 +
 x-pack/scripts/functional_tests.js            |   6 +-
 .../test/functional/apps/security/security.ts |   2 +-
 .../apps/security/trial_license/index.ts      |  15 +
 .../security/trial_license/login_selector.ts  | 100 ++++++
 .../apps/spaces/copy_saved_objects.ts         |   2 +-
 .../functional/apps/spaces/enter_space.ts     |   4 +-
 .../apps/spaces/spaces_selection.ts           |   4 +-
 .../feature_controls/visualize_security.ts    |   5 +-
 ...rity_basic.js => config_security_basic.ts} |   3 +-
 .../test/functional/config_security_trial.ts  |  92 ++++++
 .../page_objects/monitoring_page.js           |   4 +-
 .../{security_page.js => security_page.ts}    | 307 +++++++++++-------
 .../fixtures/saml_provider/kibana.json        |   7 +
 .../fixtures/saml_provider/metadata.xml       |  41 +++
 .../fixtures/saml_provider/server/index.ts    |  14 +
 .../saml_provider/server/init_routes.ts       |  46 +++
 20 files changed, 537 insertions(+), 132 deletions(-)
 rename test/functional/page_objects/{shield_page.ts => login_page.ts} (90%)
 create mode 100644 x-pack/test/functional/apps/security/trial_license/index.ts
 create mode 100644 x-pack/test/functional/apps/security/trial_license/login_selector.ts
 rename x-pack/test/functional/{config_security_basic.js => config_security_basic.ts} (93%)
 create mode 100644 x-pack/test/functional/config_security_trial.ts
 rename x-pack/test/functional/page_objects/{security_page.js => security_page.ts} (62%)
 create mode 100644 x-pack/test/saml_api_integration/fixtures/saml_provider/kibana.json
 create mode 100644 x-pack/test/saml_api_integration/fixtures/saml_provider/metadata.xml
 create mode 100644 x-pack/test/saml_api_integration/fixtures/saml_provider/server/index.ts
 create mode 100644 x-pack/test/saml_api_integration/fixtures/saml_provider/server/init_routes.ts

diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 4a7570049ded737..c591891a846b9e2 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -34,7 +34,7 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
   const find = getService('find');
   const globalNav = getService('globalNav');
   const testSubjects = getService('testSubjects');
-  const PageObjects = getPageObjects(['shield']);
+  const PageObjects = getPageObjects(['login']);
 
   const defaultTryTimeout = config.get('timeouts.try');
   const defaultFindTimeout = config.get('timeouts.find');
@@ -76,12 +76,12 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
       if (loginPage && !wantedLoginPage) {
         log.debug('Found login page');
         if (config.get('security.disableTestUser')) {
-          await PageObjects.shield.login(
+          await PageObjects.login.login(
             config.get('servers.kibana.username'),
             config.get('servers.kibana.password')
           );
         } else {
-          await PageObjects.shield.login('test_user', 'changeme');
+          await PageObjects.login.login('test_user', 'changeme');
         }
 
         await find.byCssSelector(
diff --git a/test/functional/page_objects/index.ts b/test/functional/page_objects/index.ts
index 01301109b80efb5..10b09c742f58e79 100644
--- a/test/functional/page_objects/index.ts
+++ b/test/functional/page_objects/index.ts
@@ -28,7 +28,7 @@ import { HomePageProvider } from './home_page';
 import { NewsfeedPageProvider } from './newsfeed_page';
 import { SettingsPageProvider } from './settings_page';
 import { SharePageProvider } from './share_page';
-import { ShieldPageProvider } from './shield_page';
+import { LoginPageProvider } from './login_page';
 import { TimePickerProvider } from './time_picker';
 import { TimelionPageProvider } from './timelion_page';
 import { VisualBuilderPageProvider } from './visual_builder_page';
@@ -51,7 +51,7 @@ export const pageObjects = {
   newsfeed: NewsfeedPageProvider,
   settings: SettingsPageProvider,
   share: SharePageProvider,
-  shield: ShieldPageProvider,
+  login: LoginPageProvider,
   timelion: TimelionPageProvider,
   timePicker: TimePickerProvider,
   visualBuilder: VisualBuilderPageProvider,
diff --git a/test/functional/page_objects/shield_page.ts b/test/functional/page_objects/login_page.ts
similarity index 90%
rename from test/functional/page_objects/shield_page.ts
rename to test/functional/page_objects/login_page.ts
index 2b9c59373a8bc32..c84f47a342155a2 100644
--- a/test/functional/page_objects/shield_page.ts
+++ b/test/functional/page_objects/login_page.ts
@@ -19,10 +19,10 @@
 
 import { FtrProviderContext } from '../ftr_provider_context';
 
-export function ShieldPageProvider({ getService }: FtrProviderContext) {
+export function LoginPageProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
 
-  class ShieldPage {
+  class LoginPage {
     async login(user: string, pwd: string) {
       await testSubjects.setValue('loginUsername', user);
       await testSubjects.setValue('loginPassword', pwd);
@@ -30,5 +30,5 @@ export function ShieldPageProvider({ getService }: FtrProviderContext) {
     }
   }
 
-  return new ShieldPage();
+  return new LoginPage();
 }
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
index 460c6550085a455..b59547aff24db30 100644
--- a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
@@ -262,6 +262,7 @@ export class LoginForm extends Component<Props, State> {
         {this.props.selector.providers.map(provider => (
           <button
             key={provider.name}
+            data-test-subj={`loginCard-${provider.type}/${provider.name}`}
             disabled={!this.isLoadingState(LoadingStateType.None)}
             onClick={() =>
               provider.usesLoginForm
diff --git a/x-pack/scripts/functional_tests.js b/x-pack/scripts/functional_tests.js
index efe1f859059706b..655f9208e3957a6 100644
--- a/x-pack/scripts/functional_tests.js
+++ b/x-pack/scripts/functional_tests.js
@@ -9,13 +9,15 @@ const alwaysImportedTests = [
   require.resolve('../test/functional_endpoint_ingest_failure/config.ts'),
   require.resolve('../test/functional_endpoint/config.ts'),
   require.resolve('../test/functional_with_es_ssl/config.ts'),
-  require.resolve('../test/functional/config_security_basic.js'),
+  require.resolve('../test/functional/config_security_basic.ts'),
+  require.resolve('../test/functional/config_security_trial.ts'),
   require.resolve('../test/plugin_functional/config.ts'),
 ];
 const onlyNotInCoverageTests = [
   require.resolve('../test/reporting/configs/chromium_api.js'),
   require.resolve('../test/reporting/configs/generate_api.js'),
-  require.resolve('../test/api_integration/config_security_basic.js'),
+  require.resolve('../test/api_integration/config_security_basic.ts'),
+  require.resolve('../test/api_integration/config_security_trial.ts'),
   require.resolve('../test/api_integration/config.js'),
   require.resolve('../test/alerting_api_integration/basic/config.ts'),
   require.resolve('../test/alerting_api_integration/spaces_only/config.ts'),
diff --git a/x-pack/test/functional/apps/security/security.ts b/x-pack/test/functional/apps/security/security.ts
index 3447f77aa7fd614..5bf7bc85eca8be2 100644
--- a/x-pack/test/functional/apps/security/security.ts
+++ b/x-pack/test/functional/apps/security/security.ts
@@ -67,7 +67,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
         });
 
         it('logging out of a non-default space redirects to the login page at the server root', async () => {
-          await PageObjects.security.login(null, null, {
+          await PageObjects.security.login(undefined, undefined, {
             expectSpaceSelector: true,
           });
 
diff --git a/x-pack/test/functional/apps/security/trial_license/index.ts b/x-pack/test/functional/apps/security/trial_license/index.ts
new file mode 100644
index 000000000000000..73c0aec656ea37a
--- /dev/null
+++ b/x-pack/test/functional/apps/security/trial_license/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default function({ loadTestFile }: FtrProviderContext) {
+  describe('security app - login selector - trial license', function() {
+    this.tags('ciGroup4');
+
+    loadTestFile(require.resolve('./login_selector'));
+  });
+}
diff --git a/x-pack/test/functional/apps/security/trial_license/login_selector.ts b/x-pack/test/functional/apps/security/trial_license/login_selector.ts
new file mode 100644
index 000000000000000..00b3a1261290286
--- /dev/null
+++ b/x-pack/test/functional/apps/security/trial_license/login_selector.ts
@@ -0,0 +1,100 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+
+export default function({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const testSubjects = getService('testSubjects');
+  const browser = getService('browser');
+  const PageObjects = getPageObjects(['security', 'common']);
+
+  describe('Login Selector', function() {
+    this.tags('includeFirefox');
+
+    before(async () => {
+      await getService('esSupertest')
+        .post('/_security/role_mapping/saml1')
+        .send({ roles: ['superuser'], enabled: true, rules: { field: { 'realm.name': 'saml1' } } })
+        .expect(200);
+
+      await esArchiver.load('empty_kibana');
+      await PageObjects.security.forceLogout();
+    });
+
+    after(async () => {
+      await esArchiver.unload('empty_kibana');
+    });
+
+    beforeEach(async () => {
+      await browser.get(`${PageObjects.common.getHostPort()}/login`);
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+    });
+
+    afterEach(async () => {
+      await PageObjects.security.forceLogout();
+    });
+
+    it('can login with Login Form', async () => {
+      await PageObjects.security.loginSelector.login('basic', 'basic1');
+    });
+
+    it('can login with SSO', async () => {
+      await PageObjects.security.loginSelector.login('saml', 'saml1');
+    });
+
+    it('should show toast with error if SSO fails', async () => {
+      await PageObjects.common.clearAllToasts();
+      await PageObjects.security.loginSelector.selectLoginMethod('saml', 'unknown_saml');
+
+      const toastTitle = await PageObjects.common.closeToast();
+      expect(toastTitle).to.eql('Could not perform login.');
+
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+    });
+
+    it('can go to Login Form and return back to Selector', async () => {
+      await PageObjects.security.loginSelector.selectLoginMethod('basic', 'basic1');
+      await PageObjects.security.loginSelector.verifyLoginFormIsVisible();
+
+      await testSubjects.click('loginBackToSelector');
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+
+      await PageObjects.security.loginSelector.login('saml', 'saml1');
+    });
+
+    it('can show Login Help from both Login Selector and Login Form', async () => {
+      // Show Login Help from Login Selector.
+      await testSubjects.click('loginHelpLink');
+      await PageObjects.security.loginSelector.verifyLoginHelpIsVisible('Some login help.');
+
+      // Go back to Login Selector.
+      await testSubjects.click('loginBackToLoginLink');
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+
+      // Go to Login Form and show Login Help there.
+      await PageObjects.security.loginSelector.selectLoginMethod('basic', 'basic1');
+      await PageObjects.security.loginSelector.verifyLoginFormIsVisible();
+      await testSubjects.click('loginHelpLink');
+      await PageObjects.security.loginSelector.verifyLoginHelpIsVisible('Some login help.');
+
+      // Go back to Login Form.
+      await testSubjects.click('loginBackToLoginLink');
+      await PageObjects.security.loginSelector.verifyLoginFormIsVisible();
+
+      // Go back to Login Selector and show Login Help there again.
+      await testSubjects.click('loginBackToSelector');
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+      await testSubjects.click('loginHelpLink');
+      await PageObjects.security.loginSelector.verifyLoginHelpIsVisible('Some login help.');
+
+      // Go back to Login Selector.
+      await testSubjects.click('loginBackToLoginLink');
+      await PageObjects.security.loginSelector.verifyLoginSelectorIsVisible();
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/spaces/copy_saved_objects.ts b/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
index 0b5718e92e38e7c..0f9fa2aed164acf 100644
--- a/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
+++ b/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
@@ -32,7 +32,7 @@ export default function spaceSelectorFunctonalTests({
         disabledFeatures: [],
       });
 
-      await PageObjects.security.login(null, null, {
+      await PageObjects.security.login(undefined, undefined, {
         expectSpaceSelector: true,
       });
 
diff --git a/x-pack/test/functional/apps/spaces/enter_space.ts b/x-pack/test/functional/apps/spaces/enter_space.ts
index d45b8a1ea4cdb7e..77d2db6c00c91ea 100644
--- a/x-pack/test/functional/apps/spaces/enter_space.ts
+++ b/x-pack/test/functional/apps/spaces/enter_space.ts
@@ -27,7 +27,7 @@ export default function enterSpaceFunctonalTests({
     it('falls back to the default home page when the configured default route is malformed', async () => {
       const spaceId = 'default';
 
-      await PageObjects.security.login(null, null, {
+      await PageObjects.security.login(undefined, undefined, {
         expectSpaceSelector: true,
       });
 
@@ -39,7 +39,7 @@ export default function enterSpaceFunctonalTests({
     it('allows user to navigate to different spaces, respecting the configured default route', async () => {
       const spaceId = 'another-space';
 
-      await PageObjects.security.login(null, null, {
+      await PageObjects.security.login(undefined, undefined, {
         expectSpaceSelector: true,
       });
 
diff --git a/x-pack/test/functional/apps/spaces/spaces_selection.ts b/x-pack/test/functional/apps/spaces/spaces_selection.ts
index b88311597d76575..9b81d4714fdebc0 100644
--- a/x-pack/test/functional/apps/spaces/spaces_selection.ts
+++ b/x-pack/test/functional/apps/spaces/spaces_selection.ts
@@ -36,7 +36,7 @@ export default function spaceSelectorFunctonalTests({
       it('allows user to navigate to different spaces', async () => {
         const spaceId = 'another-space';
 
-        await PageObjects.security.login(null, null, {
+        await PageObjects.security.login(undefined, undefined, {
           expectSpaceSelector: true,
         });
 
@@ -67,7 +67,7 @@ export default function spaceSelectorFunctonalTests({
 
       before(async () => {
         await esArchiver.load('spaces/selector');
-        await PageObjects.security.login(null, null, {
+        await PageObjects.security.login(undefined, undefined, {
           expectSpaceSelector: true,
         });
         await PageObjects.spaceSelector.clickSpaceCard('default');
diff --git a/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts b/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
index 8b2a0e0d6517d54..7edfb3e72f51762 100644
--- a/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
+++ b/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
@@ -408,10 +408,7 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
         await PageObjects.security.login(
           'no_visualize_privileges_user',
           'no_visualize_privileges_user-password',
-          {
-            expectSpaceSelector: false,
-            shouldLoginIfPrompted: false,
-          }
+          { expectSpaceSelector: false }
         );
       });
 
diff --git a/x-pack/test/functional/config_security_basic.js b/x-pack/test/functional/config_security_basic.ts
similarity index 93%
rename from x-pack/test/functional/config_security_basic.js
rename to x-pack/test/functional/config_security_basic.ts
index 2bb59796b551794..185c41c48e11514 100644
--- a/x-pack/test/functional/config_security_basic.js
+++ b/x-pack/test/functional/config_security_basic.ts
@@ -8,12 +8,13 @@
 
 import { resolve } from 'path';
 
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
 import { services } from './services';
 import { pageObjects } from './page_objects';
 
 // the default export of config files must be a config provider
 // that returns an object with the projects config values
-export default async function({ readConfigFile }) {
+export default async function({ readConfigFile }: FtrConfigProviderContext) {
   const kibanaCommonConfig = await readConfigFile(
     require.resolve('../../../test/common/config.js')
   );
diff --git a/x-pack/test/functional/config_security_trial.ts b/x-pack/test/functional/config_security_trial.ts
new file mode 100644
index 000000000000000..dc81c0bf1675cc9
--- /dev/null
+++ b/x-pack/test/functional/config_security_trial.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable import/no-default-export */
+
+import { resolve } from 'path';
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+import { services } from './services';
+import { pageObjects } from './page_objects';
+
+// the default export of config files must be a config provider
+// that returns an object with the projects config values
+export default async function({ readConfigFile }: FtrConfigProviderContext) {
+  const kibanaCommonConfig = await readConfigFile(
+    require.resolve('../../../test/common/config.js')
+  );
+  const kibanaFunctionalConfig = await readConfigFile(
+    require.resolve('../../../test/functional/config.js')
+  );
+
+  const kibanaPort = kibanaFunctionalConfig.get('servers.kibana.port');
+  const idpPath = resolve(__dirname, '../saml_api_integration/fixtures/saml_provider/metadata.xml');
+  const samlIdPPlugin = resolve(__dirname, '../saml_api_integration/fixtures/saml_provider');
+
+  return {
+    testFiles: [resolve(__dirname, './apps/security/trial_license')],
+
+    services,
+    pageObjects,
+
+    servers: kibanaFunctionalConfig.get('servers'),
+
+    esTestCluster: {
+      license: 'trial',
+      from: 'snapshot',
+      serverArgs: [
+        'xpack.security.authc.token.enabled=true',
+        'xpack.security.authc.realms.saml.saml1.order=0',
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${idpPath}`,
+        'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
+        `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
+        `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,
+        `xpack.security.authc.realms.saml.saml1.sp.acs=http://localhost:${kibanaPort}/api/security/saml/callback`,
+        'xpack.security.authc.realms.saml.saml1.attributes.principal=urn:oid:0.0.7',
+      ],
+    },
+
+    kbnTestServer: {
+      ...kibanaCommonConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...kibanaCommonConfig.get('kbnTestServer.serverArgs'),
+        `--plugin-path=${samlIdPPlugin}`,
+        '--server.uuid=5b2de169-2785-441b-ae8c-186a1936b17d',
+        '--xpack.security.encryptionKey="wuGNaIhoMpk5sO4UBxgr3NyW1sFcLgIf"',
+        `--xpack.security.loginHelp="Some **login** help."`,
+        `--xpack.security.authc.providers=${JSON.stringify({
+          basic: { basic1: { order: 0 } },
+          saml: {
+            saml1: {
+              order: 1,
+              realm: 'saml1',
+              description: 'Log in with SAML',
+              icon: 'logoKibana',
+            },
+            unknown_saml: {
+              order: 2,
+              realm: 'unknown_realm',
+              description: 'Do not log in with THIS SAML',
+              icon: 'logoAWS',
+            },
+          },
+        })}`,
+      ],
+    },
+    uiSettings: {
+      defaults: {
+        'accessibility:disableAnimations': true,
+        'dateFormat:tz': 'UTC',
+      },
+    },
+    apps: kibanaFunctionalConfig.get('apps'),
+    esArchiver: { directory: resolve(__dirname, 'es_archives') },
+    screenshots: { directory: resolve(__dirname, 'screenshots') },
+
+    junit: {
+      reportName: 'Chrome X-Pack UI Functional Tests',
+    },
+  };
+}
diff --git a/x-pack/test/functional/page_objects/monitoring_page.js b/x-pack/test/functional/page_objects/monitoring_page.js
index 323c01e2348805a..ece0c0a6c785431 100644
--- a/x-pack/test/functional/page_objects/monitoring_page.js
+++ b/x-pack/test/functional/page_objects/monitoring_page.js
@@ -5,7 +5,7 @@
  */
 
 export function MonitoringPageProvider({ getPageObjects, getService }) {
-  const PageObjects = getPageObjects(['common', 'header', 'security', 'shield', 'spaceSelector']);
+  const PageObjects = getPageObjects(['common', 'header', 'security', 'login', 'spaceSelector']);
   const testSubjects = getService('testSubjects');
   const security = getService('security');
 
@@ -20,7 +20,7 @@ export function MonitoringPageProvider({ getPageObjects, getService }) {
 
       if (!useSuperUser) {
         await PageObjects.security.forceLogout();
-        await PageObjects.shield.login('basic_monitoring_user', 'monitoring_user_password');
+        await PageObjects.login.login('basic_monitoring_user', 'monitoring_user_password');
       }
       await PageObjects.common.navigateToApp('monitoring');
     }
diff --git a/x-pack/test/functional/page_objects/security_page.js b/x-pack/test/functional/page_objects/security_page.ts
similarity index 62%
rename from x-pack/test/functional/page_objects/security_page.js
rename to x-pack/test/functional/page_objects/security_page.ts
index ae26a831d417232..5f29d4fff548a6b 100644
--- a/x-pack/test/functional/page_objects/security_page.js
+++ b/x-pack/test/functional/page_objects/security_page.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { map as mapAsync } from 'bluebird';
+import { FtrProviderContext } from '../ftr_provider_context';
+import { Role } from '../../../plugins/security/common/model';
 
-export function SecurityPageProvider({ getService, getPageObjects }) {
+export function SecurityPageProvider({ getService, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const config = getService('config');
   const retry = getService('retry');
@@ -17,53 +18,114 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
   const userMenu = getService('userMenu');
   const PageObjects = getPageObjects(['common', 'header', 'settings', 'home', 'error']);
 
-  class LoginPage {
-    async login(username, password, options = {}) {
-      const [superUsername, superPassword] = config.get('servers.elasticsearch.auth').split(':');
+  interface LoginOptions {
+    expectSpaceSelector?: boolean;
+    expectSuccess?: boolean;
+    expectForbidden?: boolean;
+  }
+
+  type LoginExpectedResult = 'spaceSelector' | 'error' | 'chrome';
+
+  async function waitForLoginPage() {
+    await retry.waitForWithTimeout('login page', config.get('timeouts.waitFor') * 5, async () => {
+      const alert = await browser.getAlert();
+      if (alert && alert.accept) {
+        await alert.accept();
+      }
+      return await find.existsByDisplayedByCssSelector('.login-form');
+    });
+  }
+
+  async function waitForLoginForm() {
+    log.debug('Waiting for Login Form to appear.');
+    await retry.waitForWithTimeout('login form', config.get('timeouts.waitFor') * 5, async () => {
+      const alert = await browser.getAlert();
+      if (alert && alert.accept) {
+        await alert.accept();
+      }
+
+      return await testSubjects.exists('loginForm');
+    });
+  }
 
-      username = username || superUsername;
-      password = password || superPassword;
+  async function waitForLoginSelector() {
+    log.debug('Waiting for Login Selector to appear.');
+    await retry.waitForWithTimeout(
+      'login selector',
+      config.get('timeouts.waitFor') * 5,
+      async () => {
+        return await testSubjects.exists('loginSelector');
+      }
+    );
+  }
+
+  async function waitForLoginHelp(helpText: string) {
+    log.debug(`Waiting for Login Help to appear with text: ${helpText}.`);
+    await retry.waitForWithTimeout('login help', config.get('timeouts.waitFor') * 5, async () => {
+      return (await testSubjects.getVisibleText('loginHelp')) === helpText;
+    });
+  }
+
+  async function waitForLoginResult(expectedResult?: LoginExpectedResult) {
+    log.debug(`Waiting for login result, expected: ${expectedResult}.`);
+
+    // wait for either space selector, kibanaChrome or loginErrorMessage
+    if (expectedResult === 'spaceSelector') {
+      await retry.try(() => testSubjects.find('kibanaSpaceSelector'));
+      log.debug(
+        `Finished login process, landed on space selector. currentUrl = ${await browser.getCurrentUrl()}`
+      );
+      return;
+    }
 
-      const expectSpaceSelector = options.expectSpaceSelector || false;
-      const expectSuccess = options.expectSuccess;
-      const expectForbidden = options.expectForbidden || false;
+    if (expectedResult === 'error') {
       const rawDataTabLocator = 'a[id=rawdata-tab]';
+      if (await find.existsByCssSelector(rawDataTabLocator)) {
+        // Firefox has 3 tabs and requires navigation to see Raw output
+        await find.clickByCssSelector(rawDataTabLocator);
+      }
+      await retry.try(async () => {
+        if (await find.existsByCssSelector(rawDataTabLocator)) {
+          await find.clickByCssSelector(rawDataTabLocator);
+        }
+        await PageObjects.error.expectForbidden();
+      });
+      log.debug(
+        `Finished login process, found forbidden message. currentUrl = ${await browser.getCurrentUrl()}`
+      );
+      return;
+    }
 
+    if (expectedResult === 'chrome') {
+      await find.byCssSelector('[data-test-subj="kibanaChrome"] nav:not(.ng-hide) ', 20000);
+      log.debug(`Finished login process currentUrl = ${await browser.getCurrentUrl()}`);
+    }
+  }
+
+  const loginPage = Object.freeze({
+    async login(username?: string, password?: string, options: LoginOptions = {}) {
       await PageObjects.common.navigateToApp('login');
 
       // ensure welcome screen won't be shown. This is relevant for environments which don't allow
       // to use the yml setting, e.g. cloud
       await browser.setLocalStorageItem('home:welcome:show', 'false');
+      await waitForLoginForm();
 
-      await testSubjects.setValue('loginUsername', username);
-      await testSubjects.setValue('loginPassword', password);
+      const [superUsername, superPassword] = config.get('servers.elasticsearch.auth').split(':');
+      await testSubjects.setValue('loginUsername', username || superUsername);
+      await testSubjects.setValue('loginPassword', password || superPassword);
       await testSubjects.click('loginSubmit');
 
-      // wait for either space selector, kibanaChrome or loginErrorMessage
-      if (expectSpaceSelector) {
-        await retry.try(() => testSubjects.find('kibanaSpaceSelector'));
-        log.debug(
-          `Finished login process, landed on space selector. currentUrl = ${await browser.getCurrentUrl()}`
-        );
-      } else if (expectForbidden) {
-        if (await find.existsByCssSelector(rawDataTabLocator)) {
-          // Firefox has 3 tabs and requires navigation to see Raw output
-          await find.clickByCssSelector(rawDataTabLocator);
-        }
-        await retry.try(async () => {
-          if (await find.existsByCssSelector(rawDataTabLocator)) {
-            await find.clickByCssSelector(rawDataTabLocator);
-          }
-          await PageObjects.error.expectForbidden();
-        });
-        log.debug(
-          `Finished login process, found forbidden message. currentUrl = ${await browser.getCurrentUrl()}`
-        );
-      } else if (expectSuccess) {
-        await find.byCssSelector('[data-test-subj="kibanaChrome"] nav:not(.ng-hide) ', 20000);
-        log.debug(`Finished login process currentUrl = ${await browser.getCurrentUrl()}`);
-      }
-    }
+      await waitForLoginResult(
+        options.expectSpaceSelector
+          ? 'spaceSelector'
+          : options.expectForbidden
+          ? 'error'
+          : options.expectSuccess
+          ? 'chrome'
+          : undefined
+      );
+    },
 
     async getErrorMessage() {
       return await retry.try(async () => {
@@ -76,13 +138,53 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
 
         return errorMessageText;
       });
-    }
-  }
+    },
+  });
+
+  const loginSelector = Object.freeze({
+    async login(providerType: string, providerName: string, options?: Record<string, any>) {
+      log.debug(`Starting login flow for ${providerType}/${providerName}`);
+
+      await this.verifyLoginSelectorIsVisible();
+      await this.selectLoginMethod(providerType, providerName);
+
+      if (providerType === 'basic' || providerType === 'token') {
+        await waitForLoginForm();
+
+        const [superUsername, superPassword] = config.get('servers.elasticsearch.auth').split(':');
+        await testSubjects.setValue('loginUsername', options?.username ?? superUsername);
+        await testSubjects.setValue('loginPassword', options?.password ?? superPassword);
+        await testSubjects.click('loginSubmit');
+      }
+
+      await waitForLoginResult('chrome');
+
+      log.debug(`Finished login process currentUrl = ${await browser.getCurrentUrl()}`);
+    },
+
+    async selectLoginMethod(providerType: string, providerName: string) {
+      // Ensure welcome screen won't be shown. This is relevant for environments which don't allow
+      // to use the yml setting, e.g. cloud.
+      await browser.setLocalStorageItem('home:welcome:show', 'false');
+      await testSubjects.click(`loginCard-${providerType}/${providerName}`);
+    },
+
+    async verifyLoginFormIsVisible() {
+      await waitForLoginForm();
+    },
+
+    async verifyLoginSelectorIsVisible() {
+      await waitForLoginSelector();
+    },
+
+    async verifyLoginHelpIsVisible(helpText: string) {
+      await waitForLoginHelp(helpText);
+    },
+  });
 
   class SecurityPage {
-    constructor() {
-      this.loginPage = new LoginPage();
-    }
+    public loginPage = loginPage;
+    public loginSelector = loginSelector;
 
     async initTests() {
       log.debug('SecurityPage:initTests');
@@ -91,7 +193,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       await browser.setWindowSize(1600, 1000);
     }
 
-    async login(username, password, options = {}) {
+    async login(username?: string, password?: string, options: LoginOptions = {}) {
       await this.loginPage.login(username, password, options);
 
       if (options.expectSpaceSelector || options.expectForbidden) {
@@ -110,7 +212,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       }
 
       await userMenu.clickLogoutButton();
-      await this.waitForLoginForm();
+      await waitForLoginPage();
     }
 
     async forceLogout() {
@@ -124,17 +226,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       const url = PageObjects.common.getHostPort() + '/logout';
       await browser.get(url);
       log.debug('Waiting on the login form to appear');
-      await this.waitForLoginForm();
-    }
-
-    async waitForLoginForm() {
-      await retry.waitForWithTimeout('login form', config.get('timeouts.waitFor') * 5, async () => {
-        const alert = await browser.getAlert();
-        if (alert && alert.accept) {
-          await alert.accept();
-        }
-        return await find.existsByDisplayedByCssSelector('.login-form');
-      });
+      await waitForLoginPage();
     }
 
     async clickRolesSection() {
@@ -153,14 +245,10 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       await retry.try(() => testSubjects.click('createRoleButton'));
     }
 
-    async clickCloneRole(roleName) {
+    async clickCloneRole(roleName: string) {
       await retry.try(() => testSubjects.click(`clone-role-action-${roleName}`));
     }
 
-    async getCreateIndexPatternInputFieldExists() {
-      return await testSubjects.exists('createIndexPatternNameInput');
-    }
-
     async clickCancelEditUser() {
       await testSubjects.click('userFormCancelButton');
     }
@@ -181,7 +269,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
-    async addIndexToRole(index) {
+    async addIndexToRole(index: string) {
       log.debug(`Adding index ${index} to role`);
       const indexInput = await retry.try(() =>
         find.byCssSelector('[data-test-subj="indicesInput0"] input')
@@ -190,7 +278,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       await indexInput.type('\n');
     }
 
-    async addPrivilegeToRole(privilege) {
+    async addPrivilegeToRole(privilege: string) {
       log.debug(`Adding privilege ${privilege} to role`);
       const privilegeInput = await retry.try(() =>
         find.byCssSelector('[data-test-subj="privilegesInput0"] input')
@@ -208,7 +296,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       // await options.click();
     }
 
-    async assignRoleToUser(role) {
+    async assignRoleToUser(role: string) {
       await this.selectRole(role);
     }
 
@@ -227,8 +315,8 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
     }
 
     async getElasticsearchUsers() {
-      const users = await testSubjects.findAll('userRow');
-      return mapAsync(users, async user => {
+      const users = [];
+      for (const user of await testSubjects.findAll('userRow')) {
         const fullnameElement = await user.findByTestSubject('userRowFullName');
         const usernameElement = await user.findByTestSubject('userRowUserName');
         const emailElement = await user.findByTestSubject('userRowEmail');
@@ -237,20 +325,22 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
         const isUserReserved = (await user.findAllByTestSubject('userReserved', 1)).length > 0;
         const isUserDeprecated = (await user.findAllByTestSubject('userDeprecated', 1)).length > 0;
 
-        return {
+        users.push({
           username: await usernameElement.getVisibleText(),
           fullname: await fullnameElement.getVisibleText(),
           email: await emailElement.getVisibleText(),
           roles: (await rolesElement.getVisibleText()).split('\n').map(role => role.trim()),
           reserved: isUserReserved,
           deprecated: isUserDeprecated,
-        };
-      });
+        });
+      }
+
+      return users;
     }
 
     async getElasticsearchRoles() {
-      const users = await testSubjects.findAll('roleRow');
-      return mapAsync(users, async role => {
+      const roles = [];
+      for (const role of await testSubjects.findAll('roleRow')) {
         const [rolename, reserved, deprecated] = await Promise.all([
           role.findByTestSubject('roleRowName').then(el => el.getVisibleText()),
           // findAll is substantially faster than `find.descendantExistsByCssSelector for negative cases
@@ -259,12 +349,10 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
           role.findAllByTestSubject('roleDeprecated', 1).then(el => el.length > 0),
         ]);
 
-        return {
-          rolename,
-          reserved,
-          deprecated,
-        };
-      });
+        roles.push({ rolename, reserved, deprecated });
+      }
+
+      return roles;
     }
 
     async clickNewUser() {
@@ -275,7 +363,15 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       return await testSubjects.click('createRoleButton');
     }
 
-    async addUser(userObj) {
+    async addUser(userObj: {
+      username: string;
+      password: string;
+      confirmPassword: string;
+      email: string;
+      fullname: string;
+      roles: string[];
+      save?: boolean;
+    }) {
       const self = this;
       await this.clickNewUser();
       log.debug('username = ' + userObj.username);
@@ -302,35 +398,36 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       }
     }
 
-    addRole(roleName, userObj) {
+    addRole(roleName: string, roleObj: Role) {
       const self = this;
 
       return (
         this.clickNewRole()
           .then(function() {
             // We have to use non-test-subject selectors because this markup is generated by ui-select.
-            log.debug('userObj.indices[0].names = ' + userObj.elasticsearch.indices[0].names);
+            log.debug('roleObj.indices[0].names = ' + roleObj.elasticsearch.indices[0].names);
             return testSubjects.append('roleFormNameInput', roleName);
           })
           .then(function() {
             return find.setValue(
               '[data-test-subj="indicesInput0"] input',
-              userObj.elasticsearch.indices[0].names + '\n'
+              roleObj.elasticsearch.indices[0].names + '\n'
             );
           })
           .then(function() {
             return testSubjects.click('restrictDocumentsQuery0');
           })
           .then(function() {
-            if (userObj.elasticsearch.indices[0].query) {
-              return testSubjects.setValue('queryInput0', userObj.elasticsearch.indices[0].query);
+            if (roleObj.elasticsearch.indices[0].query) {
+              return testSubjects.setValue('queryInput0', roleObj.elasticsearch.indices[0].query);
             }
           })
 
-          //KibanaPriv
-          .then(function() {
-            function addKibanaPriv(priv) {
-              return priv.reduce(async function(promise, privName) {
+          // KibanaPrivilege
+          .then(async () => {
+            const globalPrivileges = (roleObj.kibana as any).global;
+            if (globalPrivileges) {
+              for (const privilegeName of globalPrivileges) {
                 const button = await testSubjects.find('addSpacePrivilegeButton');
                 await button.click();
 
@@ -343,33 +440,30 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
                 const basePrivilegeSelector = await testSubjects.find('basePrivilegeComboBox');
                 await basePrivilegeSelector.click();
 
-                const privilegeOption = await find.byCssSelector(`#basePrivilege_${privName}`);
+                const privilegeOption = await find.byCssSelector(`#basePrivilege_${privilegeName}`);
                 await privilegeOption.click();
 
                 const createPrivilegeButton = await testSubjects.find('createSpacePrivilegeButton');
                 await createPrivilegeButton.click();
-
-                return promise;
-              }, Promise.resolve());
+              }
             }
-            return userObj.kibana.global ? addKibanaPriv(userObj.kibana.global) : Promise.resolve();
           })
 
           .then(function() {
-            function addPriv(priv) {
-              return priv.reduce(function(promise, privName) {
+            function addPrivilege(privileges: string[]) {
+              return privileges.reduce(function(promise: Promise<any>, privilegeName: string) {
                 // We have to use non-test-subject selectors because this markup is generated by ui-select.
                 return promise
-                  .then(() => self.addPrivilegeToRole(privName))
+                  .then(() => self.addPrivilegeToRole(privilegeName))
                   .then(() => PageObjects.common.sleep(250));
               }, Promise.resolve());
             }
-            return addPriv(userObj.elasticsearch.indices[0].privileges);
+            return addPrivilege(roleObj.elasticsearch.indices[0].privileges);
           })
-          //clicking the Granted fields and removing the asterix
+          // clicking the Granted fields and removing the asterix
           .then(async function() {
-            function addGrantedField(field) {
-              return field.reduce(function(promise, fieldName) {
+            function addGrantedField(field: string[]) {
+              return field.reduce(function(promise: Promise<any>, fieldName: string) {
                 return promise
                   .then(function() {
                     return find.setValue('[data-test-subj="fieldInput0"] input', fieldName + '\n');
@@ -380,7 +474,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
               }, Promise.resolve());
             }
 
-            if (userObj.elasticsearch.indices[0].field_security) {
+            if (roleObj.elasticsearch.indices[0].field_security) {
               // Toggle FLS switch
               await testSubjects.click('restrictFieldsQuery0');
 
@@ -390,10 +484,10 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
                   'div[data-test-subj="fieldInput0"] [title="Remove * from selection in this group"] svg.euiIcon'
                 )
                 .then(function() {
-                  return addGrantedField(userObj.elasticsearch.indices[0].field_security.grant);
+                  return addGrantedField(roleObj.elasticsearch.indices[0].field_security!.grant!);
                 });
             }
-          }) //clicking save button
+          }) // clicking save button
           .then(async () => {
             log.debug('click save button');
             await testSubjects.click('roleFormSaveButton');
@@ -404,7 +498,7 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       );
     }
 
-    async selectRole(role) {
+    async selectRole(role: string) {
       const dropdown = await testSubjects.find('rolesDropdown');
       const input = await dropdown.findByCssSelector('input');
       await input.type(role);
@@ -413,8 +507,8 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       await testSubjects.find(`roleOption-${role}`);
     }
 
-    deleteUser(username) {
-      let alertText;
+    deleteUser(username: string) {
+      let alertText: string;
       log.debug('Delete user ' + username);
       return find
         .clickByDisplayedLinkText(username)
@@ -440,11 +534,6 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
           return alertText;
         });
     }
-
-    async getPermissionDeniedMessage() {
-      const el = await find.displayedByCssSelector('span.kuiInfoPanelHeader__title');
-      return await el.getVisibleText();
-    }
   }
   return new SecurityPage();
 }
diff --git a/x-pack/test/saml_api_integration/fixtures/saml_provider/kibana.json b/x-pack/test/saml_api_integration/fixtures/saml_provider/kibana.json
new file mode 100644
index 000000000000000..3cbd37e38bb2da9
--- /dev/null
+++ b/x-pack/test/saml_api_integration/fixtures/saml_provider/kibana.json
@@ -0,0 +1,7 @@
+{
+  "id": "saml_provider_plugin",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": false
+}
diff --git a/x-pack/test/saml_api_integration/fixtures/saml_provider/metadata.xml b/x-pack/test/saml_api_integration/fixtures/saml_provider/metadata.xml
new file mode 100644
index 000000000000000..19a6c1326414496
--- /dev/null
+++ b/x-pack/test/saml_api_integration/fixtures/saml_provider/metadata.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+                     entityID="http://www.elastic.co/saml1">
+  <md:IDPSSODescriptor WantAuthnRequestsSigned="false"
+                       protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
+          <ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVANNWkg9lzNiLqNkMFhFKHcXyaZmqMA0GCSqGSIb3DQEB
+CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
+ZXJhdGVkIENBMCAXDTE5MTIyNzE3MDM0MloYDzIwNjkxMjE0MTcwMzQyWjARMQ8w
+DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCQ
+wYYbQtbRBKJ4uNZc2+IgRU+7NNL21ZebQlEIMgK7jAqOMrsW2b5DATz41Fd+GQFU
+FUYYjwo+PQj6sJHshOJo/gNb32HrydvMI7YPvevkszkuEGCfXxQ3Dw2RTACLgD0Q
+OCkwHvn3TMf0loloV/ePGWaZDYZaXi3a5DdWi/HFFoJysgF0JV2f6XyKhJkGaEfJ
+s9pWX269zH/XQvGNx4BEimJpYB8h4JnDYPFIiQdqj+sl2b+kS1hH9kL5gBAMXjFU
+vcNnX+PmyTjyJrGo75k0ku+spBf1bMwuQt3uSmM+TQIXkvFDmS0DOVESrpA5EC1T
+BUGRz6o/I88Xx4Mud771AgMBAAGjYzBhMB0GA1UdDgQWBBQLB1Eo23M3Ss8MsFaz
+V+Twcb3PmDAfBgNVHSMEGDAWgBQa7SYOe8NGcF00EbwPHA91YCsHSTAUBgNVHREE
+DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEAnEl/
+z5IElIjvkK4AgMPrNcRlvIGDt2orEik7b6Jsq6/RiJQ7cSsYTZf7xbqyxNsUOTxv
++frj47MEN448H2nRvUxH29YR3XygV5aEwADSAhwaQWn0QfWTCZbJTmSoNEDtDOzX
+TGDlAoCD9s9Xz9S1JpxY4H+WWRZrBSDM6SC1c6CzuEeZRuScNAjYD5mh2v6fOlSy
+b8xJWSg0AFlJPCa3ZsA2SKbNqI0uNfJTnkXRm88Z2NHcgtlADbOLKauWfCrpgsCk
+cZgo6yAYkOM148h/8wGla1eX+iE1R72NUABGydu8MSQKvc0emWJkGsC1/KqPlf/O
+eOUsdwn1yDKHRxDHyA==
+          </ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                            Location="/saml_provider/logout"/>
+    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+                            Location="/saml_provider/logout"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                            Location="/saml_provider/login"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+                            Location="/saml_provider/login"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>
diff --git a/x-pack/test/saml_api_integration/fixtures/saml_provider/server/index.ts b/x-pack/test/saml_api_integration/fixtures/saml_provider/server/index.ts
new file mode 100644
index 000000000000000..7c3bc5d03216042
--- /dev/null
+++ b/x-pack/test/saml_api_integration/fixtures/saml_provider/server/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializer } from '../../../../../../src/core/server';
+import { initRoutes } from './init_routes';
+
+export const plugin: PluginInitializer<void, void> = () => ({
+  setup: core => initRoutes(core),
+  start: () => {},
+  stop: () => {},
+});
diff --git a/x-pack/test/saml_api_integration/fixtures/saml_provider/server/init_routes.ts b/x-pack/test/saml_api_integration/fixtures/saml_provider/server/init_routes.ts
new file mode 100644
index 000000000000000..5777aa3f423f0cd
--- /dev/null
+++ b/x-pack/test/saml_api_integration/fixtures/saml_provider/server/init_routes.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup } from '../../../../../../src/core/server';
+import { getSAMLResponse, getSAMLRequestId } from '../../saml_tools';
+
+export function initRoutes(core: CoreSetup) {
+  const serverInfo = core.http.getServerInfo();
+  core.http.resources.register(
+    {
+      path: '/saml_provider/login',
+      validate: false,
+      options: { authRequired: false },
+    },
+    async (context, request, response) => {
+      const samlResponse = await getSAMLResponse({
+        inResponseTo: await getSAMLRequestId(request.url.href!),
+        destination: `${serverInfo.protocol}://${serverInfo.host}:${serverInfo.port}/api/security/saml/callback`,
+      });
+
+      return response.renderHtml({
+        body: `
+          <!DOCTYPE html>
+          <title>Kibana SAML Login</title>
+          <link rel="icon" href="data:,">
+          <script defer src="/saml_provider/login/submit.js"></script>
+          <body>
+            <form id="loginForm" method="post" action="/api/security/saml/callback">
+                <input name="SAMLResponse" type="hidden" value="${samlResponse}" />
+            </form>
+          </body>
+        `,
+      });
+    }
+  );
+
+  core.http.resources.register(
+    { path: '/saml_provider/login/submit.js', validate: false, options: { authRequired: false } },
+    (context, request, response) => {
+      return response.renderJs({ body: 'document.getElementById("loginForm").submit();' });
+    }
+  );
+}