Skip to content

Commit

Permalink
Implement new extension points in IdentityPlugin and add ContextProvi…
Browse files Browse the repository at this point in the history
…dingPluginSubject (#4896)

Signed-off-by: Craig Perkins <[email protected]>
  • Loading branch information
cwperks authored Jan 14, 2025
1 parent 3e62dc9 commit 1924e41
Show file tree
Hide file tree
Showing 33 changed files with 1,424 additions and 64 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import org.opensearch.common.xcontent.XContentFactory;
import org.opensearch.core.rest.RestStatus;
import org.opensearch.core.xcontent.XContentBuilder;
import org.opensearch.security.http.ExampleSystemIndexPlugin;
import org.opensearch.test.framework.TestSecurityConfig.AuthcDomain;
import org.opensearch.test.framework.cluster.ClusterManager;
import org.opensearch.test.framework.cluster.LocalCluster;
Expand All @@ -47,7 +46,6 @@ public class ThreadPoolTests {
.anonymousAuth(false)
.authc(AUTHC_DOMAIN)
.users(USER_ADMIN)
.plugin(ExampleSystemIndexPlugin.class)
.nodeSettings(Map.of(SECURITY_RESTAPI_ROLES_ENABLED, List.of("user_" + USER_ADMIN.getName() + "__" + ALL_ACCESS.getName())))
.build();

Expand Down

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,28 @@ public void wildcard() throws Exception {
);
}

@Test
public void wildcardByUsername() throws Exception {
SecurityDynamicConfiguration<RoleV7> roles = SecurityDynamicConfiguration.empty(CType.ROLES);

ActionPrivileges subject = new ActionPrivileges(
roles,
FlattenedActionGroups.EMPTY,
null,
Settings.EMPTY,
Map.of("plugin:org.opensearch.sample.SamplePlugin", Set.of("*"))
);

assertThat(
subject.hasClusterPrivilege(ctxByUsername("plugin:org.opensearch.sample.SamplePlugin"), "cluster:whatever"),
isAllowed()
);
assertThat(
subject.hasClusterPrivilege(ctx("plugin:org.opensearch.other.OtherPlugin"), "cluster:whatever"),
isForbidden(missingPrivileges("cluster:whatever"))
);
}

@Test
public void explicit_wellKnown() throws Exception {
SecurityDynamicConfiguration<RoleV7> roles = SecurityDynamicConfiguration.fromYaml("non_explicit_role:\n" + //
Expand Down Expand Up @@ -455,7 +477,8 @@ public IndicesAndAliases(IndexSpec indexSpec, ActionSpec actionSpec, Statefulnes
settings,
WellKnownActions.CLUSTER_ACTIONS,
WellKnownActions.INDEX_ACTIONS,
WellKnownActions.INDEX_ACTIONS
WellKnownActions.INDEX_ACTIONS,
Map.of()
);

if (statefulness == Statefulness.STATEFUL || statefulness == Statefulness.STATEFUL_LIMITED) {
Expand Down Expand Up @@ -1030,4 +1053,19 @@ static PrivilegesEvaluationContext ctx(String... roles) {
null
);
}

static PrivilegesEvaluationContext ctxByUsername(String username) {
User user = new User(username);
user.addAttributes(ImmutableMap.of("attrs.dept_no", "a11"));
return new PrivilegesEvaluationContext(
user,
ImmutableSet.of(),
null,
null,
null,
null,
new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
null
);
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
* compatible open source license.
*
*/
package org.opensearch.security;
package org.opensearch.security.systemindex;

import java.util.List;
import java.util.Map;
Expand All @@ -19,17 +19,22 @@
import org.junit.runner.RunWith;

import org.opensearch.core.rest.RestStatus;
import org.opensearch.security.http.ExampleSystemIndexPlugin;
import org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin1;
import org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin2;
import org.opensearch.test.framework.TestSecurityConfig.AuthcDomain;
import org.opensearch.test.framework.cluster.ClusterManager;
import org.opensearch.test.framework.cluster.LocalCluster;
import org.opensearch.test.framework.cluster.TestRestClient;
import org.opensearch.test.framework.cluster.TestRestClient.HttpResponse;
import org.opensearch.test.framework.matcher.RestMatchers;

import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.equalTo;
import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ROLES_ENABLED;
import static org.opensearch.security.support.ConfigConstants.SECURITY_SYSTEM_INDICES_ENABLED_KEY;
import static org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin1.SYSTEM_INDEX_1;
import static org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin2.SYSTEM_INDEX_2;
import static org.opensearch.test.framework.TestSecurityConfig.Role.ALL_ACCESS;
import static org.opensearch.test.framework.TestSecurityConfig.User.USER_ADMIN;

Expand All @@ -44,7 +49,7 @@ public class SystemIndexTests {
.anonymousAuth(false)
.authc(AUTHC_DOMAIN)
.users(USER_ADMIN)
.plugin(ExampleSystemIndexPlugin.class)
.plugin(SystemIndexPlugin1.class, SystemIndexPlugin2.class)
.nodeSettings(
Map.of(
SECURITY_RESTAPI_ROLES_ENABLED,
Expand Down Expand Up @@ -89,6 +94,100 @@ public void adminShouldNotBeAbleToDeleteSecurityIndex() {
}
}

@Test
public void testPluginShouldBeAbleToIndexDocumentIntoItsSystemIndex() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.put("try-create-and-index/" + SYSTEM_INDEX_1);

assertThat(response.getStatusCode(), equalTo(RestStatus.OK.getStatus()));
assertThat(response.getBody(), containsString(SystemIndexPlugin1.class.getCanonicalName()));
}
}

@Test
public void testPluginShouldNotBeAbleToIndexDocumentIntoSystemIndexRegisteredByOtherPlugin() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.put("try-create-and-index/" + SYSTEM_INDEX_2);

assertThat(
response,
RestMatchers.isForbidden(
"/error/root_cause/0/reason",
"no permissions for [] and User [name=plugin:org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin1"
)
);
}
}

@Test
public void testPluginShouldBeAbleToCreateSystemIndexButUserShouldNotBeAbleToIndex() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.put("try-create-and-index/" + SYSTEM_INDEX_1 + "?runAs=user");

assertThat(response, RestMatchers.isForbidden("/error/root_cause/0/reason", "no permissions for [] and User [name=admin"));
}
}

@Test
public void testPluginShouldNotBeAbleToRunClusterActions() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.get("try-cluster-health/plugin");

assertThat(
response,
RestMatchers.isForbidden(
"/error/root_cause/0/reason",
"no permissions for [cluster:monitor/health] and User [name=plugin:org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin1"
)
);
}
}

@Test
public void testAdminUserShouldBeAbleToRunClusterActions() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.get("try-cluster-health/user");

assertThat(response.getStatusCode(), equalTo(RestStatus.OK.getStatus()));
}
}

@Test
public void testAuthenticatedUserShouldBeAbleToRunClusterActions() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.get("try-cluster-health/default");

assertThat(response.getStatusCode(), equalTo(RestStatus.OK.getStatus()));
}
}

@Test
public void testPluginShouldBeAbleToBulkIndexDocumentIntoItsSystemIndex() {
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.put("try-create-and-bulk-index/" + SYSTEM_INDEX_1);

assertThat(response.getStatusCode(), equalTo(RestStatus.OK.getStatus()));
}
}

@Test
public void testPluginShouldNotBeAbleToBulkIndexDocumentIntoMixOfSystemIndexWhereAtLeastOneDoesNotBelongToPlugin() {
try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
client.put(".system-index1");
client.put(".system-index2");
}
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
HttpResponse response = client.put("try-create-and-bulk-mixed-index");

assertThat(
response.getBody(),
containsString(
"no permissions for [] and User [name=plugin:org.opensearch.security.systemindex.sampleplugin.SystemIndexPlugin1"
)
);
}
}

@Test
public void regularUserShouldGetNoResultsWhenSearchingSystemIndex() {
// Create system index and index a dummy document as the super admin user, data returned to super admin
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/

package org.opensearch.security.systemindex.sampleplugin;

import org.opensearch.action.ActionType;

public class IndexDocumentIntoSystemIndexAction extends ActionType<IndexDocumentIntoSystemIndexResponse> {
public static final IndexDocumentIntoSystemIndexAction INSTANCE = new IndexDocumentIntoSystemIndexAction();
public static final String NAME = "cluster:mock/systemindex/index";

private IndexDocumentIntoSystemIndexAction() {
super(NAME, IndexDocumentIntoSystemIndexResponse::new);
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/

package org.opensearch.security.systemindex.sampleplugin;

import java.io.IOException;

import org.opensearch.action.ActionRequest;
import org.opensearch.action.ActionRequestValidationException;
import org.opensearch.core.common.io.stream.StreamInput;

public class IndexDocumentIntoSystemIndexRequest extends ActionRequest {

private final String indexName;

private final String runAs;

public IndexDocumentIntoSystemIndexRequest(String indexName, String runAs) {
this.indexName = indexName;
this.runAs = runAs;
}

public IndexDocumentIntoSystemIndexRequest(StreamInput in) throws IOException {
super(in);
this.indexName = in.readString();
this.runAs = in.readOptionalString();
}

@Override
public ActionRequestValidationException validate() {
return null;
}

public String getIndexName() {
return this.indexName;
}

public String getRunAs() {
return this.runAs;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/

package org.opensearch.security.systemindex.sampleplugin;

// CS-SUPPRESS-SINGLE: RegexpSingleline It is not possible to use phrase "cluster manager" instead of master here
import java.io.IOException;

import org.opensearch.action.support.master.AcknowledgedResponse;
import org.opensearch.core.common.io.stream.StreamInput;
import org.opensearch.core.common.io.stream.StreamOutput;
import org.opensearch.core.xcontent.ToXContent;
import org.opensearch.core.xcontent.ToXContentObject;
import org.opensearch.core.xcontent.XContentBuilder;
// CS-ENFORCE-SINGLE

public class IndexDocumentIntoSystemIndexResponse extends AcknowledgedResponse implements ToXContentObject {

private String plugin;

public IndexDocumentIntoSystemIndexResponse(boolean status, String plugin) {
super(status);
this.plugin = plugin;
}

public IndexDocumentIntoSystemIndexResponse(StreamInput in) throws IOException {
super(in);
}

@Override
public void writeTo(StreamOutput out) throws IOException {
super.writeTo(out);
out.writeString(plugin);
}

@Override
public void addCustomFields(XContentBuilder builder, ToXContent.Params params) throws IOException {
super.addCustomFields(builder, params);
builder.field("plugin", plugin);
}
}
Loading

0 comments on commit 1924e41

Please sign in to comment.