github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-06-28 09:28:55 -04:00
Code Issues Projects Releases Packages Wiki Activity

Fix compilation and tests for customAuthzEngine (#125469)

Browse source 
Relates: #123812
This commit is contained in:
Yang Wang 2025-03-24 12:03:06 +11:00 • committed by GitHub
parent 59a55c85f3
commit 6c04abc68c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 68 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugins/examples/custom-processor/src/main/java/org/elasticsearch/example/customprocessor/ExampleRepeatProcessor.java
View file

@ -1,5 +1,6 @@
package org.elasticsearch.example.customprocessor; package org.elasticsearch.example.customprocessor;
import org.elasticsearch.cluster.metadata.ProjectId;
import org.elasticsearch.ingest.AbstractProcessor; import org.elasticsearch.ingest.AbstractProcessor;
import org.elasticsearch.ingest.ConfigurationUtils; import org.elasticsearch.ingest.ConfigurationUtils;
import org.elasticsearch.ingest.IngestDocument; import org.elasticsearch.ingest.IngestDocument;
@ -44,7 +45,8 @@ public class ExampleRepeatProcessor extends AbstractProcessor {
Map<String, Processor.Factory> registry, Map<String, Processor.Factory> registry,
String tag, String tag,
String description, String description,
Map<String, Object> config Map<String, Object> config,
ProjectId projectId
) { ) {
String field = ConfigurationUtils.readStringProperty(TYPE, tag, config, FIELD_KEY_NAME); String field = ConfigurationUtils.readStringProperty(TYPE, tag, config, FIELD_KEY_NAME);
return new ExampleRepeatProcessor(tag, description, field); return new ExampleRepeatProcessor(tag, description, field);

12
plugins/examples/security-authorization-engine/src/main/java/org/elasticsearch/example/CustomAuthorizationEngine.java
View file

@ -87,15 +87,15 @@ public class CustomAuthorizationEngine implements AuthorizationEngine {
} }
@Override @Override
SubscribableListener<IndexAuthorizationResult> void authorizeIndexAction( public SubscribableListener<IndexAuthorizationResult> authorizeIndexAction(
RequestInfo requestInfo, RequestInfo requestInfo,
AuthorizationInfo authorizationInfo, AuthorizationInfo authorizationInfo,
AsyncSupplier<ResolvedIndices> indicesAsyncSupplier, AsyncSupplier<ResolvedIndices> indicesAsyncSupplier,
ProjectMetadata project ProjectMetadata project
) { ) {
if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) { if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) {
ActionListener<IndexAuthorizationResult> listener = new SubscribableListener<>(); SubscribableListener<IndexAuthorizationResult> listener = new SubscribableListener<>();
indicesAsyncSupplier.getAsync(ActionListener.wrap(resolvedIndices -> { indicesAsyncSupplier.getAsync().addListener(ActionListener.wrap(resolvedIndices -> {
Map<String, IndexAccessControl> indexAccessControlMap = new HashMap<>(); Map<String, IndexAccessControl> indexAccessControlMap = new HashMap<>();
for (String name : resolvedIndices.getLocal()) { for (String name : resolvedIndices.getLocal()) {
indexAccessControlMap.put(name, new IndexAccessControl(FieldPermissions.DEFAULT, null)); indexAccessControlMap.put(name, new IndexAccessControl(FieldPermissions.DEFAULT, null));
@ -106,7 +106,7 @@ public class CustomAuthorizationEngine implements AuthorizationEngine {
}, listener::onFailure)); }, listener::onFailure));
return listener; return listener;
} else { } else {
return SubscribableListener.succcess(new IndexAuthorizationResult(IndicesAccessControl.DENIED)); return SubscribableListener.newSucceeded(new IndexAuthorizationResult(IndicesAccessControl.DENIED));
} }
} }
@ -120,7 +120,7 @@ public class CustomAuthorizationEngine implements AuthorizationEngine {
if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) { if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) {
listener.onResponse(new AuthorizedIndices() { listener.onResponse(new AuthorizedIndices() {
public Set<String> all(IndexComponentSelector selector) { public Set<String> all(IndexComponentSelector selector) {
return () -> indicesLookup.keySet(); return indicesLookup.keySet();
} }
public boolean check(String name, IndexComponentSelector selector) { public boolean check(String name, IndexComponentSelector selector) {
return indicesLookup.containsKey(name); return indicesLookup.containsKey(name);
@ -129,7 +129,7 @@ public class CustomAuthorizationEngine implements AuthorizationEngine {
} else { } else {
listener.onResponse(new AuthorizedIndices() { listener.onResponse(new AuthorizedIndices() {
public Set<String> all(IndexComponentSelector selector) { public Set<String> all(IndexComponentSelector selector) {
return () -> Set.of(); return Set.of();
} }
public boolean check(String name, IndexComponentSelector selector) { public boolean check(String name, IndexComponentSelector selector) {
return false; return false;

104
plugins/examples/security-authorization-engine/src/test/java/org/elasticsearch/example/CustomAuthorizationEngineTests.java
View file

@ -11,10 +11,8 @@ package org.elasticsearch.example;
import org.elasticsearch.action.search.SearchRequest; import org.elasticsearch.action.search.SearchRequest;
import org.elasticsearch.action.support.PlainActionFuture; import org.elasticsearch.action.support.PlainActionFuture;
import org.elasticsearch.cluster.metadata.IndexAbstraction; import org.elasticsearch.action.support.SubscribableListener;
import org.elasticsearch.cluster.metadata.IndexAbstraction.ConcreteIndex;
import org.elasticsearch.cluster.metadata.IndexMetadata; import org.elasticsearch.cluster.metadata.IndexMetadata;
import org.elasticsearch.cluster.metadata.Metadata;
import org.elasticsearch.cluster.metadata.ProjectMetadata; import org.elasticsearch.cluster.metadata.ProjectMetadata;
import org.elasticsearch.common.settings.Settings; import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.index.IndexVersion; import org.elasticsearch.index.IndexVersion;
@ -31,9 +29,6 @@ import org.elasticsearch.xpack.core.security.authz.accesscontrol.IndicesAccessCo
import org.elasticsearch.xpack.core.security.user.User; import org.elasticsearch.xpack.core.security.user.User;
import java.util.Collections; import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.stream.Stream;
import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.is;
@ -52,13 +47,15 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
public void testAuthorizeRunAs() { public void testAuthorizeRunAs() {
final String action = "cluster:monitor/foo"; final String action = "cluster:monitor/foo";
final TransportRequest request = new TransportRequest() {}; final TransportRequest request = new TransportRequest() {
};
CustomAuthorizationEngine engine = new CustomAuthorizationEngine(); CustomAuthorizationEngine engine = new CustomAuthorizationEngine();
// unauthorized // unauthorized
{ {
Authentication authentication = Authentication Authentication authentication = Authentication.newRealmAuthentication(
.newRealmAuthentication(new User("bar", "not_superuser"), new RealmRef("test", "test", "node")) new User("bar", "not_superuser"),
.runAs(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")); new RealmRef("test", "test", "node")
).runAs(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node"));
RequestInfo info = new RequestInfo(authentication, request, action, null); RequestInfo info = new RequestInfo(authentication, request, action, null);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>(); PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(info, future); engine.resolveAuthorizationInfo(info, future);
@ -72,9 +69,10 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
// authorized // authorized
{ {
Authentication authentication = Authentication Authentication authentication = Authentication.newRealmAuthentication(
.newRealmAuthentication(new User("bar", "custom_superuser"), new RealmRef("test", "test", "node")) new User("bar", "custom_superuser"),
.runAs(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")); new RealmRef("test", "test", "node")
).runAs(new User("joe", "not_superuser"), new RealmRef("test", "test", "node"));
RequestInfo info = new RequestInfo(authentication, request, action, null); RequestInfo info = new RequestInfo(authentication, request, action, null);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>(); PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(info, future); engine.resolveAuthorizationInfo(info, future);
@ -103,10 +101,12 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
// unauthorized // unauthorized
{ {
RequestInfo unauthReqInfo = RequestInfo unauthReqInfo = new RequestInfo(
new RequestInfo( Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")), requestInfo.getRequest(),
requestInfo.getRequest(), requestInfo.getAction(), null); requestInfo.getAction(),
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>(); PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(unauthReqInfo, future); engine.resolveAuthorizationInfo(unauthReqInfo, future);
AuthorizationInfo authzInfo = future.actionGet(); AuthorizationInfo authzInfo = future.actionGet();
@ -120,28 +120,35 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
public void testAuthorizeIndexAction() { public void testAuthorizeIndexAction() {
CustomAuthorizationEngine engine = new CustomAuthorizationEngine(); CustomAuthorizationEngine engine = new CustomAuthorizationEngine();
ProjectMetadata project = ProjectMetadata.builder(randomProjectIdOrDefault()).put(IndexMetadata.builder("index") ProjectMetadata project = ProjectMetadata.builder(randomProjectIdOrDefault())
.settings(Settings.builder().put("index.version.created", IndexVersion.current())) .put(
.numberOfShards(1) IndexMetadata.builder("index")
.numberOfReplicas(0) .settings(Settings.builder().put("index.version.created", IndexVersion.current()))
.build(), .numberOfShards(1)
false .numberOfReplicas(0)
).build(); .build(),
false
)
.build();
// authorized // authorized
{ {
RequestInfo requestInfo = RequestInfo requestInfo = new RequestInfo(
new RequestInfo( Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")),
Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")), new SearchRequest(),
new SearchRequest(), "indices:data/read/search", null); "indices:data/read/search",
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>(); PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(requestInfo, future); engine.resolveAuthorizationInfo(requestInfo, future);
AuthorizationInfo authzInfo = future.actionGet(); AuthorizationInfo authzInfo = future.actionGet();
PlainActionFuture<IndexAuthorizationResult> resultFuture = new PlainActionFuture<>(); final SubscribableListener<IndexAuthorizationResult> resultListener = engine.authorizeIndexAction(
engine.authorizeIndexAction(requestInfo, authzInfo, requestInfo,
listener -> listener.onResponse(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())), authzInfo,
project, resultFuture); () -> SubscribableListener.newSucceeded(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
IndexAuthorizationResult result = resultFuture.actionGet(); project
);
IndexAuthorizationResult result = safeAwait(resultListener);
assertThat(result.isGranted(), is(true)); assertThat(result.isGranted(), is(true));
IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl(); IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl();
assertNotNull(indicesAccessControl.getIndexPermissions("index")); assertNotNull(indicesAccessControl.getIndexPermissions("index"));
@ -149,19 +156,23 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
// unauthorized // unauthorized
{ {
RequestInfo requestInfo = RequestInfo requestInfo = new RequestInfo(
new RequestInfo( Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")), new SearchRequest(),
new SearchRequest(), "indices:data/read/search", null); "indices:data/read/search",
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>(); PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(requestInfo, future); engine.resolveAuthorizationInfo(requestInfo, future);
AuthorizationInfo authzInfo = future.actionGet(); AuthorizationInfo authzInfo = future.actionGet();
PlainActionFuture<IndexAuthorizationResult> resultFuture = new PlainActionFuture<>(); final SubscribableListener<IndexAuthorizationResult> resultListener = engine.authorizeIndexAction(
engine.authorizeIndexAction(requestInfo, authzInfo, requestInfo,
listener -> listener.onResponse(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())), authzInfo,
project, resultFuture); () -> SubscribableListener.newSucceeded(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
IndexAuthorizationResult result = resultFuture.actionGet(); project
);
IndexAuthorizationResult result = safeAwait(resultListener);
assertThat(result.isGranted(), is(false)); assertThat(result.isGranted(), is(false));
IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl(); IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl();
assertNull(indicesAccessControl.getIndexPermissions("index")); assertNull(indicesAccessControl.getIndexPermissions("index"));
@ -170,9 +181,12 @@ public class CustomAuthorizationEngineTests extends ESTestCase {
private RequestInfo getRequestInfo() { private RequestInfo getRequestInfo() {
final String action = "cluster:monitor/foo"; final String action = "cluster:monitor/foo";
final TransportRequest request = new TransportRequest() {}; final TransportRequest request = new TransportRequest() {
final Authentication authentication = };
Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")); final Authentication authentication = Authentication.newRealmAuthentication(
new User("joe", "custom_superuser"),
new RealmRef("test", "test", "node")
);
return new RequestInfo(authentication, request, action, null); return new RequestInfo(authentication, request, action, null);
} }
} }