Skip to content

Commit d8020fb

Browse files
jdconradKubik42
jdconrad
authored and
Kubik42
committed
Revert "Remove transport version V_7_0_0 (elastic#135874)" (elastic#136635)
This reverts commit 570de53. elastic/elasticsearch-serverless#4688
1 parent dea06c5 commit d8020fb

File tree

6 files changed

+307
-3
lines changed

6 files changed

+307
-3
lines changed

‎server/src/main/java/org/elasticsearch/TransportVersions.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ static TransportVersion def(int id) {
5353
}
5454

5555
// TODO: ES-10337 we can remove all transport versions earlier than 8.18
56+
public static final TransportVersion V_7_0_0 = def(7_00_00_99);
5657
public static final TransportVersion V_7_1_0 = def(7_01_00_99);
5758
public static final TransportVersion V_7_2_0 = def(7_02_00_99);
5859
public static final TransportVersion V_7_3_0 = def(7_03_00_99);

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationSerializationTests.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,21 @@
1313
import org.elasticsearch.test.ESTestCase;
1414
import org.elasticsearch.test.TransportVersionUtils;
1515
import org.elasticsearch.transport.RemoteClusterPortSettings;
16+
import org.elasticsearch.xpack.core.security.authc.support.AuthenticationContextSerializer;
1617
import org.elasticsearch.xpack.core.security.user.ElasticUser;
1718
import org.elasticsearch.xpack.core.security.user.InternalUsers;
1819
import org.elasticsearch.xpack.core.security.user.KibanaSystemUser;
1920
import org.elasticsearch.xpack.core.security.user.KibanaUser;
2021
import org.elasticsearch.xpack.core.security.user.User;
2122

23+
import java.io.IOException;
2224
import java.util.Arrays;
2325
import java.util.Map;
2426

2527
import static org.elasticsearch.xpack.core.security.authc.Authentication.AuthenticationSerializationHelper;
28+
import static org.hamcrest.Matchers.arrayContaining;
2629
import static org.hamcrest.Matchers.containsString;
30+
import static org.hamcrest.Matchers.emptyArray;
2731
import static org.hamcrest.Matchers.equalTo;
2832
import static org.hamcrest.Matchers.is;
2933
import static org.hamcrest.Matchers.not;
@@ -228,4 +232,47 @@ public void testReservedUserSerialization() throws Exception {
228232

229233
assertEquals(kibanaSystemUser, readFrom);
230234
}
235+
236+
public void testRolesRemovedFromUserForLegacyApiKeys() throws IOException {
237+
TransportVersion transportVersion = TransportVersionUtils.randomVersionBetween(
238+
random(),
239+
TransportVersions.V_7_0_0,
240+
TransportVersions.V_7_8_0
241+
);
242+
Subject authenticatingSubject = new Subject(
243+
new User("foo", "role"),
244+
new Authentication.RealmRef(AuthenticationField.API_KEY_REALM_NAME, AuthenticationField.API_KEY_REALM_TYPE, "node"),
245+
transportVersion,
246+
Map.of(AuthenticationField.API_KEY_ID_KEY, "abc")
247+
);
248+
Subject effectiveSubject = new Subject(
249+
new User("bar", "role"),
250+
new Authentication.RealmRef("native", "native", "node"),
251+
transportVersion,
252+
Map.of()
253+
);
254+
255+
{
256+
Authentication actual = AuthenticationContextSerializer.decode(
257+
Authentication.doEncode(authenticatingSubject, authenticatingSubject, Authentication.AuthenticationType.API_KEY)
258+
);
259+
assertThat(actual.getAuthenticatingSubject().getUser().roles(), is(emptyArray()));
260+
}
261+
262+
{
263+
Authentication actual = AuthenticationContextSerializer.decode(
264+
Authentication.doEncode(effectiveSubject, authenticatingSubject, Authentication.AuthenticationType.API_KEY)
265+
);
266+
assertThat(actual.getAuthenticatingSubject().getUser().roles(), is(emptyArray()));
267+
assertThat(actual.getEffectiveSubject().getUser().roles(), is(arrayContaining("role")));
268+
}
269+
270+
{
271+
// do not strip roles for authentication methods other than API key
272+
Authentication actual = AuthenticationContextSerializer.decode(
273+
Authentication.doEncode(effectiveSubject, effectiveSubject, Authentication.AuthenticationType.REALM)
274+
);
275+
assertThat(actual.getAuthenticatingSubject().getUser().roles(), is(arrayContaining("role")));
276+
}
277+
}
231278
}

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationTests.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1321,7 +1321,9 @@ public static Authentication randomAuthentication(User user, RealmRef realmRef,
13211321
if (realmRef == null) {
13221322
realmRef = randomRealmRef(false);
13231323
}
1324-
final TransportVersion version = TransportVersionUtils.randomCompatibleVersion(random());
1324+
// If the realm is expected to have a domain, we need a version that's at least compatible with domains
1325+
final TransportVersion minVersion = realmRef.getDomain() != null ? Authentication.VERSION_REALM_DOMAINS : TransportVersions.V_7_0_0;
1326+
final TransportVersion version = TransportVersionUtils.randomVersionBetween(random(), minVersion, TransportVersion.current());
13251327
final Map<String, Object> metadata;
13261328
if (randomBoolean()) {
13271329
metadata = Map.of(randomAlphaOfLengthBetween(3, 8), randomAlphaOfLengthBetween(3, 8));
@@ -1334,7 +1336,11 @@ public static Authentication randomAuthentication(User user, RealmRef realmRef,
13341336
}
13351337

13361338
public static Authentication randomApiKeyAuthentication(User user, String apiKeyId) {
1337-
return randomApiKeyAuthentication(user, apiKeyId, TransportVersionUtils.randomCompatibleVersion(random()));
1339+
return randomApiKeyAuthentication(
1340+
user,
1341+
apiKeyId,
1342+
TransportVersionUtils.randomVersionBetween(random(), TransportVersions.V_7_0_0, TransportVersion.current())
1343+
);
13381344
}
13391345

13401346
public static Authentication randomApiKeyAuthentication(User user, String apiKeyId, TransportVersion version) {

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/SubjectTests.java‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,21 @@
88
package org.elasticsearch.xpack.core.security.authc;
99

1010
import org.elasticsearch.TransportVersion;
11+
import org.elasticsearch.TransportVersions;
1112
import org.elasticsearch.common.Strings;
1213
import org.elasticsearch.common.bytes.BytesArray;
1314
import org.elasticsearch.common.bytes.BytesReference;
1415
import org.elasticsearch.common.settings.Settings;
1516
import org.elasticsearch.common.util.ArrayUtils;
1617
import org.elasticsearch.test.ESTestCase;
18+
import org.elasticsearch.test.TransportVersionUtils;
1719
import org.elasticsearch.xpack.core.security.action.apikey.ApiKey;
1820
import org.elasticsearch.xpack.core.security.authc.service.ServiceAccountSettings;
1921
import org.elasticsearch.xpack.core.security.authz.RoleDescriptorsIntersection;
2022
import org.elasticsearch.xpack.core.security.authz.store.RoleKey;
2123
import org.elasticsearch.xpack.core.security.authz.store.RoleReference;
2224
import org.elasticsearch.xpack.core.security.authz.store.RoleReference.ApiKeyRoleReference;
25+
import org.elasticsearch.xpack.core.security.authz.store.RoleReference.BwcApiKeyRoleReference;
2326
import org.elasticsearch.xpack.core.security.authz.store.RoleReference.FixedRoleReference;
2427
import org.elasticsearch.xpack.core.security.authz.store.RoleReference.NamedRoleReference;
2528
import org.elasticsearch.xpack.core.security.authz.store.RoleReference.ServiceAccountRoleReference;
@@ -29,6 +32,7 @@
2932
import org.elasticsearch.xpack.core.security.user.User;
3033

3134
import java.util.Arrays;
35+
import java.util.Collections;
3236
import java.util.HashMap;
3337
import java.util.List;
3438
import java.util.Map;
@@ -283,6 +287,50 @@ private static void expectFixedReferenceAtIndex(int index, List<RoleReference> r
283287
assertThat(fixedRoleReference.id(), equalTo(expectedKey));
284288
}
285289

290+
public void testGetRoleReferencesForApiKeyBwc() {
291+
Map<String, Object> authMetadata = new HashMap<>();
292+
final String apiKeyId = randomAlphaOfLength(12);
293+
authMetadata.put(AuthenticationField.API_KEY_ID_KEY, apiKeyId);
294+
authMetadata.put(AuthenticationField.API_KEY_NAME_KEY, randomBoolean() ? null : randomAlphaOfLength(12));
295+
boolean emptyApiKeyRoleDescriptor = randomBoolean();
296+
Map<String, Object> roleARDMap = Map.of("cluster", List.of("monitor"));
297+
authMetadata.put(
298+
API_KEY_ROLE_DESCRIPTORS_KEY,
299+
(emptyApiKeyRoleDescriptor)
300+
? randomFrom(Arrays.asList(null, Collections.emptyMap()))
301+
: Collections.singletonMap("a role", roleARDMap)
302+
);
303+
304+
Map<String, Object> limitedRdMap = Map.of("cluster", List.of("all"));
305+
authMetadata.put(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY, Collections.singletonMap("limited role", limitedRdMap));
306+
307+
final Subject subject = new Subject(
308+
new User("joe"),
309+
new Authentication.RealmRef(API_KEY_REALM_NAME, API_KEY_REALM_TYPE, "node"),
310+
TransportVersionUtils.randomVersionBetween(random(), TransportVersions.V_7_0_0, TransportVersions.V_7_8_1),
311+
authMetadata
312+
);
313+
314+
final RoleReferenceIntersection roleReferenceIntersection = subject.getRoleReferenceIntersection(getAnonymousUser());
315+
final List<RoleReference> roleReferences = roleReferenceIntersection.getRoleReferences();
316+
317+
if (emptyApiKeyRoleDescriptor) {
318+
assertThat(roleReferences, contains(isA(BwcApiKeyRoleReference.class)));
319+
final BwcApiKeyRoleReference limitedByRoleReference = (BwcApiKeyRoleReference) roleReferences.get(0);
320+
assertThat(limitedByRoleReference.getApiKeyId(), equalTo(apiKeyId));
321+
assertThat(limitedByRoleReference.getRoleDescriptorsMap(), equalTo(authMetadata.get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY)));
322+
} else {
323+
assertThat(roleReferences, contains(isA(BwcApiKeyRoleReference.class), isA(BwcApiKeyRoleReference.class)));
324+
final BwcApiKeyRoleReference roleReference = (BwcApiKeyRoleReference) roleReferences.get(0);
325+
assertThat(roleReference.getApiKeyId(), equalTo(apiKeyId));
326+
assertThat(roleReference.getRoleDescriptorsMap(), equalTo(authMetadata.get(API_KEY_ROLE_DESCRIPTORS_KEY)));
327+
328+
final BwcApiKeyRoleReference limitedByRoleReference = (BwcApiKeyRoleReference) roleReferences.get(1);
329+
assertThat(limitedByRoleReference.getApiKeyId(), equalTo(apiKeyId));
330+
assertThat(limitedByRoleReference.getRoleDescriptorsMap(), equalTo(authMetadata.get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY)));
331+
}
332+
}
333+
286334
public void testGetFleetApiKeyRoleReferenceBwcBugFix() {
287335
final BytesReference roleBytes = new BytesArray("{\"a role\": {\"cluster\": [\"all\"]}}");
288336
final BytesReference limitedByRoleBytes = new BytesArray("{}");

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/TokenServiceTests.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,16 @@ public void setupClient() {
243243
}
244244

245245
private static DiscoveryNode addAnother7071DataNode(ClusterService clusterService) {
246-
return addAnotherDataNodeWithVersion(clusterService, Version.V_7_1_0, TransportVersions.V_7_1_0);
246+
Version version;
247+
TransportVersion transportVersion;
248+
if (randomBoolean()) {
249+
version = Version.V_7_0_0;
250+
transportVersion = TransportVersions.V_7_0_0;
251+
} else {
252+
version = Version.V_7_1_0;
253+
transportVersion = TransportVersions.V_7_1_0;
254+
}
255+
return addAnotherDataNodeWithVersion(clusterService, version, transportVersion);
247256
}
248257

249258
private static DiscoveryNode addAnotherPre8500DataNode(ClusterService clusterService) {

0 commit comments

Comments
 (0)