Skip to content

Commit 0795703

Browse files
jakelandisjakelandis
authored
Fix RoleDescriptor test that fails randomly (#116852)
This commit fixes a test fails based on the random seed. The change updates the name of the test to match the updated name of the method it is testing. It also re-implements the test to rely less on randomness and explicitly tests the possible inputs. fixes #116376
1 parent 1cf22ee commit 0795703

File tree

1 file changed

+172
-17
lines changed

1 file changed

+172
-17
lines changed

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptorTests.java‎

Lines changed: 172 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,12 @@
3131
import org.elasticsearch.xpack.core.XPackClientPlugin;
3232
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.ApplicationResourcePrivileges;
3333
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
34+
import org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissionGroup;
3435
import org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissions;
3536
import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
3637
import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivileges;
38+
import org.elasticsearch.xpack.core.security.authz.restriction.Workflow;
39+
import org.elasticsearch.xpack.core.security.authz.restriction.WorkflowResolver;
3740
import org.hamcrest.Matchers;
3841

3942
import java.io.IOException;
@@ -47,7 +50,6 @@
4750
import static org.elasticsearch.xcontent.XContentFactory.jsonBuilder;
4851
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptor.SECURITY_ROLE_DESCRIPTION;
4952
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptor.WORKFLOWS_RESTRICTION_VERSION;
50-
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomIndicesPrivileges;
5153
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomIndicesPrivilegesBuilder;
5254
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomRemoteClusterPermissions;
5355
import static org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissions.ROLE_REMOTE_CLUSTER_PRIVS;
@@ -1338,38 +1340,191 @@ public void testIsEmpty() {
13381340
}
13391341
}
13401342

1341-
public void testHasPrivilegesOtherThanIndex() {
1343+
public void testHasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster() {
1344+
// any index and some cluster privileges are allowed
13421345
assertThat(
13431346
new RoleDescriptor(
13441347
"name",
1348+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]), // all of these are allowed
1349+
new RoleDescriptor.IndicesPrivileges[] {
1350+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1351+
null,
1352+
null,
1353+
null,
1354+
null,
1355+
null,
1356+
null,
1357+
null,
1358+
null,
1359+
null
1360+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1361+
is(false)
1362+
);
1363+
// any index and some cluster privileges are allowed
1364+
assertThat(
1365+
new RoleDescriptor(
1366+
"name",
1367+
new String[] { "manage_security" }, // unlikely we will ever support allowing manage security across clusters
1368+
new RoleDescriptor.IndicesPrivileges[] {
1369+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1370+
null,
1371+
null,
1372+
null,
1373+
null,
1374+
null,
1375+
null,
1376+
null,
1377+
null,
1378+
null
1379+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1380+
is(true)
1381+
);
1382+
1383+
// application privileges are not allowed
1384+
assertThat(
1385+
new RoleDescriptor(
1386+
"name",
1387+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1388+
new RoleDescriptor.IndicesPrivileges[] {
1389+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1390+
new ApplicationResourcePrivileges[] {
1391+
ApplicationResourcePrivileges.builder().application("app").privileges("foo").resources("res").build() },
1392+
null,
1393+
null,
1394+
null,
1395+
null,
1396+
null,
1397+
null,
1398+
null,
1399+
null
1400+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1401+
is(true)
1402+
);
1403+
1404+
// configurable cluster privileges are not allowed
1405+
assertThat(
1406+
new RoleDescriptor(
1407+
"name",
1408+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1409+
new RoleDescriptor.IndicesPrivileges[] {
1410+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1411+
null,
1412+
new ConfigurableClusterPrivilege[] {
1413+
new ConfigurableClusterPrivileges.ManageApplicationPrivileges(Collections.singleton("foo")) },
1414+
null,
1415+
null,
1416+
null,
1417+
null,
1418+
null,
1419+
null,
1420+
null
1421+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1422+
is(true)
1423+
);
1424+
1425+
// run as is not allowed
1426+
assertThat(
1427+
new RoleDescriptor(
1428+
"name",
1429+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1430+
new RoleDescriptor.IndicesPrivileges[] {
1431+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1432+
null,
1433+
null,
1434+
new String[] { "foo" },
1435+
null,
1436+
null,
1437+
null,
1438+
null,
1439+
null,
1440+
null
1441+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1442+
is(true)
1443+
);
1444+
1445+
// workflows restriction is not allowed
1446+
assertThat(
1447+
new RoleDescriptor(
1448+
"name",
1449+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1450+
new RoleDescriptor.IndicesPrivileges[] {
1451+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
13451452
null,
1346-
randomBoolean() ? null : randomIndicesPrivileges(1, 5),
13471453
null,
13481454
null,
13491455
null,
13501456
null,
13511457
null,
13521458
null,
1459+
new RoleDescriptor.Restriction(WorkflowResolver.allWorkflows().stream().map(Workflow::name).toArray(String[]::new)),
1460+
null
1461+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1462+
is(true)
1463+
);
1464+
// remote indices privileges are not allowed
1465+
assertThat(
1466+
new RoleDescriptor(
1467+
"name",
1468+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1469+
new RoleDescriptor.IndicesPrivileges[] {
1470+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1471+
null,
1472+
null,
1473+
null,
1474+
null,
1475+
null,
1476+
new RoleDescriptor.RemoteIndicesPrivileges[] {
1477+
RoleDescriptor.RemoteIndicesPrivileges.builder("rmt").indices("idx").privileges("foo").build() },
13531478
null,
13541479
null,
13551480
null
13561481
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1482+
is(true)
1483+
);
1484+
// remote cluster privileges are not allowed
1485+
assertThat(
1486+
new RoleDescriptor(
1487+
"name",
1488+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1489+
new RoleDescriptor.IndicesPrivileges[] {
1490+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1491+
null,
1492+
null,
1493+
null,
1494+
null,
1495+
null,
1496+
null,
1497+
new RemoteClusterPermissions().addGroup(
1498+
new RemoteClusterPermissionGroup(
1499+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1500+
new String[] { "rmt" }
1501+
)
1502+
),
1503+
null,
1504+
null
1505+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1506+
is(true)
1507+
);
1508+
1509+
// metadata, transient metadata and description are allowed
1510+
assertThat(
1511+
new RoleDescriptor(
1512+
"name",
1513+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1514+
new RoleDescriptor.IndicesPrivileges[] {
1515+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1516+
null,
1517+
null,
1518+
null,
1519+
Collections.singletonMap("foo", "bar"),
1520+
Collections.singletonMap("foo", "bar"),
1521+
null,
1522+
null,
1523+
null,
1524+
"description"
1525+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
13571526
is(false)
13581527
);
1359-
final RoleDescriptor roleDescriptor = RoleDescriptorTestHelper.builder()
1360-
.allowReservedMetadata(true)
1361-
.allowRemoteIndices(true)
1362-
.allowRestriction(true)
1363-
.allowDescription(true)
1364-
.allowRemoteClusters(true)
1365-
.build();
1366-
final boolean expected = roleDescriptor.hasClusterPrivileges()
1367-
|| roleDescriptor.hasConfigurableClusterPrivileges()
1368-
|| roleDescriptor.hasApplicationPrivileges()
1369-
|| roleDescriptor.hasRunAs()
1370-
|| roleDescriptor.hasRemoteIndicesPrivileges()
1371-
|| roleDescriptor.hasWorkflowsRestriction();
1372-
assertThat(roleDescriptor.hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(), equalTo(expected));
13731528
}
13741529

13751530
private static void resetFieldPermssionsCache() {

0 commit comments

Comments
 (0)