Skip to content

Commit 5018173

Browse files
slobodanadamovicslobodanadamovic
committed
move profile intialization logic into CrossClusterAccessTransportInterceptor
1 parent 9b25155 commit 5018173

File tree

2 files changed

+50
-49
lines changed

2 files changed

+50
-49
lines changed

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterAccessTransportInterceptor.java‎

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
import org.elasticsearch.action.support.DestructiveOperations;
1515
import org.elasticsearch.common.settings.SecureString;
1616
import org.elasticsearch.common.settings.Settings;
17+
import org.elasticsearch.common.ssl.SslConfiguration;
18+
import org.elasticsearch.common.util.Maps;
1719
import org.elasticsearch.common.util.concurrent.ThreadContext;
1820
import org.elasticsearch.license.LicenseUtils;
1921
import org.elasticsearch.license.XPackLicenseState;
@@ -28,12 +30,14 @@
2830
import org.elasticsearch.transport.TransportResponse;
2931
import org.elasticsearch.transport.TransportResponseHandler;
3032
import org.elasticsearch.transport.TransportService;
33+
import org.elasticsearch.xpack.core.XPackSettings;
3134
import org.elasticsearch.xpack.core.security.SecurityContext;
3235
import org.elasticsearch.xpack.core.security.authc.Authentication;
3336
import org.elasticsearch.xpack.core.security.authc.CrossClusterAccessSubjectInfo;
3437
import org.elasticsearch.xpack.core.security.user.InternalUser;
3538
import org.elasticsearch.xpack.core.security.user.SystemUser;
3639
import org.elasticsearch.xpack.core.security.user.User;
40+
import org.elasticsearch.xpack.core.ssl.SSLService;
3741
import org.elasticsearch.xpack.core.ssl.SslProfile;
3842
import org.elasticsearch.xpack.security.Security;
3943
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
@@ -44,11 +48,14 @@
4448
import org.elasticsearch.xpack.security.authc.CrossClusterAccessHeaders;
4549
import org.elasticsearch.xpack.security.authz.AuthorizationService;
4650

51+
import java.util.Collections;
4752
import java.util.Map;
4853
import java.util.Optional;
4954
import java.util.function.Function;
5055

5156
import static org.elasticsearch.core.Strings.format;
57+
import static org.elasticsearch.transport.RemoteClusterPortSettings.REMOTE_CLUSTER_PROFILE;
58+
import static org.elasticsearch.transport.RemoteClusterPortSettings.REMOTE_CLUSTER_SERVER_ENABLED;
5259
import static org.elasticsearch.transport.RemoteClusterPortSettings.TRANSPORT_VERSION_ADVANCED_REMOTE_CLUSTER_SECURITY;
5360

5461
public class CrossClusterAccessTransportInterceptor implements RemoteClusterTransportInterceptor {
@@ -331,7 +338,47 @@ public Map<String, ServerTransportFilter> getProfileFilters(
331338
Map<String, SslProfile> profileConfigurations,
332339
DestructiveOperations destructiveOperations
333340
) {
334-
return Map.of();
341+
Map<String, ServerTransportFilter> profileFilters = Maps.newMapWithExpectedSize(profileConfigurations.size() + 1);
342+
343+
final boolean transportSSLEnabled = XPackSettings.TRANSPORT_SSL_ENABLED.get(settings);
344+
final boolean remoteClusterPortEnabled = REMOTE_CLUSTER_SERVER_ENABLED.get(settings);
345+
final boolean remoteClusterServerSSLEnabled = XPackSettings.REMOTE_CLUSTER_SERVER_SSL_ENABLED.get(settings);
346+
347+
for (Map.Entry<String, SslProfile> entry : profileConfigurations.entrySet()) {
348+
final String profileName = entry.getKey();
349+
final SslProfile sslProfile = entry.getValue();
350+
final SslConfiguration profileConfiguration = sslProfile.configuration();
351+
assert profileConfiguration != null : "Ssl Profile [" + sslProfile + "] for [" + profileName + "] has a null configuration";
352+
final boolean useRemoteClusterProfile = remoteClusterPortEnabled && profileName.equals(REMOTE_CLUSTER_PROFILE);
353+
if (useRemoteClusterProfile) {
354+
profileFilters.put(
355+
profileName,
356+
new CrossClusterAccessServerTransportFilter(
357+
crossClusterAccessAuthcService,
358+
authzService,
359+
threadPool.getThreadContext(),
360+
remoteClusterServerSSLEnabled && SSLService.isSSLClientAuthEnabled(profileConfiguration),
361+
destructiveOperations,
362+
securityContext,
363+
licenseState
364+
)
365+
);
366+
} else {
367+
profileFilters.put(
368+
profileName,
369+
new ServerTransportFilter(
370+
authcService,
371+
authzService,
372+
threadPool.getThreadContext(),
373+
transportSSLEnabled && SSLService.isSSLClientAuthEnabled(profileConfiguration),
374+
destructiveOperations,
375+
securityContext
376+
)
377+
);
378+
}
379+
}
380+
381+
return Collections.unmodifiableMap(profileFilters);
335382
}
336383

337384
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptor.java‎

Lines changed: 2 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@
1212
import org.elasticsearch.action.ActionListener;
1313
import org.elasticsearch.action.support.DestructiveOperations;
1414
import org.elasticsearch.common.settings.Settings;
15-
import org.elasticsearch.common.ssl.SslConfiguration;
16-
import org.elasticsearch.common.util.Maps;
1715
import org.elasticsearch.common.util.concurrent.AbstractRunnable;
1816
import org.elasticsearch.common.util.concurrent.EsExecutors;
1917
import org.elasticsearch.common.util.concurrent.RunOnce;
@@ -34,7 +32,6 @@
3432
import org.elasticsearch.transport.TransportResponseHandler;
3533
import org.elasticsearch.transport.TransportService;
3634
import org.elasticsearch.transport.TransportService.ContextRestoreResponseHandler;
37-
import org.elasticsearch.xpack.core.XPackSettings;
3835
import org.elasticsearch.xpack.core.security.SecurityContext;
3936
import org.elasticsearch.xpack.core.security.authc.CrossClusterAccessSubjectInfo;
4037
import org.elasticsearch.xpack.core.security.transport.ProfileConfigurations;
@@ -47,15 +44,12 @@
4744
import org.elasticsearch.xpack.security.authz.AuthorizationUtils;
4845
import org.elasticsearch.xpack.security.authz.PreAuthorizationUtils;
4946

50-
import java.util.Collections;
5147
import java.util.Map;
5248
import java.util.Optional;
5349
import java.util.concurrent.Executor;
5450
import java.util.function.Function;
5551

5652
import static org.elasticsearch.core.Strings.format;
57-
import static org.elasticsearch.transport.RemoteClusterPortSettings.REMOTE_CLUSTER_PROFILE;
58-
import static org.elasticsearch.transport.RemoteClusterPortSettings.REMOTE_CLUSTER_SERVER_ENABLED;
5953

6054
public class SecurityServerTransportInterceptor implements TransportInterceptor {
6155

@@ -120,7 +114,6 @@ public SecurityServerTransportInterceptor(
120114
this.crossClusterAccessAuthcService = crossClusterAccessAuthcService;
121115
this.licenseState = licenseState;
122116
this.remoteClusterCredentialsResolver = remoteClusterCredentialsResolver;
123-
this.profileFilters = initializeProfileFilters(destructiveOperations);
124117
this.remoteClusterTransportInterceptor = new CrossClusterAccessTransportInterceptor(
125118
crossClusterAccessAuthcService,
126119
authcService,
@@ -131,6 +124,7 @@ public SecurityServerTransportInterceptor(
131124
settings,
132125
remoteClusterCredentialsResolver
133126
);
127+
this.profileFilters = initializeProfileFilters(destructiveOperations);
134128
}
135129

136130
@Override
@@ -285,47 +279,7 @@ public <T extends TransportRequest> TransportRequestHandler<T> interceptHandler(
285279
private Map<String, ServerTransportFilter> initializeProfileFilters(DestructiveOperations destructiveOperations) {
286280
final Map<String, SslProfile> profileConfigurations = ProfileConfigurations.get(settings, sslService, false);
287281

288-
Map<String, ServerTransportFilter> profileFilters = Maps.newMapWithExpectedSize(profileConfigurations.size() + 1);
289-
290-
final boolean transportSSLEnabled = XPackSettings.TRANSPORT_SSL_ENABLED.get(settings);
291-
final boolean remoteClusterPortEnabled = REMOTE_CLUSTER_SERVER_ENABLED.get(settings);
292-
final boolean remoteClusterServerSSLEnabled = XPackSettings.REMOTE_CLUSTER_SERVER_SSL_ENABLED.get(settings);
293-
294-
for (Map.Entry<String, SslProfile> entry : profileConfigurations.entrySet()) {
295-
final String profileName = entry.getKey();
296-
final SslProfile sslProfile = entry.getValue();
297-
final SslConfiguration profileConfiguration = sslProfile.configuration();
298-
assert profileConfiguration != null : "Ssl Profile [" + sslProfile + "] for [" + profileName + "] has a null configuration";
299-
final boolean useRemoteClusterProfile = remoteClusterPortEnabled && profileName.equals(REMOTE_CLUSTER_PROFILE);
300-
if (useRemoteClusterProfile) {
301-
profileFilters.put(
302-
profileName,
303-
new CrossClusterAccessServerTransportFilter(
304-
crossClusterAccessAuthcService,
305-
authzService,
306-
threadPool.getThreadContext(),
307-
remoteClusterServerSSLEnabled && SSLService.isSSLClientAuthEnabled(profileConfiguration),
308-
destructiveOperations,
309-
securityContext,
310-
licenseState
311-
)
312-
);
313-
} else {
314-
profileFilters.put(
315-
profileName,
316-
new ServerTransportFilter(
317-
authcService,
318-
authzService,
319-
threadPool.getThreadContext(),
320-
transportSSLEnabled && SSLService.isSSLClientAuthEnabled(profileConfiguration),
321-
destructiveOperations,
322-
securityContext
323-
)
324-
);
325-
}
326-
}
327-
328-
return Collections.unmodifiableMap(profileFilters);
282+
return remoteClusterTransportInterceptor.getProfileFilters(profileConfigurations, destructiveOperations);
329283
}
330284

331285
public static class ProfileSecuredRequestHandler<T extends TransportRequest> implements TransportRequestHandler<T> {

0 commit comments

Comments
 (0)