fixup!

Author: jfreden

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/support/SecurityIndexManager.java

@@ -46,7 +46,6 @@
 import org.elasticsearch.rest.RestStatus;
 import org.elasticsearch.threadpool.Scheduler;
 import org.elasticsearch.xcontent.XContentType;
-import org.elasticsearch.xpack.core.security.authc.support.mapper.ExpressionRoleMapping;
 import org.elasticsearch.xpack.core.security.authz.RoleMappingMetadata;
 import org.elasticsearch.xpack.security.SecurityFeatures;
 import org.elasticsearch.xpack.security.action.rolemapping.ReservedRoleMappingAction;
@@ -288,11 +287,12 @@ public void clusterChanged(ClusterChangedEvent event) {
         Tuple<Boolean, Boolean> available = checkIndexAvailable(event.state());
         final boolean indexAvailableForWrite = available.v1();
         final boolean indexAvailableForSearch = available.v2();
-        final Set<ExpressionRoleMapping> reservedStateRoleMappings = RoleMappingMetadata.getFromClusterState(event.state())
-            .getRoleMappings();
-        final boolean clusterStateRoleMappingsSynced = reservedStateRoleMappings.size() == ReservedRoleMappingAction
-            .getFileSettingsMetadataHandlerRoleMappingKeys(event.state())
-            .size();
+        final Set<String> reservedStateRoleMappingNames = ReservedRoleMappingAction.getFileSettingsMetadataHandlerRoleMappingKeys(
+            event.state()
+        );
+        final boolean clusterStateRoleMappingsSynced = reservedStateRoleMappingNames.size() == RoleMappingMetadata.getFromClusterState(
+            event.state()
+        ).getRoleMappings().size();
         final boolean mappingIsUpToDate = indexMetadata == null || checkIndexMappingUpToDate(event.state());
         final int migrationsVersion = getMigrationVersionFromIndexMetadata(indexMetadata);
         final SystemIndexDescriptor.MappingsVersion minClusterMappingVersion = getMinSecurityIndexMappingVersion(event.state());
@@ -334,7 +334,7 @@ public void clusterChanged(ClusterChangedEvent event) {
             allSecurityFeatures.stream()
                 .filter(feature -> featureService.clusterHasFeature(event.state(), feature))
                 .collect(Collectors.toSet()),
-            reservedStateRoleMappings
+            reservedStateRoleMappingNames
         );
         this.state = newState;
 
@@ -345,8 +345,8 @@ public void clusterChanged(ClusterChangedEvent event) {
         }
     }
 
-    public Set<ExpressionRoleMapping> getReservedStateRoleMappings() {
-        return state.reservedStateRoleMappings;
+    public Set<String> getReservedStateRoleMappingNames() {
+        return state.reservedStateRoleMappingNames;
     }
 
     public static int getMigrationVersionFromIndexMetadata(IndexMetadata indexMetadata) {
@@ -715,7 +715,7 @@ public static class State {
         public final IndexMetadata.State indexState;
         public final String indexUUID;
         public final Set<NodeFeature> securityFeatures;
-        public final Set<ExpressionRoleMapping> reservedStateRoleMappings;
+        public final Set<String> reservedStateRoleMappingNames;
 
         public State(
             Instant creationTime,
@@ -733,7 +733,7 @@ public State(
             IndexMetadata.State indexState,
             String indexUUID,
             Set<NodeFeature> securityFeatures,
-            Set<ExpressionRoleMapping> reservedStateRoleMappings
+            Set<String> reservedStateRoleMappingNames
         ) {
             this.creationTime = creationTime;
             this.isIndexUpToDate = isIndexUpToDate;
@@ -750,7 +750,7 @@ public State(
             this.indexState = indexState;
             this.indexUUID = indexUUID;
             this.securityFeatures = securityFeatures;
-            this.reservedStateRoleMappings = reservedStateRoleMappings;
+            this.reservedStateRoleMappingNames = reservedStateRoleMappingNames;
         }
 
         @Override
@@ -772,7 +772,7 @@ public boolean equals(Object o) {
                 && indexHealth == state.indexHealth
                 && indexState == state.indexState
                 && Objects.equals(securityFeatures, state.securityFeatures)
-                && Objects.equals(reservedStateRoleMappings, state.reservedStateRoleMappings);
+                && Objects.equals(reservedStateRoleMappingNames, state.reservedStateRoleMappingNames);
         }
 
         public boolean indexExists() {
@@ -795,7 +795,7 @@ public int hashCode() {
                 concreteIndexName,
                 indexHealth,
                 securityFeatures,
-                reservedStateRoleMappings
+                reservedStateRoleMappingNames
             );
         }
 
@@ -835,7 +835,7 @@ public String toString() {
                 + ", securityFeatures="
                 + securityFeatures
                 + ", reservedStateRoleMappingNames=["
-                + Arrays.toString(reservedStateRoleMappings.stream().map(ExpressionRoleMapping::getName).toArray(String[]::new))
+                + Arrays.toString(reservedStateRoleMappingNames.toArray(String[]::new))
                 + "]"
                 + '}';
         }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/support/SecurityMigrations.java

@@ -34,8 +34,8 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
-import java.util.stream.Collectors;
 
+import static org.elasticsearch.TransportVersions.ADD_MANAGE_ROLES_PRIVILEGE;
 import static org.elasticsearch.xpack.core.ClientHelper.SECURITY_ORIGIN;
 import static org.elasticsearch.xpack.core.ClientHelper.executeAsyncWithOrigin;
 import static org.elasticsearch.xpack.security.support.SecuritySystemIndices.SecurityMainIndexMappingVersion.ADD_REMOTE_CLUSTER_AND_DESCRIPTION_FIELDS;
@@ -136,10 +136,7 @@ public int minMappingVersion() {
 
             @Override
             public void migrate(SecurityIndexManager securityIndexManager, Client client, ActionListener<Void> listener) {
-                Set<String> clusterStateRoleMappingNames = securityIndexManager.getReservedStateRoleMappings()
-                    .stream()
-                    .map(ExpressionRoleMapping::getName)
-                    .collect(Collectors.toSet());
+                Set<String> clusterStateRoleMappingNames = securityIndexManager.getReservedStateRoleMappingNames();
 
                 // No role mappings in cluster state -> no cleanup needed
                 if (clusterStateRoleMappingNames.isEmpty()) {
@@ -199,7 +196,7 @@ public Set<NodeFeature> nodeFeaturesRequired() {
 
             @Override
             public int minMappingVersion() {
-                return ADD_REMOTE_CLUSTER_AND_DESCRIPTION_FIELDS.id();
+                return ADD_MANAGE_ROLES_PRIVILEGE.id();
             }
         })
     );