|
| 1 | +/* |
| 2 | + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one |
| 3 | + * or more contributor license agreements. Licensed under the Elastic License |
| 4 | + * 2.0; you may not use this file except in compliance with the Elastic License |
| 5 | + * 2.0. |
| 6 | + */ |
| 7 | + |
| 8 | +package org.elasticsearch.xpack.security.support; |
| 9 | + |
| 10 | +import org.elasticsearch.action.ActionListener; |
| 11 | +import org.elasticsearch.action.search.SearchRequest; |
| 12 | +import org.elasticsearch.action.search.SearchResponse; |
| 13 | +import org.elasticsearch.action.support.WriteRequest; |
| 14 | +import org.elasticsearch.cluster.metadata.IndexMetadata; |
| 15 | +import org.elasticsearch.cluster.service.ClusterService; |
| 16 | +import org.elasticsearch.core.TimeValue; |
| 17 | +import org.elasticsearch.index.query.QueryBuilders; |
| 18 | +import org.elasticsearch.painless.PainlessPlugin; |
| 19 | +import org.elasticsearch.plugins.Plugin; |
| 20 | +import org.elasticsearch.search.SearchHit; |
| 21 | +import org.elasticsearch.test.ESIntegTestCase; |
| 22 | +import org.elasticsearch.test.ESTestCase; |
| 23 | +import org.elasticsearch.test.SecurityIntegTestCase; |
| 24 | +import org.elasticsearch.xcontent.ToXContent; |
| 25 | +import org.elasticsearch.xcontent.XContentBuilder; |
| 26 | +import org.elasticsearch.xpack.core.security.action.UpdateIndexMigrationVersionAction; |
| 27 | +import org.elasticsearch.xpack.core.security.authz.RoleDescriptor; |
| 28 | +import org.elasticsearch.xpack.security.authz.store.NativeRolesStore; |
| 29 | +import org.junit.Before; |
| 30 | + |
| 31 | +import java.io.IOException; |
| 32 | +import java.util.Collection; |
| 33 | +import java.util.List; |
| 34 | +import java.util.Map; |
| 35 | +import java.util.concurrent.ExecutorService; |
| 36 | +import java.util.concurrent.Executors; |
| 37 | +import java.util.concurrent.atomic.AtomicBoolean; |
| 38 | +import java.util.concurrent.atomic.AtomicLong; |
| 39 | +import java.util.stream.Collectors; |
| 40 | +import java.util.stream.Stream; |
| 41 | + |
| 42 | +import static org.elasticsearch.xcontent.XContentFactory.jsonBuilder; |
| 43 | +import static org.elasticsearch.xpack.core.security.action.UpdateIndexMigrationVersionAction.MIGRATION_VERSION_CUSTOM_DATA_KEY; |
| 44 | +import static org.elasticsearch.xpack.core.security.action.UpdateIndexMigrationVersionAction.MIGRATION_VERSION_CUSTOM_KEY; |
| 45 | +import static org.elasticsearch.xpack.core.security.authz.RoleDescriptor.ROLE_TYPE; |
| 46 | +import static org.elasticsearch.xpack.core.security.test.TestRestrictedIndices.INTERNAL_SECURITY_MAIN_INDEX_7; |
| 47 | +import static org.elasticsearch.xpack.security.support.SecurityMigrations.ROLE_METADATA_FLATTENED_MIGRATION_VERSION; |
| 48 | +import static org.hamcrest.Matchers.greaterThanOrEqualTo; |
| 49 | + |
| 50 | +@ESIntegTestCase.ClusterScope(scope = ESIntegTestCase.Scope.TEST, numDataNodes = 0, autoManageMasterNodes = false) |
| 51 | +public class MetadataFlattenedMigrationIntegTests extends SecurityIntegTestCase { |
| 52 | + |
| 53 | + private final AtomicLong versionCounter = new AtomicLong(1); |
| 54 | + |
| 55 | + @Before |
| 56 | + public void resetVersion() { |
| 57 | + versionCounter.set(1); |
| 58 | + } |
| 59 | + |
| 60 | + public void testMigrationWithConcurrentUpdates() throws Exception { |
| 61 | + internalCluster().setBootstrapMasterNodeIndex(0); |
| 62 | + internalCluster().startNode(); |
| 63 | + ensureGreen(); |
| 64 | + |
| 65 | + waitForMigrationCompletion(); |
| 66 | + var roles = createRoles(); |
| 67 | + final var nativeRoleStore = internalCluster().getInstance(NativeRolesStore.class); |
| 68 | + |
| 69 | + try (ExecutorService executor = Executors.newSingleThreadExecutor()) { |
| 70 | + final AtomicBoolean runUpdateRolesBackground = new AtomicBoolean(true); |
| 71 | + executor.submit(() -> { |
| 72 | + while (runUpdateRolesBackground.get()) { |
| 73 | + // Only update half the list so the other half can be verified as migrated |
| 74 | + RoleDescriptor roleToUpdate = randomFrom(roles.subList(0, roles.size() / 2)); |
| 75 | + |
| 76 | + RoleDescriptor updatedRole = new RoleDescriptor( |
| 77 | + roleToUpdate.getName(), |
| 78 | + new String[] { "monitor" }, |
| 79 | + null, |
| 80 | + null, |
| 81 | + null, |
| 82 | + null, |
| 83 | + Map.of("test", "value", "timestamp", System.currentTimeMillis(), "random", randomAlphaOfLength(10)), |
| 84 | + null |
| 85 | + ); |
| 86 | + nativeRoleStore.putRole( |
| 87 | + WriteRequest.RefreshPolicy.IMMEDIATE, |
| 88 | + updatedRole, |
| 89 | + ActionListener.wrap(resp -> {}, ESTestCase::fail) |
| 90 | + ); |
| 91 | + try { |
| 92 | + Thread.sleep(10); |
| 93 | + } catch (InterruptedException e) { |
| 94 | + throw new RuntimeException(e); |
| 95 | + } |
| 96 | + } |
| 97 | + }); |
| 98 | + |
| 99 | + resetMigration(); |
| 100 | + try { |
| 101 | + waitForMigrationCompletion(); |
| 102 | + } finally { |
| 103 | + runUpdateRolesBackground.set(false); |
| 104 | + executor.shutdown(); |
| 105 | + } |
| 106 | + } |
| 107 | + assertAllRolesHaveMetadataFlattened(); |
| 108 | + } |
| 109 | + |
| 110 | + private void resetMigration() { |
| 111 | + client().execute( |
| 112 | + UpdateIndexMigrationVersionAction.INSTANCE, |
| 113 | + new UpdateIndexMigrationVersionAction.Request( |
| 114 | + TimeValue.MAX_VALUE, |
| 115 | + ROLE_METADATA_FLATTENED_MIGRATION_VERSION - 1, |
| 116 | + INTERNAL_SECURITY_MAIN_INDEX_7 |
| 117 | + ) |
| 118 | + ).actionGet(); |
| 119 | + } |
| 120 | + |
| 121 | + private List<RoleDescriptor> createRoles() throws IOException { |
| 122 | + var roles = randomList( |
| 123 | + 25, |
| 124 | + 50, |
| 125 | + () -> new RoleDescriptor( |
| 126 | + randomAlphaOfLength(20), |
| 127 | + null, |
| 128 | + null, |
| 129 | + null, |
| 130 | + null, |
| 131 | + null, |
| 132 | + Map.of("test", "value", "timestamp", System.currentTimeMillis(), "random", randomAlphaOfLength(10)), |
| 133 | + Map.of() |
| 134 | + ) |
| 135 | + ); |
| 136 | + for (RoleDescriptor role : roles) { |
| 137 | + indexRoleDirectly(role); |
| 138 | + } |
| 139 | + indicesAdmin().prepareRefresh(INTERNAL_SECURITY_MAIN_INDEX_7).get(); |
| 140 | + return roles; |
| 141 | + } |
| 142 | + |
| 143 | + private void indexRoleDirectly(RoleDescriptor role) throws IOException { |
| 144 | + XContentBuilder builder = buildRoleDocument(role); |
| 145 | + prepareIndex(INTERNAL_SECURITY_MAIN_INDEX_7).setId(ROLE_TYPE + "-" + role.getName()) |
| 146 | + .setSource(builder) |
| 147 | + .setRefreshPolicy(WriteRequest.RefreshPolicy.IMMEDIATE) |
| 148 | + .get(); |
| 149 | + } |
| 150 | + |
| 151 | + private XContentBuilder buildRoleDocument(RoleDescriptor role) throws IOException { |
| 152 | + XContentBuilder builder = jsonBuilder().startObject(); |
| 153 | + // metadata_flattened is populated by the native role store, so write directly to index to simulate pre-migration state |
| 154 | + role.innerToXContent(builder, ToXContent.EMPTY_PARAMS, true); |
| 155 | + builder.endObject(); |
| 156 | + return builder; |
| 157 | + } |
| 158 | + |
| 159 | + private int getCurrentMigrationVersion() { |
| 160 | + ClusterService clusterService = internalCluster().getInstance(ClusterService.class); |
| 161 | + IndexMetadata indexMetadata = clusterService.state().metadata().getProject().index(INTERNAL_SECURITY_MAIN_INDEX_7); |
| 162 | + if (indexMetadata == null || indexMetadata.getCustomData(MIGRATION_VERSION_CUSTOM_KEY) == null) { |
| 163 | + return 0; |
| 164 | + } |
| 165 | + return Integer.parseInt(indexMetadata.getCustomData(MIGRATION_VERSION_CUSTOM_KEY).get(MIGRATION_VERSION_CUSTOM_DATA_KEY)); |
| 166 | + } |
| 167 | + |
| 168 | + private void waitForMigrationCompletion() throws Exception { |
| 169 | + assertBusy(() -> assertThat(getCurrentMigrationVersion(), greaterThanOrEqualTo(ROLE_METADATA_FLATTENED_MIGRATION_VERSION))); |
| 170 | + } |
| 171 | + |
| 172 | + private void assertAllRolesHaveMetadataFlattened() { |
| 173 | + SearchRequest searchRequest = new SearchRequest(INTERNAL_SECURITY_MAIN_INDEX_7); |
| 174 | + searchRequest.source().query(QueryBuilders.termQuery("type", "role")).size(1000); |
| 175 | + SearchResponse response = client().search(searchRequest).actionGet(); |
| 176 | + for (SearchHit hit : response.getHits().getHits()) { |
| 177 | + @SuppressWarnings("unchecked") |
| 178 | + Map<String, Object> metadata = (Map<String, Object>) hit.getSourceAsMap().get("metadata_flattened"); |
| 179 | + // Only check non-reserved roles |
| 180 | + if (metadata.get("_reserved") == null) { |
| 181 | + assertEquals("value", metadata.get("test")); |
| 182 | + } |
| 183 | + } |
| 184 | + response.decRef(); |
| 185 | + } |
| 186 | + |
| 187 | + @Override |
| 188 | + protected Collection<Class<? extends Plugin>> nodePlugins() { |
| 189 | + return Stream.concat(super.nodePlugins().stream(), Stream.of(PainlessPlugin.class)).collect(Collectors.toList()); |
| 190 | + } |
| 191 | +} |
0 commit comments