Skip to content

Commit 79d15eb

Browse files
n1v0lgn1v0lg
committed
Composite role store tests
1 parent 444112b commit 79d15eb

File tree

2 files changed

+124
-0
lines changed

2 files changed

+124
-0
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,10 @@ boolean hasQuery() {
899899
return query != null;
900900
}
901901

902+
public IndexComponentSelectorPrivilege getSelectorPrivilege() {
903+
return selectorPrivilege;
904+
}
905+
902906
public boolean allowRestrictedIndices() {
903907
return allowRestrictedIndices;
904908
}

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@
8686
import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilegeTests;
8787
import org.elasticsearch.xpack.core.security.authz.privilege.ClusterPrivilegeResolver;
8888
import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
89+
import org.elasticsearch.xpack.core.security.authz.privilege.IndexComponentSelectorPrivilege;
8990
import org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege;
9091
import org.elasticsearch.xpack.core.security.authz.restriction.Workflow;
9192
import org.elasticsearch.xpack.core.security.authz.restriction.WorkflowResolver;
@@ -150,6 +151,7 @@
150151
import static org.elasticsearch.xpack.security.authc.ApiKeyServiceTests.Utils.createApiKeyAuthentication;
151152
import static org.hamcrest.Matchers.anyOf;
152153
import static org.hamcrest.Matchers.arrayContaining;
154+
import static org.hamcrest.Matchers.arrayContainingInAnyOrder;
153155
import static org.hamcrest.Matchers.arrayWithSize;
154156
import static org.hamcrest.Matchers.containsInAnyOrder;
155157
import static org.hamcrest.Matchers.containsString;
@@ -1268,6 +1270,7 @@ public void testBuildRoleWithFlsAndDlsInRemoteIndicesDefinition() {
12681270
false,
12691271
"{\"match\":{\"field\":\"a\"}}",
12701272
new FieldPermissionsDefinition.FieldGrantExcludeGroup(new String[] { "field" }, null),
1273+
IndexComponentSelectorPrivilege.DATA,
12711274
"index-1"
12721275
)
12731276
);
@@ -1303,13 +1306,15 @@ public void testBuildRoleWithFlsAndDlsInRemoteIndicesDefinition() {
13031306
false,
13041307
"{\"match\":{\"field\":\"a\"}}",
13051308
new FieldPermissionsDefinition.FieldGrantExcludeGroup(new String[] { "field" }, null),
1309+
IndexComponentSelectorPrivilege.DATA,
13061310
"index-1"
13071311
),
13081312
indexGroup(
13091313
IndexPrivilege.READ,
13101314
false,
13111315
"{\"match\":{\"field\":\"b\"}}",
13121316
new FieldPermissionsDefinition.FieldGrantExcludeGroup(new String[] { "other" }, null),
1317+
IndexComponentSelectorPrivilege.DATA,
13131318
"index-1"
13141319
)
13151320
);
@@ -1529,6 +1534,90 @@ public void testBuildRoleWithMultipleRemoteClusterMerged() {
15291534
}
15301535
}
15311536

1537+
public void testBuildRoleWithReadFailureStorePrivilegeOnly() {
1538+
String indexPattern = randomAlphanumericOfLength(10);
1539+
final Role role = buildRole(
1540+
roleDescriptorWithIndicesPrivileges(
1541+
"r1",
1542+
new IndicesPrivileges[] { IndicesPrivileges.builder().indices(indexPattern).privileges("read_failure_store").build() }
1543+
)
1544+
);
1545+
assertHasIndexGroups(
1546+
role.indices(),
1547+
indexGroup(IndexPrivilege.READ_FAILURE_STORE, false, IndexComponentSelectorPrivilege.FAILURES, indexPattern)
1548+
);
1549+
}
1550+
1551+
public void testBuildRoleWithReadFailureStorePrivilegeDuplicatesMerged() {
1552+
String indexPattern = randomAlphanumericOfLength(10);
1553+
final Role role = buildRole(
1554+
roleDescriptorWithIndicesPrivileges(
1555+
"r1",
1556+
new IndicesPrivileges[] {
1557+
IndicesPrivileges.builder().indices(indexPattern).privileges("read_failure_store").build(),
1558+
IndicesPrivileges.builder().indices(indexPattern).privileges("read_failure_store").build() }
1559+
)
1560+
);
1561+
assertHasIndexGroups(
1562+
role.indices(),
1563+
indexGroup(IndexPrivilege.READ_FAILURE_STORE, false, IndexComponentSelectorPrivilege.FAILURES, indexPattern)
1564+
);
1565+
}
1566+
1567+
public void testBuildRoleWithReadFailureStoreAndReadPrivilegeSplit() {
1568+
String indexPattern = randomAlphanumericOfLength(10);
1569+
final Role role = buildRole(
1570+
roleDescriptorWithIndicesPrivileges(
1571+
"r1",
1572+
new IndicesPrivileges[] {
1573+
IndicesPrivileges.builder().indices(indexPattern).privileges("read", "read_failure_store").build() }
1574+
)
1575+
);
1576+
assertHasIndexGroups(
1577+
role.indices(),
1578+
indexGroup(IndexPrivilege.READ_FAILURE_STORE, false, IndexComponentSelectorPrivilege.FAILURES, indexPattern),
1579+
indexGroup(IndexPrivilege.READ, false, IndexComponentSelectorPrivilege.DATA, indexPattern)
1580+
);
1581+
}
1582+
1583+
public void testBuildRoleWithMultipleReadFailureStoreAndReadPrivilegeSplit() {
1584+
String indexPattern = randomAlphanumericOfLength(10);
1585+
final Role role = buildRole(
1586+
roleDescriptorWithIndicesPrivileges(
1587+
"r1",
1588+
new IndicesPrivileges[] {
1589+
IndicesPrivileges.builder().indices(indexPattern).privileges("read").build(),
1590+
IndicesPrivileges.builder().indices(indexPattern).privileges("read_failure_store").build() }
1591+
)
1592+
);
1593+
assertHasIndexGroups(
1594+
role.indices(),
1595+
indexGroup(IndexPrivilege.READ_FAILURE_STORE, false, IndexComponentSelectorPrivilege.FAILURES, indexPattern),
1596+
indexGroup(IndexPrivilege.READ, false, IndexComponentSelectorPrivilege.DATA, indexPattern)
1597+
);
1598+
}
1599+
1600+
public void testBuildRoleWithAllPrivilegeIsNeverSplit() {
1601+
String indexPattern = randomAlphanumericOfLength(10);
1602+
final Role role = buildRole(
1603+
roleDescriptorWithIndicesPrivileges(
1604+
"r1",
1605+
new IndicesPrivileges[] {
1606+
IndicesPrivileges.builder().indices(indexPattern).privileges("read", "read_failure_store", "all").build(),
1607+
IndicesPrivileges.builder().indices(indexPattern).privileges("read_failure_store").build() }
1608+
)
1609+
);
1610+
assertHasIndexGroups(
1611+
role.indices(),
1612+
indexGroup(
1613+
IndexPrivilege.get(Set.of("read", "read_failure_store", "all")),
1614+
false,
1615+
IndexComponentSelectorPrivilege.ALL,
1616+
indexPattern
1617+
)
1618+
);
1619+
}
1620+
15321621
public void testCustomRolesProviderFailures() throws Exception {
15331622
final FileRolesStore fileRolesStore = mock(FileRolesStore.class);
15341623
doCallRealMethod().when(fileRolesStore).accept(anySet(), anyActionListener());
@@ -3257,6 +3346,10 @@ private RoleDescriptor roleDescriptorWithRemoteIndicesPrivileges(
32573346
return roleDescriptorWithIndicesPrivileges(name, rips, null);
32583347
}
32593348

3349+
private RoleDescriptor roleDescriptorWithIndicesPrivileges(final String name, final IndicesPrivileges[] ips) {
3350+
return roleDescriptorWithIndicesPrivileges(name, null, ips);
3351+
}
3352+
32603353
private RoleDescriptor roleDescriptorWithIndicesPrivileges(
32613354
final String name,
32623355
final RoleDescriptor.RemoteIndicesPrivileges[] rips,
@@ -3357,6 +3450,12 @@ private void assertHasRemoteIndexGroupsForClusters(
33573450
);
33583451
}
33593452

3453+
@SafeVarargs
3454+
@SuppressWarnings("varargs")
3455+
private void assertHasIndexGroups(final IndicesPermission permission, final Matcher<IndicesPermission.Group>... matchers) {
3456+
assertThat(permission.groups(), arrayContainingInAnyOrder(matchers));
3457+
}
3458+
33603459
private static Matcher<IndicesPermission.Group> indexGroup(final String... indices) {
33613460
return indexGroup(IndexPrivilege.READ, false, indices);
33623461
}
@@ -3371,6 +3470,23 @@ private static Matcher<IndicesPermission.Group> indexGroup(
33713470
allowRestrictedIndices,
33723471
null,
33733472
new FieldPermissionsDefinition.FieldGrantExcludeGroup(null, null),
3473+
IndexComponentSelectorPrivilege.DATA,
3474+
indices
3475+
);
3476+
}
3477+
3478+
private static Matcher<IndicesPermission.Group> indexGroup(
3479+
final IndexPrivilege privilege,
3480+
final boolean allowRestrictedIndices,
3481+
final IndexComponentSelectorPrivilege selectorPrivilege,
3482+
final String... indices
3483+
) {
3484+
return indexGroup(
3485+
privilege,
3486+
allowRestrictedIndices,
3487+
null,
3488+
new FieldPermissionsDefinition.FieldGrantExcludeGroup(null, null),
3489+
selectorPrivilege,
33743490
indices
33753491
);
33763492
}
@@ -3380,6 +3496,7 @@ private static Matcher<IndicesPermission.Group> indexGroup(
33803496
final boolean allowRestrictedIndices,
33813497
@Nullable final String query,
33823498
final FieldPermissionsDefinition.FieldGrantExcludeGroup flsGroup,
3499+
IndexComponentSelectorPrivilege selectorPrivilege,
33833500
final String... indices
33843501
) {
33853502
return new BaseMatcher<>() {
@@ -3393,6 +3510,7 @@ public boolean matches(Object o) {
33933510
&& equalTo(privilege).matches(group.privilege())
33943511
&& equalTo(allowRestrictedIndices).matches(group.allowRestrictedIndices())
33953512
&& equalTo(new FieldPermissions(new FieldPermissionsDefinition(Set.of(flsGroup)))).matches(group.getFieldPermissions())
3513+
&& equalTo(selectorPrivilege).matches(group.getSelectorPrivilege())
33963514
&& arrayContaining(indices).matches(group.indices());
33973515
}
33983516

@@ -3410,6 +3528,8 @@ public void describeTo(Description description) {
34103528
+ query
34113529
+ ", fieldGrantExcludeGroup="
34123530
+ flsGroup
3531+
+ ", selectorPrivilege="
3532+
+ selectorPrivilege
34133533
+ '}'
34143534
);
34153535
}

0 commit comments

Comments
 (0)