Skip to content

Fix compilation and tests for customAuthzEngine #125469

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 24, 2025
Merged

Fix compilation and tests for customAuthzEngine #125469

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f49fd61
Fix compilation and tests for customAuthzEngine
ywangd Mar 23, 2025
4d9ee4c
simplify
ywangd Mar 23, 2025
6e8339c
fix custom processor
ywangd Mar 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion ...essor/src/main/java/org/elasticsearch/example/customprocessor/ExampleRepeatProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
package org.elasticsearch.example.customprocessor;

import org.elasticsearch.cluster.metadata.ProjectId;
import org.elasticsearch.ingest.AbstractProcessor;
import org.elasticsearch.ingest.ConfigurationUtils;
import org.elasticsearch.ingest.IngestDocument;
Expand Down Expand Up @@ -44,7 +45,8 @@ public ExampleRepeatProcessor create(
Map<String, Processor.Factory> registry,
String tag,
String description,
Map<String, Object> config
Map<String, Object> config,
ProjectId projectId
Comment on lines -47 to +49
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not related to custom authz engine. But needs to be fixed as well so that CI can pass.

) {
String field = ConfigurationUtils.readStringProperty(TYPE, tag, config, FIELD_KEY_NAME);
return new ExampleRepeatProcessor(tag, description, field);
Expand Down
12 changes: 6 additions & 6 deletions ...thorization-engine/src/main/java/org/elasticsearch/example/CustomAuthorizationEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,15 +87,15 @@ public void authorizeClusterAction(RequestInfo requestInfo, AuthorizationInfo au
}

@Override
SubscribableListener<IndexAuthorizationResult> void authorizeIndexAction(
public SubscribableListener<IndexAuthorizationResult> authorizeIndexAction(
RequestInfo requestInfo,
AuthorizationInfo authorizationInfo,
AsyncSupplier<ResolvedIndices> indicesAsyncSupplier,
ProjectMetadata project
) {
if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) {
ActionListener<IndexAuthorizationResult> listener = new SubscribableListener<>();
indicesAsyncSupplier.getAsync(ActionListener.wrap(resolvedIndices -> {
SubscribableListener<IndexAuthorizationResult> listener = new SubscribableListener<>();
indicesAsyncSupplier.getAsync().addListener(ActionListener.wrap(resolvedIndices -> {
Map<String, IndexAccessControl> indexAccessControlMap = new HashMap<>();
for (String name : resolvedIndices.getLocal()) {
indexAccessControlMap.put(name, new IndexAccessControl(FieldPermissions.DEFAULT, null));
Expand All @@ -106,7 +106,7 @@ SubscribableListener<IndexAuthorizationResult> void authorizeIndexAction(
}, listener::onFailure));
return listener;
} else {
return SubscribableListener.succcess(new IndexAuthorizationResult(IndicesAccessControl.DENIED));
return SubscribableListener.newSucceeded(new IndexAuthorizationResult(IndicesAccessControl.DENIED));
}
}

Expand All @@ -120,7 +120,7 @@ public void loadAuthorizedIndices(
if (isSuperuser(requestInfo.getAuthentication().getEffectiveSubject().getUser())) {
listener.onResponse(new AuthorizedIndices() {
public Set<String> all(IndexComponentSelector selector) {
return () -> indicesLookup.keySet();
return indicesLookup.keySet();
}
public boolean check(String name, IndexComponentSelector selector) {
return indicesLookup.containsKey(name);
Expand All @@ -129,7 +129,7 @@ public boolean check(String name, IndexComponentSelector selector) {
} else {
listener.onResponse(new AuthorizedIndices() {
public Set<String> all(IndexComponentSelector selector) {
return () -> Set.of();
return Set.of();
}
public boolean check(String name, IndexComponentSelector selector) {
return false;
Expand Down
104 changes: 59 additions & 45 deletions ...zation-engine/src/test/java/org/elasticsearch/example/CustomAuthorizationEngineTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,8 @@

import org.elasticsearch.action.search.SearchRequest;
import org.elasticsearch.action.support.PlainActionFuture;
import org.elasticsearch.cluster.metadata.IndexAbstraction;
import org.elasticsearch.cluster.metadata.IndexAbstraction.ConcreteIndex;
import org.elasticsearch.action.support.SubscribableListener;
import org.elasticsearch.cluster.metadata.IndexMetadata;
import org.elasticsearch.cluster.metadata.Metadata;
import org.elasticsearch.cluster.metadata.ProjectMetadata;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.index.IndexVersion;
Expand All @@ -31,9 +29,6 @@
import org.elasticsearch.xpack.core.security.user.User;

import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.stream.Stream;

import static org.hamcrest.Matchers.is;

Expand All @@ -52,13 +47,15 @@ public void testGetAuthorizationInfo() {

public void testAuthorizeRunAs() {
final String action = "cluster:monitor/foo";
final TransportRequest request = new TransportRequest() {};
final TransportRequest request = new TransportRequest() {
};
CustomAuthorizationEngine engine = new CustomAuthorizationEngine();
// unauthorized
{
Authentication authentication = Authentication
.newRealmAuthentication(new User("bar", "not_superuser"), new RealmRef("test", "test", "node"))
.runAs(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node"));
Authentication authentication = Authentication.newRealmAuthentication(
new User("bar", "not_superuser"),
new RealmRef("test", "test", "node")
).runAs(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node"));
Comment on lines -59 to +58
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No real change here other than format. This module has not been properly formatted for a while. There are a few more places in the PR like this.

RequestInfo info = new RequestInfo(authentication, request, action, null);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(info, future);
Expand All @@ -72,9 +69,10 @@ public void testAuthorizeRunAs() {

// authorized
{
Authentication authentication = Authentication
.newRealmAuthentication(new User("bar", "custom_superuser"), new RealmRef("test", "test", "node"))
.runAs(new User("joe", "not_superuser"), new RealmRef("test", "test", "node"));
Authentication authentication = Authentication.newRealmAuthentication(
new User("bar", "custom_superuser"),
new RealmRef("test", "test", "node")
).runAs(new User("joe", "not_superuser"), new RealmRef("test", "test", "node"));
RequestInfo info = new RequestInfo(authentication, request, action, null);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(info, future);
Expand Down Expand Up @@ -103,10 +101,12 @@ public void testAuthorizeClusterAction() {

// unauthorized
{
RequestInfo unauthReqInfo =
new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
requestInfo.getRequest(), requestInfo.getAction(), null);
RequestInfo unauthReqInfo = new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
requestInfo.getRequest(),
requestInfo.getAction(),
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(unauthReqInfo, future);
AuthorizationInfo authzInfo = future.actionGet();
Expand All @@ -120,48 +120,59 @@ public void testAuthorizeClusterAction() {

public void testAuthorizeIndexAction() {
CustomAuthorizationEngine engine = new CustomAuthorizationEngine();
ProjectMetadata project = ProjectMetadata.builder(randomProjectIdOrDefault()).put(IndexMetadata.builder("index")
.settings(Settings.builder().put("index.version.created", IndexVersion.current()))
.numberOfShards(1)
.numberOfReplicas(0)
.build(),
false
).build();
ProjectMetadata project = ProjectMetadata.builder(randomProjectIdOrDefault())
.put(
IndexMetadata.builder("index")
.settings(Settings.builder().put("index.version.created", IndexVersion.current()))
.numberOfShards(1)
.numberOfReplicas(0)
.build(),
false
)
.build();
// authorized
{
RequestInfo requestInfo =
new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")),
new SearchRequest(), "indices:data/read/search", null);
RequestInfo requestInfo = new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node")),
new SearchRequest(),
"indices:data/read/search",
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(requestInfo, future);
AuthorizationInfo authzInfo = future.actionGet();

PlainActionFuture<IndexAuthorizationResult> resultFuture = new PlainActionFuture<>();
engine.authorizeIndexAction(requestInfo, authzInfo,
listener -> listener.onResponse(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
project, resultFuture);
IndexAuthorizationResult result = resultFuture.actionGet();
final SubscribableListener<IndexAuthorizationResult> resultListener = engine.authorizeIndexAction(
requestInfo,
authzInfo,
() -> SubscribableListener.newSucceeded(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
project
);
IndexAuthorizationResult result = safeAwait(resultListener);
assertThat(result.isGranted(), is(true));
IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl();
assertNotNull(indicesAccessControl.getIndexPermissions("index"));
}

// unauthorized
{
RequestInfo requestInfo =
new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
new SearchRequest(), "indices:data/read/search", null);
RequestInfo requestInfo = new RequestInfo(
Authentication.newRealmAuthentication(new User("joe", "not_superuser"), new RealmRef("test", "test", "node")),
new SearchRequest(),
"indices:data/read/search",
null
);
PlainActionFuture<AuthorizationInfo> future = new PlainActionFuture<>();
engine.resolveAuthorizationInfo(requestInfo, future);
AuthorizationInfo authzInfo = future.actionGet();

PlainActionFuture<IndexAuthorizationResult> resultFuture = new PlainActionFuture<>();
engine.authorizeIndexAction(requestInfo, authzInfo,
listener -> listener.onResponse(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
project, resultFuture);
IndexAuthorizationResult result = resultFuture.actionGet();
final SubscribableListener<IndexAuthorizationResult> resultListener = engine.authorizeIndexAction(
requestInfo,
authzInfo,
() -> SubscribableListener.newSucceeded(new ResolvedIndices(Collections.singletonList("index"), Collections.emptyList())),
project
);
IndexAuthorizationResult result = safeAwait(resultListener);
assertThat(result.isGranted(), is(false));
IndicesAccessControl indicesAccessControl = result.getIndicesAccessControl();
assertNull(indicesAccessControl.getIndexPermissions("index"));
Expand All @@ -170,9 +181,12 @@ public void testAuthorizeIndexAction() {

private RequestInfo getRequestInfo() {
final String action = "cluster:monitor/foo";
final TransportRequest request = new TransportRequest() {};
final Authentication authentication =
Authentication.newRealmAuthentication(new User("joe", "custom_superuser"), new RealmRef("test", "test", "node"));
final TransportRequest request = new TransportRequest() {
};
final Authentication authentication = Authentication.newRealmAuthentication(
new User("joe", "custom_superuser"),
new RealmRef("test", "test", "node")
);
return new RequestInfo(authentication, request, action, null);
}
}