Skip to content

Improve error handling during index expressions resolving #126018

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Apr 6, 2025
Merged

Improve error handling during index expressions resolving #126018

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c285c8c
Improve error handling during index expressions resolving
slobodanadamovic Apr 1, 2025
f5a1bc2
audit "access denied" only when we actually return access denied error
slobodanadamovic Apr 1, 2025
7037533
drop IAE as it may not actually be client error but rather internal ne
slobodanadamovic Apr 1, 2025
85eaf61
skip auditing only for InvalidIndexNameException
slobodanadamovic Apr 1, 2025
0428284
Merge branch 'main' of github.com:elastic/elasticsearch into sa-impro…
slobodanadamovic Apr 1, 2025
601d8f7
introduce and handle more specific selector validation exceptions
slobodanadamovic Apr 4, 2025
9a73179
fix failing test
slobodanadamovic Apr 4, 2025
c58f8c1
Merge branch 'main' into sa-improve-error-handling
slobodanadamovic Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...rg/elasticsearch/xpack/remotecluster/AbstractRemoteClusterSecurityFailureStoreRestIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ protected Tuple<String, String> getSingleDataAndFailureIndices(String dataStream
}

protected static void assertSelectorsNotSupported(ResponseException exception) {
assertThat(exception.getResponse().getStatusLine().getStatusCode(), equalTo(403));
assertThat(exception.getResponse().getStatusLine().getStatusCode(), equalTo(400));
assertThat(exception.getMessage(), containsString("Selectors are not yet supported on remote cluster patterns"));
}

Expand Down
6 changes: 6 additions & 0 deletions ...stTest/java/org/elasticsearch/xpack/security/failurestore/FailureStoreSecurityRestIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2255,6 +2255,12 @@ private static void expectThrows(ThrowingRunnable runnable, int statusCode) {
assertThat(ex.getResponse().getStatusLine().getStatusCode(), equalTo(statusCode));
}

private static void expectThrows(ThrowingRunnable runnable, int statusCode, String errorMessage) {
var ex = expectThrows(ResponseException.class, runnable);
assertThat(ex.getResponse().getStatusLine().getStatusCode(), equalTo(statusCode));
assertThat(ex.getMessage(), containsString(errorMessage));
}

private void expectThrows(String user, Search search, int statusCode) {
expectThrows(() -> performRequest(user, search.toSearchRequest()), statusCode);
expectThrows(() -> performRequest(user, search.toAsyncSearchRequest()), statusCode);
Expand Down
14 changes: 14 additions & 0 deletions ...n/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@
import org.elasticsearch.core.Nullable;
import org.elasticsearch.core.Tuple;
import org.elasticsearch.index.IndexNotFoundException;
import org.elasticsearch.indices.InvalidIndexNameException;
import org.elasticsearch.license.XPackLicenseState;
import org.elasticsearch.threadpool.ThreadPool;
import org.elasticsearch.transport.TransportActionProxy;
Expand Down Expand Up @@ -502,6 +503,19 @@ private void authorizeAction(
indicesAndAliasesResolver.resolve(action, request, projectMetadata, authorizedIndices)
),
e -> {
if (e instanceof InvalidIndexNameException) {
Copy link
Contributor Author

@slobodanadamovic slobodanadamovic Apr 1, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another exception I've considered was InvalidArgumentException but decided to skip it since it's not guaranteed that it's caused by the user's invalid input (sometimes it hides internal errors). I think we need clearer error handling overall or to be very specific which exceptions we consider client errors (e.g. analyze exception messages) .

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, InvalidArgumentException feels too broad to catch here...

WDYT about adding InvalidSelectorException (extend InvalidArgumentException) and throw that in getByKeyOrThrow and also throw either InvalidSelectorException or InvalidIndexNameException inside ensureNoSelectorsProvided? I think that would cover a decent amount of other cases.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good suggestion. Using a dedicated exception is a way to go. I'll adjust that.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've pushed 601d8f7, which introduces InvalidSelectorException and UnsupportedSelectorException. Let me know what you think.

logger.debug(
() -> Strings.format(
"failed [%s] action authorization for [%s] due [%s] exception",
action,
authentication,
e.getClass().getSimpleName()
),
e
);
listener.onFailure(e);
return;
}
auditTrail.accessDenied(requestId, authentication, action, request, authzInfo);
if (e instanceof IndexNotFoundException) {
listener.onFailure(e);
Expand Down