Skip to content

Commit 892e99f

Browse files
DarshitChanpuraDarshitChanpura
authored
[Resource Sharing] Requires default_owner for resource/migrate API (#5789)
Signed-off-by: Darshit Chanpura <[email protected]>
1 parent dcbaa1a commit 892e99f

File tree

12 files changed

+402
-160
lines changed

12 files changed

+402
-160
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
1919
- Get list of headersToCopy from core and use getHeader(String headerName) instead of getHeaders() ([#5769](https://github.com/opensearch-project/security/pull/5769))
2020
- [Resource Sharing] Keep track of resource_type on resource sharing document ([#5772](https://github.com/opensearch-project/security/pull/5772))
2121
- Add support for X509 v3 extensions (SAN) for authentication ([#5701](https://github.com/opensearch-project/security/pull/5701))
22+
- [Resource Sharing] Requires default_owner for resource/migrate API ([#5789](https://github.com/opensearch-project/security/pull/5789))
2223

2324
### Bug Fixes
2425
- Create a WildcardMatcher.NONE when creating a WildcardMatcher with an empty string ([#5694](https://github.com/opensearch-project/security/pull/5694))

‎RESOURCE_SHARING_AND_ACCESS_CONTROL.md‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -605,11 +605,12 @@ Read documents from a plugin’s index and migrate ownership and backend role-ba
605605

606606
**Request Body**
607607

608-
| Parameter | Type | Required | Description |
609-
|------------------------|--------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------|
610-
| `source_index` | string | yes | Name of the plugin index containing the existing resource documents |
611-
| `username_path` | string | yes | JSON Pointer to the username field inside each document |
612-
| `backend_roles_path` | string | yes | JSON Pointer to the backend_roles field (must point to a JSON array) |
608+
| Parameter | Type | Required | Description |
609+
|------------------------|--------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
610+
| `source_index` | string | yes | Name of the plugin index containing the existing resource documents |
611+
| `username_path` | string | yes | JSON Pointer to the username field inside each document |
612+
| `backend_roles_path` | string | yes | JSON Pointer to the backend_roles field (must point to a JSON array) |
613+
| `default_owner` | string | yes | Name of the user to be used as owner for resource without owner information |
613614
| `default_access_level` | object | yes | Default access level to assign migrated backend_roles. Must be one from the available action-groups for this type. See `resource-action-groups.yml`. |
614615

615616
**Example Request**
@@ -620,6 +621,7 @@ Read documents from a plugin’s index and migrate ownership and backend role-ba
620621
"source_index": ".sample_resource",
621622
"username_path": "/owner",
622623
"backend_roles_path": "/backend_roles",
624+
"default_owner": "some_user",
623625
"default_access_level": {
624626
"sample-resource": "read_only",
625627
"sample-resource-group": "read-only-group"
@@ -631,8 +633,9 @@ Read documents from a plugin’s index and migrate ownership and backend role-ba
631633

632634
```json
633635
{
634-
"summary": "Migration complete. migrated 10; skippedNoUser 2; failed 1",
635-
"skippedResources": ["doc-17", "doc-22"]
636+
"summary": "Migration complete. migrated 10; skippedNoType 1; skippedExisting 0; failed 1",
637+
"resourcesWithDefaultOwner": ["doc-17"],
638+
"skippedResources": ["doc-22"]
636639
}
637640
```
638641

‎config/roles.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ security_rest_api_full_access:
1818
- 'restapi:admin/config/update'
1919
- 'restapi:admin/internalusers'
2020
- 'restapi:admin/nodesdn'
21+
- 'restapi:admin/resource_sharing/migrate'
2122
- 'restapi:admin/roles'
2223
- 'restapi:admin/rolesmapping'
2324
- 'restapi:admin/ssl/certs/info'

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -158,11 +158,12 @@ public static String migrationPayload_valid() {
158158
"source_index": "%s",
159159
"username_path": "%s",
160160
"backend_roles_path": "%s",
161+
"default_owner": "%s",
161162
"default_access_level": {
162163
"sample-resource": "%s"
163164
}
164165
}
165-
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "sample_read_only");
166+
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "some_user", "sample_read_only");
166167
}
167168

168169
public static String migrationPayload_valid_withSpecifiedAccessLevel(String accessLevel) {
@@ -171,57 +172,75 @@ public static String migrationPayload_valid_withSpecifiedAccessLevel(String acce
171172
"source_index": "%s",
172173
"username_path": "%s",
173174
"backend_roles_path": "%s",
175+
"default_owner": "%s",
174176
"default_access_level": {
175177
"sample-resource": "%s"
176178
}
177179
}
178-
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", accessLevel);
180+
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "some_user", accessLevel);
179181
}
180182

181183
public static String migrationPayload_missingSourceIndex() {
182184
return """
183185
{
184186
"username_path": "%s",
185187
"backend_roles_path": "%s",
188+
"default_owner": "%s",
186189
"default_access_level": {
187190
"sample-resource": "%s"
188191
}
189192
}
190-
""".formatted("user/name", "user/backend_roles", "sample_read_only");
193+
""".formatted("user/name", "user/backend_roles", "some_user", "sample_read_only");
191194
}
192195

193196
public static String migrationPayload_missingUserName() {
194197
return """
195198
{
196199
"source_index": "%s",
197200
"backend_roles_path": "%s",
201+
"default_owner": "%s",
198202
"default_access_level": {
199203
"sample-resource": "%s"
200204
}
201205
}
202-
""".formatted(RESOURCE_INDEX_NAME, "user/backend_roles", "sample_read_only");
206+
""".formatted(RESOURCE_INDEX_NAME, "user/backend_roles", "some_user", "sample_read_only");
203207
}
204208

205209
public static String migrationPayload_missingBackendRoles() {
206210
return """
207211
{
208212
"source_index": "%s",
209213
"username_path": "%s",
214+
"default_owner": "%s",
210215
"default_access_level": {
211216
"sample-resource": "%s"
212217
}
213218
}
214-
""".formatted(RESOURCE_INDEX_NAME, "user/name", "sample_read_only");
219+
""".formatted(RESOURCE_INDEX_NAME, "user/name", "some_user", "sample_read_only");
215220
}
216221

217222
public static String migrationPayload_missingDefaultAccessLevel() {
218223
return """
219224
{
220225
"source_index": "%s",
221226
"username_path": "%s",
222-
"backend_roles_path": "%s"
227+
"backend_roles_path": "%s",
228+
"default_owner": "%s"
229+
}
230+
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "some_user");
231+
}
232+
233+
public static String migrationPayload_missingDefaultOwner() {
234+
return """
235+
{
236+
"source_index": "%s",
237+
"username_path": "%s",
238+
"backend_roles_path": "%s",
239+
"default_access_level": {
240+
"sample-resource": "%s"
241+
}
223242
}
224-
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles");
243+
""".formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "sample_read_only");
225244
}
226245

227246
public static String putSharingInfoPayload(

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/FeatureFlagSettingTests.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,10 @@ public void testBehaviorAfterEnabling() throws Exception {
256256
try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
257257
TestRestClient.HttpResponse migrateResponse = client.postJson(RESOURCE_SHARING_MIGRATION_ENDPOINT, migrationPayload_valid());
258258
migrateResponse.assertStatusCode(HttpStatus.SC_OK);
259-
assertThat(migrateResponse.bodyAsMap().get("summary"), equalTo("Migration complete. migrated 1; skippedNoUser 0; failed 0"));
259+
assertThat(
260+
migrateResponse.bodyAsMap().get("summary"),
261+
equalTo("Migration complete. migrated 1; skippedNoType 0; skippedExisting 0; failed 0")
262+
);
260263
}
261264

262265
// “Enabled” expectations:

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/ProtectedTypesSettingTests.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,10 @@ public void testResourceProtected() throws Exception {
258258
try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
259259
TestRestClient.HttpResponse migrateResponse = client.postJson(RESOURCE_SHARING_MIGRATION_ENDPOINT, migrationPayload_valid());
260260
migrateResponse.assertStatusCode(HttpStatus.SC_OK);
261-
assertThat(migrateResponse.bodyAsMap().get("summary"), equalTo("Migration complete. migrated 1; skippedNoUser 0; failed 0"));
261+
assertThat(
262+
migrateResponse.bodyAsMap().get("summary"),
263+
equalTo("Migration complete. migrated 1; skippedNoType 0; skippedExisting 0; failed 0")
264+
);
262265
}
263266

264267
// Marked as protected type; expectations:

0 commit comments

Comments
 (0)