Skip to content

Commit bf40c8f

Browse files
nibixnibix
committed
Introduced explicit index resolution API
Signed-off-by: Nils Bandener <[email protected]>
1 parent 79a663e commit bf40c8f

File tree

3 files changed

+43
-22
lines changed

3 files changed

+43
-22
lines changed

‎src/main/java/org/opensearch/security/filter/SecurityFilter.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
import org.opensearch.action.search.SearchRequest;
6262
import org.opensearch.action.support.ActionFilter;
6363
import org.opensearch.action.support.ActionFilterChain;
64+
import org.opensearch.action.support.ActionRequestMetadata;
6465
import org.opensearch.action.update.UpdateRequest;
6566
import org.opensearch.cluster.service.ClusterService;
6667
import org.opensearch.common.settings.Settings;
@@ -158,12 +159,13 @@ public <Request extends ActionRequest, Response extends ActionResponse> void app
158159
Task task,
159160
final String action,
160161
Request request,
162+
ActionRequestMetadata<Request, Response> actionRequestMetadata,
161163
ActionListener<Response> listener,
162164
ActionFilterChain<Request, Response> chain
163165
) {
164166
try (StoredContext ctx = threadContext.newStoredContext(true)) {
165167
org.apache.logging.log4j.ThreadContext.clearAll();
166-
apply0(task, action, request, listener, chain);
168+
apply0(task, action, request, actionRequestMetadata, listener, chain);
167169
}
168170
}
169171

@@ -175,6 +177,7 @@ private <Request extends ActionRequest, Response extends ActionResponse> void ap
175177
Task task,
176178
final String action,
177179
Request request,
180+
ActionRequestMetadata<Request, Response> actionRequestMetadata,
178181
ActionListener<Response> listener,
179182
ActionFilterChain<Request, Response> chain
180183
) {

‎src/main/java/org/opensearch/security/privileges/PrivilegesEvaluationContext.java‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,17 @@
1212

1313
import java.util.HashMap;
1414
import java.util.Map;
15+
import java.util.Optional;
1516
import java.util.function.Supplier;
1617

1718
import com.google.common.collect.ImmutableSet;
1819

1920
import org.opensearch.action.ActionRequest;
21+
import org.opensearch.action.support.ActionRequestMetadata;
2022
import org.opensearch.cluster.ClusterState;
2123
import org.opensearch.cluster.metadata.IndexAbstraction;
2224
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
25+
import org.opensearch.cluster.metadata.ResolvedIndices;
2326
import org.opensearch.security.resolver.IndexResolverReplacer;
2427
import org.opensearch.security.support.WildcardMatcher;
2528
import org.opensearch.security.user.User;
@@ -38,13 +41,14 @@ public class PrivilegesEvaluationContext {
3841
private final User user;
3942
private final String action;
4043
private final ActionRequest request;
41-
private IndexResolverReplacer.Resolved resolvedRequest;
44+
private ResolvedIndices resolvedIndices;
4245
private Map<String, IndexAbstraction> indicesLookup;
4346
private final Task task;
4447
private ImmutableSet<String> mappedRoles;
4548
private final IndexResolverReplacer indexResolverReplacer;
4649
private final IndexNameExpressionResolver indexNameExpressionResolver;
4750
private final Supplier<ClusterState> clusterStateSupplier;
51+
private final ActionRequestMetadata<?, ?> actionRequestMetadata;
4852

4953
/**
5054
* This caches the ready to use WildcardMatcher instances for the current request. Many index patterns have
@@ -58,6 +62,7 @@ public PrivilegesEvaluationContext(
5862
ImmutableSet<String> mappedRoles,
5963
String action,
6064
ActionRequest request,
65+
ActionRequestMetadata<?, ?> actionRequestMetadata,
6166
Task task,
6267
IndexResolverReplacer indexResolverReplacer,
6368
IndexNameExpressionResolver indexNameExpressionResolver,
@@ -71,6 +76,7 @@ public PrivilegesEvaluationContext(
7176
this.indexResolverReplacer = indexResolverReplacer;
7277
this.indexNameExpressionResolver = indexNameExpressionResolver;
7378
this.task = task;
79+
this.actionRequestMetadata = actionRequestMetadata;
7480
}
7581

7682
public User getUser() {
@@ -110,12 +116,21 @@ public ActionRequest getRequest() {
110116
return request;
111117
}
112118

113-
public IndexResolverReplacer.Resolved getResolvedRequest() {
114-
IndexResolverReplacer.Resolved result = this.resolvedRequest;
119+
public ResolvedIndices getResolvedRequest() {
120+
if (PrivilegesEvaluator.isClusterPerm(action)) {
121+
return ResolvedIndices.all();
122+
}
123+
124+
ResolvedIndices result = this.resolvedIndices;
115125

116126
if (result == null) {
117-
result = indexResolverReplacer.resolveRequest(request);
118-
this.resolvedRequest = result;
127+
Optional<ResolvedIndices> providedIndices = this.actionRequestMetadata.resolvedIndices();
128+
if (providedIndices.isPresent()) {
129+
result = this.resolvedIndices = providedIndices.get();
130+
} else {
131+
// The action does not implement the resolution mechanism; we have to do it by ourselves
132+
// TODO
133+
}
119134
}
120135

121136
return result;
@@ -166,8 +181,8 @@ public String toString() {
166181
+ '\''
167182
+ ", request="
168183
+ request
169-
+ ", resolvedRequest="
170-
+ resolvedRequest
184+
+ ", resolvedIndices="
185+
+ resolvedIndices
171186
+ ", mappedRoles="
172187
+ mappedRoles
173188
+ '}';

‎src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@
7171
import org.opensearch.action.search.SearchAction;
7272
import org.opensearch.action.search.SearchRequest;
7373
import org.opensearch.action.search.SearchScrollAction;
74+
import org.opensearch.action.support.ActionRequestMetadata;
7475
import org.opensearch.action.support.IndicesOptions;
7576
import org.opensearch.action.termvectors.MultiTermVectorsAction;
7677
import org.opensearch.action.update.UpdateAction;
@@ -79,6 +80,7 @@
7980
import org.opensearch.cluster.metadata.IndexMetadata;
8081
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
8182
import org.opensearch.cluster.metadata.Metadata;
83+
import org.opensearch.cluster.metadata.ResolvedIndices;
8284
import org.opensearch.cluster.service.ClusterService;
8385
import org.opensearch.common.settings.Settings;
8486
import org.opensearch.common.util.concurrent.ThreadContext;
@@ -296,13 +298,14 @@ private void setUserInfoInThreadContext(User user, Set<String> mappedRoles) {
296298
}
297299

298300
public PrivilegesEvaluationContext createContext(User user, String action) {
299-
return createContext(user, action, null, null, null);
301+
return createContext(user, action, null, ActionRequestMetadata.empty(), null, null);
300302
}
301303

302304
public PrivilegesEvaluationContext createContext(
303305
User user,
304306
String action0,
305307
ActionRequest request,
308+
ActionRequestMetadata<?, ?> actionRequestMetadata,
306309
Task task,
307310
Set<String> injectedRoles
308311
) {
@@ -313,7 +316,7 @@ public PrivilegesEvaluationContext createContext(
313316
TransportAddress caller = threadContext.getTransient(ConfigConstants.OPENDISTRO_SECURITY_REMOTE_ADDRESS);
314317
ImmutableSet<String> mappedRoles = ImmutableSet.copyOf((injectedRoles == null) ? mapRoles(user, caller) : injectedRoles);
315318

316-
return new PrivilegesEvaluationContext(user, mappedRoles, action0, request, task, irr, resolver, clusterStateSupplier);
319+
return new PrivilegesEvaluationContext(user, mappedRoles, action0, request, actionRequestMetadata, task, irr, resolver, clusterStateSupplier);
317320
}
318321

319322
public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context) {
@@ -393,10 +396,10 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
393396
return presponse;
394397
}
395398

396-
final Resolved requestedResolved = context.getResolvedRequest();
399+
ResolvedIndices resolvedIndices = context.getResolvedRequest();
397400

398401
if (isDebugEnabled) {
399-
log.debug("RequestedResolved : {}", requestedResolved);
402+
log.debug("RequestedResolved : {}", resolvedIndices);
400403
}
401404

402405
// check snapshot/restore requests
@@ -405,13 +408,13 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
405408
}
406409

407410
// Security index access
408-
if (systemIndexAccessEvaluator.evaluate(request, task, action0, requestedResolved, presponse, context, actionPrivileges, user)
411+
if (systemIndexAccessEvaluator.evaluate(request, task, action0, resolvedIndices, presponse, context, actionPrivileges, user)
409412
.isComplete()) {
410413
return presponse;
411414
}
412415

413416
// Protected index access
414-
if (protectedIndexAccessEvaluator.evaluate(request, task, action0, requestedResolved, presponse, mappedRoles).isComplete()) {
417+
if (protectedIndexAccessEvaluator.evaluate(request, task, action0, resolvedIndices, presponse, mappedRoles).isComplete()) {
415418
return presponse;
416419
}
417420

@@ -440,7 +443,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
440443
log.info(
441444
"No cluster-level perm match for {} {} [Action [{}]] [RolesChecked {}]. No permissions for {}",
442445
user,
443-
requestedResolved,
446+
resolvedIndices,
444447
action0,
445448
mappedRoles,
446449
presponse.getMissingPrivileges()
@@ -460,7 +463,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
460463
action0,
461464
user,
462465
dcm,
463-
requestedResolved,
466+
resolvedIndices,
464467
context,
465468
this.tenantPrivileges.get()
466469
);
@@ -495,7 +498,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
495498
}
496499

497500
// term aggregations
498-
if (termsAggregationEvaluator.evaluate(requestedResolved, request, context, actionPrivileges, presponse).isComplete()) {
501+
if (termsAggregationEvaluator.evaluate(resolvedIndices, request, context, actionPrivileges, presponse).isComplete()) {
499502
return presponse;
500503
}
501504

@@ -510,7 +513,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
510513
}
511514

512515
if (isDebugEnabled) {
513-
log.debug("Requested resolved index types: {}", requestedResolved);
516+
log.debug("Requested resolved index types: {}", resolvedIndices);
514517
log.debug("Security roles: {}", mappedRoles);
515518
}
516519

@@ -523,7 +526,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
523526
action0,
524527
user,
525528
dcm,
526-
requestedResolved,
529+
resolvedIndices,
527530
context,
528531
this.tenantPrivileges.get()
529532
);
@@ -546,7 +549,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
546549

547550
boolean dnfofPossible = dnfofEnabled && DNFOF_MATCHER.test(action0);
548551

549-
presponse = actionPrivileges.hasIndexPrivilege(context, allIndexPermsRequired, requestedResolved);
552+
presponse = actionPrivileges.hasIndexPrivilege(context, allIndexPermsRequired, resolvedIndices);
550553

551554
if (presponse.isPartiallyOk()) {
552555
if (dnfofPossible) {
@@ -571,7 +574,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
571574
}
572575

573576
if (presponse.isAllowed()) {
574-
if (checkFilteredAliases(requestedResolved, action0, isDebugEnabled)) {
577+
if (checkFilteredAliases(resolvedIndices, action0, isDebugEnabled)) {
575578
presponse.allowed = false;
576579
return presponse;
577580
}
@@ -584,7 +587,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
584587
"No {}-level perm match for {} {}: {} [Action [{}]] [RolesChecked {}]",
585588
"index",
586589
user,
587-
requestedResolved,
590+
resolvedIndices,
588591
presponse.getReason(),
589592
action0,
590593
mappedRoles

0 commit comments

Comments
 (0)