Skip to content

Commit dcbaa1a

Browse files
cwperkscwperks
authored
Ensure ResourceProvider exists for extracted resourceType (#5802)
1 parent e444495 commit dcbaa1a

File tree

4 files changed

+30
-13
lines changed

4 files changed

+30
-13
lines changed

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/disabled/DirectIndexAccessTests.java‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import static org.opensearch.sample.resource.TestUtils.SAMPLE_RESOURCE_SEARCH_ENDPOINT;
3232
import static org.opensearch.sample.resource.TestUtils.newCluster;
3333
import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
34+
import static org.opensearch.sample.utils.Constants.RESOURCE_TYPE;
3435
import static org.opensearch.security.api.AbstractApiIntegrationTest.forbidden;
3536
import static org.opensearch.test.framework.TestSecurityConfig.User.USER_ADMIN;
3637

@@ -66,7 +67,7 @@ public void testRawAccess_noAccessUser() throws Exception {
6667

6768
// cannot access any raw request
6869
try (TestRestClient client = cluster.getRestClient(NO_ACCESS_USER)) {
69-
String sample = "{\"name\":\"sampleUser\"}";
70+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
7071
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
7172
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
7273
}
@@ -89,7 +90,7 @@ public void testRawAccess_limitedAccessUser() {
8990

9091
// cannot create a resource since user doesn't have indices:data/write/index permission
9192
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
92-
String sample = "{\"name\":\"sampleUser\"}";
93+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
9394
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
9495
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
9596
}
@@ -114,7 +115,7 @@ public void testRawAccess_allAccessUser() {
114115

115116
// cannot create a resource directly since system index protection (SIP) is enabled
116117
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
117-
String sample = "{\"name\":\"sampleUser\"}";
118+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
118119
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
119120
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
120121
}
@@ -179,7 +180,7 @@ public void testRawAccess_noAccessUser() {
179180

180181
// cannot access any raw request
181182
try (TestRestClient client = cluster.getRestClient(NO_ACCESS_USER)) {
182-
String sample = "{\"name\":\"sampleUser\"}";
183+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
183184
TestRestClient.HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
184185
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
185186
}
@@ -202,7 +203,7 @@ public void testRawAccess_limitedAccessUser() {
202203

203204
// cannot create a resource since user doesn't have indices:data/write/index permission
204205
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
205-
String sample = "{\"name\":\"sampleUser\"}";
206+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
206207
TestRestClient.HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
207208
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
208209
}
@@ -228,7 +229,7 @@ public void testRawAccess_allAccessUser() {
228229
// can create a resource
229230
String userResId;
230231
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
231-
String sample = "{\"name\":\"sampleUser\"}";
232+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
232233
TestRestClient.HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
233234
resp.assertStatusCode(HttpStatus.SC_CREATED);
234235
userResId = resp.getTextFromJsonBody("/_id");

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DirectIndexAccessTests.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import static org.opensearch.sample.resource.TestUtils.directSharePayload;
3737
import static org.opensearch.sample.resource.TestUtils.newCluster;
3838
import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
39+
import static org.opensearch.sample.utils.Constants.RESOURCE_TYPE;
3940
import static org.opensearch.test.framework.TestSecurityConfig.User.USER_ADMIN;
4041

4142
/**
@@ -62,7 +63,7 @@ public static class SystemIndexEnabled {
6263
private void assertResourceIndexAccess(String id, TestSecurityConfig.User user) {
6364
// cannot interact with resource index
6465
try (TestRestClient client = cluster.getRestClient(user)) {
65-
String sample = "{\"name\":\"sampleUser\"}";
66+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
6667
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
6768
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
6869
}
@@ -196,7 +197,7 @@ public void testRawAccess_noAccessUser() {
196197

197198
// cannot access any raw request
198199
try (TestRestClient client = cluster.getRestClient(NO_ACCESS_USER)) {
199-
String sample = "{\"name\":\"sampleUser\"}";
200+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
200201
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
201202
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
202203
}
@@ -221,7 +222,7 @@ public void testRawAccess_limitedAccessUser() {
221222

222223
// cannot create a resource since user doesn't have indices:data/write/index permission
223224
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
224-
String sample = "{\"name\":\"sampleUser\"}";
225+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
225226
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc", sample);
226227
resp.assertStatusCode(HttpStatus.SC_FORBIDDEN);
227228
}
@@ -259,7 +260,7 @@ public void testRawAccess_allAccessUser() {
259260
// can create a resource
260261
String userResId;
261262
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
262-
String sample = "{\"name\":\"sampleUser\"}";
263+
String sample = "{\"name\":\"sampleUser\",\"resource_type\":\"" + RESOURCE_TYPE + "\"}";
263264
HttpResponse resp = client.postJson(RESOURCE_INDEX_NAME + "/_doc?refresh=true", sample);
264265
resp.assertStatusCode(HttpStatus.SC_CREATED);
265266
userResId = resp.getTextFromJsonBody("/_id");

‎sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceGroup.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
import static org.opensearch.core.xcontent.ConstructingObjectParser.constructorArg;
2626
import static org.opensearch.core.xcontent.ConstructingObjectParser.optionalConstructorArg;
2727
import static org.opensearch.sample.utils.Constants.RESOURCE_GROUP_TYPE;
28-
import static org.opensearch.sample.utils.Constants.RESOURCE_TYPE;
2928

3029
/**
3130
* Sample resource group declared by this plugin.
@@ -45,7 +44,7 @@ public SampleResourceGroup(StreamInput in) throws IOException {
4544
}
4645

4746
private static final ConstructingObjectParser<SampleResourceGroup, Void> PARSER = new ConstructingObjectParser<>(
48-
RESOURCE_TYPE,
47+
RESOURCE_GROUP_TYPE,
4948
true,
5049
a -> {
5150
SampleResourceGroup s;
@@ -56,21 +55,27 @@ public SampleResourceGroup(StreamInput in) throws IOException {
5655
}
5756
s.setName((String) a[0]);
5857
s.setDescription((String) a[1]);
58+
// ignore a[2] as we know the type
5959
return s;
6060
}
6161
);
6262

6363
static {
6464
PARSER.declareString(constructorArg(), new ParseField("name"));
6565
PARSER.declareStringOrNull(optionalConstructorArg(), new ParseField("description"));
66+
PARSER.declareStringOrNull(optionalConstructorArg(), new ParseField("resource_type"));
6667
}
6768

6869
public static SampleResourceGroup fromXContent(XContentParser parser) throws IOException {
6970
return PARSER.parse(parser, null);
7071
}
7172

7273
public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
73-
return builder.startObject().field("name", name).field("description", description).endObject();
74+
return builder.startObject()
75+
.field("name", name)
76+
.field("description", description)
77+
.field("resource_type", RESOURCE_GROUP_TYPE)
78+
.endObject();
7479
}
7580

7681
public void writeTo(StreamOutput out) throws IOException {

‎src/main/java/org/opensearch/security/resources/ResourceIndexListener.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import org.opensearch.security.resources.sharing.CreatedBy;
2323
import org.opensearch.security.resources.sharing.ResourceSharing;
2424
import org.opensearch.security.setting.OpensearchDynamicSetting;
25+
import org.opensearch.security.spi.resources.ResourceProvider;
2526
import org.opensearch.security.support.ConfigConstants;
2627
import org.opensearch.security.user.User;
2728
import org.opensearch.threadpool.ThreadPool;
@@ -76,6 +77,15 @@ public void postIndex(ShardId shardId, Engine.Index index, Engine.IndexResult re
7677
String resourceType = resourcePluginInfo.getResourceTypeForIndexOp(resourceIndex, index);
7778

7879
String resourceId = index.id();
80+
ResourceProvider provider = resourcePluginInfo.getResourceProvider(resourceType);
81+
if (provider == null) {
82+
log.warn(
83+
"Failed to create a resource sharing entry for resource: {} with type: {}. The type is not declared as a protected type in plugins.security.experimental.resource_sharing.protected_types.",
84+
resourceId,
85+
resourceType
86+
);
87+
return;
88+
}
7989

8090
// Only proceed if this was a create operation and for primary shard
8191
if (!index.origin().equals(Engine.Operation.Origin.PRIMARY)) {

0 commit comments

Comments
 (0)