Skip to content

Commit

Permalink
Merge remote-tracking branch 'upstream/main' into saml-anony-bug-fix
Browse files Browse the repository at this point in the history
  • Loading branch information
DarshitChanpura committed Apr 9, 2024
2 parents b54b619 + ba74d14 commit 5174654
Show file tree
Hide file tree
Showing 70 changed files with 3,242 additions and 1,546 deletions.
4 changes: 3 additions & 1 deletion .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ jobs:
working-directory: downloaded-artifacts

- name: Upload Coverage with retry
uses: Wandalen/wretry.action@v2.1.0
uses: Wandalen/wretry.action@v3.1.0
with:
attempt_limit: 5
attempt_delay: 2000
Expand Down Expand Up @@ -246,6 +246,8 @@ jobs:

- run: ./gradlew clean assemble -Dbuild.version_qualifier=${{ env.TEST_QUALIFIER }} && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION_ONLY_NUMBER }}-${{ env.TEST_QUALIFIER }}-SNAPSHOT.zip

- run: ./gradlew clean publishPluginZipPublicationToZipStagingRepository && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION }}.zip && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION }}.pom

- name: List files in the build directory if there was an error
run: ls -al ./build/distributions/
if: failure()
3 changes: 1 addition & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,7 @@ plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task

The demo configuration can be modified in the following files to add a new system index to the demo configuration:

- https://github.com/opensearch-project/security/blob/main/tools/install_demo_configuration.sh
- https://github.com/opensearch-project/security/blob/main/tools/install_demo_configuration.bat
- https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java


## Contributing
Expand Down
17 changes: 6 additions & 11 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -407,11 +407,6 @@ opensearchplugin {
// This requires an additional Jar not published as part of build-tools
loggerUsageCheck.enabled = false

// No need to validate pom, as we do not upload to maven/sonatype
tasks.matching {it.path in [":validateMavenPom", ":validateNebulaPom", ":validatePluginZipPom"]}.all { task ->
task.dependsOn ':generatePomFileForNebulaPublication', ':generatePomFileForPluginZipPublication', ':generatePomFileForMavenPublication'
}

publishing {
publications {
pluginZip(MavenPublication) { publication ->
Expand Down Expand Up @@ -618,6 +613,7 @@ dependencies {

//OpenSAML
implementation 'net.shibboleth.utilities:java-support:8.4.1'
runtimeOnly "io.dropwizard.metrics:metrics-core:4.2.25"
implementation "com.onelogin:java-saml:${one_login_java_saml}"
implementation "com.onelogin:java-saml-core:${one_login_java_saml}"
implementation "org.opensaml:opensaml-core:${open_saml_version}"
Expand All @@ -635,21 +631,20 @@ dependencies {
runtimeOnly "org.opensaml:opensaml-soap-impl:${open_saml_version}"
implementation "org.opensaml:opensaml-storage-api:${open_saml_version}"

implementation "com.nulab-inc:zxcvbn:1.8.2"
implementation "com.nulab-inc:zxcvbn:1.9.0"

runtimeOnly 'com.google.guava:failureaccess:1.0.2'
runtimeOnly 'org.apache.commons:commons-text:1.11.0'
runtimeOnly "org.glassfish.jaxb:jaxb-runtime:${jaxb_version}"
runtimeOnly 'com.google.j2objc:j2objc-annotations:2.8'
compileOnly 'com.google.code.findbugs:jsr305:3.0.2'
runtimeOnly 'org.lz4:lz4-java:1.8.0'
runtimeOnly 'io.dropwizard.metrics:metrics-core:4.2.25'
runtimeOnly 'org.slf4j:slf4j-api:1.7.36'
runtimeOnly "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
runtimeOnly 'org.xerial.snappy:snappy-java:1.1.10.5'
runtimeOnly 'org.codehaus.woodstox:stax2-api:4.2.2'
runtimeOnly "org.glassfish.jaxb:txw2:${jaxb_version}"
runtimeOnly 'com.fasterxml.woodstox:woodstox-core:6.6.1'
runtimeOnly 'com.fasterxml.woodstox:woodstox-core:6.6.2'
runtimeOnly 'org.apache.ws.xmlschema:xmlschema-core:2.3.1'
runtimeOnly 'org.apache.santuario:xmlsec:2.3.4'
runtimeOnly "com.github.luben:zstd-jni:${versions.zstd}"
Expand Down Expand Up @@ -704,12 +699,12 @@ dependencies {
exclude(group:'org.springframework', module: 'spring-jcl' )
}
testRuntimeOnly 'org.scala-lang:scala-library:2.13.13'
testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
testRuntimeOnly 'com.typesafe.scala-logging:scala-logging_3:3.9.5'
testRuntimeOnly('org.apache.zookeeper:zookeeper:3.9.2') {
exclude(group:'ch.qos.logback', module: 'logback-classic' )
exclude(group:'ch.qos.logback', module: 'logback-core' )
}
testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
testRuntimeOnly "org.apache.kafka:kafka-metadata:${kafka_version}"
testRuntimeOnly "org.apache.kafka:kafka-storage:${kafka_version}"

Expand All @@ -725,7 +720,7 @@ dependencies {
integrationTestImplementation 'junit:junit:4.13.2'
integrationTestImplementation "org.opensearch.plugin:reindex-client:${opensearch_version}"
integrationTestImplementation "org.opensearch.plugin:percolator-client:${opensearch_version}"
integrationTestImplementation 'commons-io:commons-io:2.15.1'
integrationTestImplementation 'commons-io:commons-io:2.16.0'
integrationTestImplementation "org.apache.logging.log4j:log4j-core:${versions.log4j}"
integrationTestImplementation "org.apache.logging.log4j:log4j-jul:${versions.log4j}"
integrationTestImplementation 'org.hamcrest:hamcrest:2.2'
Expand All @@ -742,7 +737,7 @@ dependencies {
integrationTestImplementation "org.apache.httpcomponents:httpasyncclient:4.1.5"

//spotless
implementation('com.google.googlejavaformat:google-java-format:1.21.0') {
implementation('com.google.googlejavaformat:google-java-format:1.22.0') {
exclude group: 'com.google.guava'
}
}
Expand Down
20 changes: 17 additions & 3 deletions config/roles.yml
Original file line number Diff line number Diff line change
Expand Up @@ -272,25 +272,39 @@ cross_cluster_search_remote_full_access:
- 'indices:data/read/search'

# Allow users to operate query assistant
ml_query_assistant_access:
query_assistant_access:
reserved: true
cluster_permissions:
- 'cluster:admin/opensearch/ml/config/get'
- 'cluster:admin/opensearch/ml/execute'
- 'cluster:admin/opensearch/ml/memory/conversation/create'
- 'cluster:admin/opensearch/ml/memory/interaction/create'
- 'cluster:admin/opensearch/ml/predict'
- 'cluster:admin/opensearch/ppl'

# Allow users to read ML stats/models/tasks
ml_read_access:
reserved: true
cluster_permissions:
- 'cluster:admin/opensearch/ml/config/get'
- 'cluster:admin/opensearch/ml/connectors/get'
- 'cluster:admin/opensearch/ml/connectors/search'
- 'cluster:admin/opensearch/ml/controllers/get'
- 'cluster:admin/opensearch/ml/memory/conversation/get'
- 'cluster:admin/opensearch/ml/memory/conversation/interaction/search'
- 'cluster:admin/opensearch/ml/memory/conversation/list'
- 'cluster:admin/opensearch/ml/memory/conversation/search'
- 'cluster:admin/opensearch/ml/memory/interaction/get'
- 'cluster:admin/opensearch/ml/memory/interaction/list'
- 'cluster:admin/opensearch/ml/memory/trace/get'
- 'cluster:admin/opensearch/ml/model_groups/get'
- 'cluster:admin/opensearch/ml/model_groups/search'
- 'cluster:admin/opensearch/ml/models/get'
- 'cluster:admin/opensearch/ml/models/search'
- 'cluster:admin/opensearch/ml/profile/nodes'
- 'cluster:admin/opensearch/ml/stats/nodes'
- 'cluster:admin/opensearch/ml/tasks/get'
- 'cluster:admin/opensearch/ml/tasks/search'
- 'cluster:admin/opensearch/ml/tools/get'
- 'cluster:admin/opensearch/ml/tools/list'

# Allows users to use all ML functionality
ml_full_access:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
## 2024-03-19 Version 2.13.0.0
## Version 2.13.0.0

Compatible with OpenSearch 2.13.0

Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/
package org.opensearch.security;

import java.io.IOException;
Expand All @@ -19,47 +19,39 @@
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope;
import com.fasterxml.jackson.databind.JsonNode;
import org.apache.commons.io.FileUtils;
import org.apache.http.HttpStatus;
import org.awaitility.Awaitility;
import org.junit.AfterClass;
import org.junit.ClassRule;
import org.junit.Test;
import org.junit.runner.RunWith;

import org.opensearch.test.framework.TestSecurityConfig.User;
import org.opensearch.test.framework.cluster.ClusterManager;
import org.opensearch.security.state.SecurityMetadata;
import org.opensearch.test.framework.TestSecurityConfig;
import org.opensearch.test.framework.cluster.LocalCluster;
import org.opensearch.test.framework.cluster.TestRestClient;
import org.opensearch.test.framework.cluster.TestRestClient.HttpResponse;

import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.aMapWithSize;
import static org.hamcrest.Matchers.allOf;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.hasKey;
import static org.hamcrest.Matchers.not;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;

@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
public class DefaultConfigurationTests {

private final static Path configurationFolder = ConfigurationFiles.createConfigurationDirectory();
private static final User ADMIN_USER = new User("admin");
private static final User NEW_USER = new User("new-user");
private static final User LIMITED_USER = new User("limited-user");

@ClassRule
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
.nodeSettings(
Map.of(
"plugins.security.allow_default_init_securityindex",
true,
"plugins.security.restapi.roles_enabled",
List.of("user_admin__all_access")
)
)
.defaultConfigurationInitDirectory(configurationFolder.toString())
.loadConfigurationIntoIndex(false)
.build();
public abstract class AbstractDefaultConfigurationTests {
public final static Path configurationFolder = ConfigurationFiles.createConfigurationDirectory();
private static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin");
private static final TestSecurityConfig.User NEW_USER = new TestSecurityConfig.User("new-user");
private static final TestSecurityConfig.User LIMITED_USER = new TestSecurityConfig.User("limited-user");

private final LocalCluster cluster;

protected AbstractDefaultConfigurationTests(LocalCluster cluster) {
this.cluster = cluster;
}

@AfterClass
public static void cleanConfigurationDirectory() throws IOException {
Expand All @@ -73,18 +65,43 @@ public void shouldLoadDefaultConfiguration() {
}
try (TestRestClient client = cluster.getRestClient(ADMIN_USER)) {
client.confirmCorrectCredentials(ADMIN_USER.getName());
HttpResponse response = client.get("_plugins/_security/api/internalusers");
response.assertStatusCode(200);
TestRestClient.HttpResponse response = client.get("_plugins/_security/api/internalusers");
response.assertStatusCode(HttpStatus.SC_OK);
Map<String, Object> users = response.getBodyAs(Map.class);
assertThat(
response.getBody(),
users,
allOf(aMapWithSize(3), hasKey(ADMIN_USER.getName()), hasKey(NEW_USER.getName()), hasKey(LIMITED_USER.getName()))
);
}
}

void assertClusterState(final TestRestClient client) {
if (cluster.node().settings().getAsBoolean("plugins.security.allow_default_init_securityindex.use_cluster_state", false)) {
final TestRestClient.HttpResponse response = client.get("_cluster/state");
response.assertStatusCode(HttpStatus.SC_OK);
final var clusterState = response.getBodyAs(Map.class);
assertTrue(response.getBody(), clusterState.containsKey(SecurityMetadata.TYPE));
@SuppressWarnings("unchecked")
final var securityClusterState = (Map<String, Object>) clusterState.get(SecurityMetadata.TYPE);
@SuppressWarnings("unchecked")
final var securityConfiguration = (Map<String, Object>) ((Map<?, ?>) clusterState.get(SecurityMetadata.TYPE)).get(
"configuration"
);
assertTrue(response.getBody(), securityClusterState.containsKey("created"));
assertNotNull(response.getBody(), securityClusterState.get("created"));

for (final var k : securityConfiguration.keySet()) {
@SuppressWarnings("unchecked")
final var sc = (Map<String, Object>) securityConfiguration.get(k);
assertTrue(response.getBody(), sc.containsKey("hash"));
assertTrue(response.getBody(), sc.containsKey("last_modified"));
}
}
}

@Test
public void securityRolesUgrade() throws Exception {
public void securityRolesUpgrade() throws Exception {
try (var client = cluster.getRestClient(ADMIN_USER)) {
// Setup: Make sure the config is ready before starting modifications
Awaitility.await().alias("Load default configuration").until(() -> client.getAuthInfo().getStatusCode(), equalTo(200));
Expand Down Expand Up @@ -159,4 +176,5 @@ private Set<String> extractFieldNames(final JsonNode json) {
json.fieldNames().forEachRemaining(set::add);
return set;
}

}
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/
package org.opensearch.security;

import java.util.List;
import java.util.Map;

import org.junit.ClassRule;

import org.opensearch.test.framework.cluster.ClusterManager;
import org.opensearch.test.framework.cluster.LocalCluster;

public class DefaultConfigurationMultiNodeClusterTests extends AbstractDefaultConfigurationTests {

@ClassRule
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
.nodeSettings(
Map.of(
"plugins.security.allow_default_init_securityindex",
true,
"plugins.security.restapi.roles_enabled",
List.of("user_admin__all_access")
)
)
.defaultConfigurationInitDirectory(configurationFolder.toString())
.loadConfigurationIntoIndex(false)
.build();

public DefaultConfigurationMultiNodeClusterTests() {
super(cluster);
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
/*
* Copyright OpenSearch Contributors
* SPDX-License-Identifier: Apache-2.0
*
* The OpenSearch Contributors require contributions made to
* this file be licensed under the Apache-2.0 license or a
* compatible open source license.
*
*/
package org.opensearch.security;

import java.util.List;
import java.util.Map;

import org.junit.ClassRule;

import org.opensearch.test.framework.cluster.ClusterManager;
import org.opensearch.test.framework.cluster.LocalCluster;

public class DefaultConfigurationMultiNodeClusterUseClusterStateTests extends AbstractDefaultConfigurationTests {

@ClassRule
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
.nodeSettings(
Map.of(
"plugins.security.allow_default_init_securityindex",
true,
"plugins.security.allow_default_init_securityindex.use_cluster_state",
true,
"plugins.security.restapi.roles_enabled",
List.of("user_admin__all_access")
)
)
.defaultConfigurationInitDirectory(configurationFolder.toString())
.loadConfigurationIntoIndex(false)
.build();

public DefaultConfigurationMultiNodeClusterUseClusterStateTests() {
super(cluster);
}

}
Loading

0 comments on commit 5174654

Please sign in to comment.