Optimize privilege evaluation for all_access role

Signed-off-by: Craig Perkins <[email protected]>
cwperks · Nov 21, 2024 · af69183 · af69183
1 parent 55ff20e
commit af69183
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java b/src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
@@ -1000,12 +1000,15 @@ private static boolean impliesTypePerm(
         if (resolved.isLocalAll()) {
             indexMatcherAndPermissions = ipatterns.stream()
                 .filter(indexPattern -> "*".equals(indexPattern.getUnresolvedIndexPattern(user)))
-                .map(p -> new IndexMatcherAndPermissions(p.attemptResolveIndexNames(user, resolver, cs), p.perms))
+                .map(p -> new IndexMatcherAndPermissions(Set.of("*"), p.perms))
                 .toArray(IndexMatcherAndPermissions[]::new);
         } else {
-            indexMatcherAndPermissions = ipatterns.stream()
-                .map(p -> new IndexMatcherAndPermissions(p.attemptResolveIndexNames(user, resolver, cs), p.perms))
-                .toArray(IndexMatcherAndPermissions[]::new);
+            indexMatcherAndPermissions = ipatterns.stream().map(p -> {
+                if ("*".equals(p.getUnresolvedIndexPattern(user))) {
+                    return new IndexMatcherAndPermissions(Set.of("*"), p.perms);
+                }
+                return new IndexMatcherAndPermissions(p.attemptResolveIndexNames(user, resolver, cs), p.perms);
+            }).toArray(IndexMatcherAndPermissions[]::new);
         }
         return resolvedRequestedIndices.stream()
             .allMatch(