fix APIKeyRestIT

jakelandis · Apr 10, 2024 · d418688 · d418688
1 parent f5ace91
commit d418688
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/...ity-trial/src/javaRestTest/java/org/elasticsearch/xpack/security/apikey/ApiKeyRestIT.java b/...ity-trial/src/javaRestTest/java/org/elasticsearch/xpack/security/apikey/ApiKeyRestIT.java
@@ -930,7 +930,7 @@ public void testCreateCrossClusterApiKey() throws IOException {
                     XContentTestUtils.convertToMap(
                         new RoleDescriptor(
                             "cross_cluster",
-                            new String[] { "cross_cluster_search", "cross_cluster_replication" },
+                            new String[] { "cross_cluster_search", "monitor_enrich", "cross_cluster_replication" },
                             new RoleDescriptor.IndicesPrivileges[] {
                                 RoleDescriptor.IndicesPrivileges.builder()
                                     .indices("metrics")
@@ -1126,7 +1126,7 @@ public void testUpdateCrossClusterApiKey() throws IOException {
         assertThat(updateResponse1.evaluate("updated"), is(true));
         final RoleDescriptor updatedRoleDescriptor1 = new RoleDescriptor(
             "cross_cluster",
-            new String[] { "cross_cluster_search", "cross_cluster_replication" },
+            new String[] { "cross_cluster_search", "monitor_enrich", "cross_cluster_replication" },
             new RoleDescriptor.IndicesPrivileges[] {
                 RoleDescriptor.IndicesPrivileges.builder()
                     .indices("data")
@@ -1199,7 +1199,7 @@ public void testUpdateCrossClusterApiKey() throws IOException {
         final ObjectPath fetchResponse3 = fetchCrossClusterApiKeyById(apiKeyId);
         final RoleDescriptor updatedRoleDescriptors2 = new RoleDescriptor(
             "cross_cluster",
-            new String[] { "cross_cluster_search" },
+            new String[] { "cross_cluster_search", "monitor_enrich" },
             new RoleDescriptor.IndicesPrivileges[] {
                 RoleDescriptor.IndicesPrivileges.builder()
                     .indices("blogs")

diff --git a/...ity/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationDenialMessages.java b/...ity/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationDenialMessages.java
@@ -116,11 +116,11 @@ public String remoteActionDenied(
             String action,
             String clusterAlias
         ) {
-            assert isIndexAction(action);
             String userText = successfulAuthenticationDescription(authentication, authorizationInfo);
             String remoteClusterText = remoteClusterText(clusterAlias);
-            return actionIsUnauthorizedMessage(action, remoteClusterText, userText)
-                + " because no remote indices privileges apply for the target cluster";
+            String message = isIndexAction(action) ? " because no remote indices privileges apply for the target cluster"
+                : " because no remote cluster privileges apply for the target cluster";
+            return actionIsUnauthorizedMessage(action, remoteClusterText, userText) + message;
         }
 
         protected Collection<String> findClusterPrivilegesThatGrant(