Optimized Privilege Evaluation [DRAFT]

build.gradle

@@ -583,6 +583,10 @@ dependencies {
  implementation 'com.nimbusds:nimbus-jose-jwt:9.41.1'
  implementation 'com.rfksystems:blake2b:2.0.0'
  implementation 'com.password4j:password4j:1.8.2'
+
+ // Action privileges: check tables and compact collections
+ implementation 'com.selectivem.collections:special-collections-complete:1.3.1'
+
  //JWT
  implementation "io.jsonwebtoken:jjwt-api:${jjwt_version}"
  implementation "io.jsonwebtoken:jjwt-impl:${jjwt_version}"

src/integrationTest/java/org/opensearch/security/privileges/IndexPatternTest.java

@@ -0,0 +1,197 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ * Modifications Copyright OpenSearch Contributors. See
+ * GitHub history for details.
+ */
+package org.opensearch.security.privileges;
+
+import java.time.ZonedDateTime;
+import java.time.temporal.ChronoField;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import org.junit.Test;
+
+import org.opensearch.cluster.ClusterState;
+import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
+import org.opensearch.cluster.metadata.Metadata;
+import org.opensearch.common.settings.Settings;
+import org.opensearch.common.util.concurrent.ThreadContext;
+import org.opensearch.security.resolver.IndexResolverReplacer;
+import org.opensearch.security.support.WildcardMatcher;
+import org.opensearch.security.user.User;
+
+import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class IndexPatternTest {
+ final static int CURRENT_YEAR = ZonedDateTime.now().get(ChronoField.YEAR);
+ final static int NEXT_YEAR = CURRENT_YEAR + 1;
+
+ final static Metadata INDEX_METADATA = //
+ indices("index_a11", "index_a12", "index_a21", "index_a22", "index_b1", "index_b2")//
+ .alias("alias_a")
+ .of("index_a11", "index_a12", "index_a21", "index_a22")//
+ .alias("alias_b")
+ .of("index_b1", "index_b2")//
+ .dataStream("data_stream_a1")//
+ .dataStream("data_stream_b1")//
+ .index("index_year_" + CURRENT_YEAR)//
+ .index("index_year_" + NEXT_YEAR)//
+ .alias("alias_year_" + CURRENT_YEAR)
+ .of("index_current_year")//
+ .alias("alias_year_" + NEXT_YEAR)
+ .of("index_next_year")//
+ .build();
+ final static ClusterState CLUSTER_STATE = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(INDEX_METADATA).build();
+
+ @Test
+ public void constantIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("index_a11");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+ assertTrue(indexPattern.dynamicOnly().isEmpty());
+ assertEquals("index_a11", indexPattern.toString());
+
+ assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_a12", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void constantAlias() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("alias_a");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("alias_a", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("alias_a1", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void constantAlias_onIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("alias_a");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_b1", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void constantDataStream_onIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("data_stream_a1");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches(".ds-data_stream_a1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches(".ds-data_stream_a2-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void patternIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("index_a1*");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_a21", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void patternAlias() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("alias_a*");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("alias_a", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("alias_b", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void patternAlias_onIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("alias_a*");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_b1", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void patternDataStream_onIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("data_stream_a*");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertFalse(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches(".ds-data_stream_a1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches(".ds-data_stream_b1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void dateMathIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("<index_year_{now/y{yyyy}}>");
+ assertFalse(indexPattern.hasStaticPattern());
+ assertTrue(indexPattern.hasDynamicPattern());
+ assertEquals("index_a11", indexPattern.toString());
+
+ assertTrue(indexPattern.matches("index_year_" + CURRENT_YEAR, ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_year_" + NEXT_YEAR, ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void dateMathAlias_onIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("<alias_year_{now/y{yyyy}}>");
+ assertFalse(indexPattern.hasStaticPattern());
+ assertTrue(indexPattern.hasDynamicPattern());
+
+ assertTrue(indexPattern.matches("index_current_year", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_next_year", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void templatedIndex() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("index_${attrs.a11}");
+ assertFalse(indexPattern.hasStaticPattern());
+ assertTrue(indexPattern.hasDynamicPattern());
+ assertEquals(indexPattern, indexPattern.dynamicOnly());
+
+ assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
+ assertFalse(indexPattern.matches("index_a12", ctx(), INDEX_METADATA.getIndicesLookup()));
+ }
+
+ @Test
+ public void mixed() throws Exception {
+ IndexPattern indexPattern = IndexPattern.from("index_${attrs.a11}", "index_a12");
+ assertTrue(indexPattern.hasStaticPattern());
+ assertTrue(indexPattern.hasDynamicPattern());
+
+ assertEquals(WildcardMatcher.from("index_a12"), indexPattern.getStaticPattern());
+ assertEquals(IndexPattern.from("index_${attrs.a11}"), indexPattern.dynamicOnly());
+ }
+
+ private static PrivilegesEvaluationContext ctx() {
+ IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
+ IndexResolverReplacer indexResolverReplacer = new IndexResolverReplacer(indexNameExpressionResolver, () -> CLUSTER_STATE, null);
+ User user = new User("test_user");
+ user.addAttributes(ImmutableMap.of("attrs.a11", "a11"));
+ user.addAttributes(ImmutableMap.of("attrs.year", "year"));
+
+ return new PrivilegesEvaluationContext(
+ user,
+ ImmutableSet.of(),
+ "indices:action/test",
+ null,
+ null,
+ indexResolverReplacer,
+ indexNameExpressionResolver,
+ () -> CLUSTER_STATE
+ );
+ }
+}

src/integrationTest/java/org/opensearch/security/privileges/PrivilegeEvaluatorResponseMatcher.java

@@ -0,0 +1,182 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ * Modifications Copyright OpenSearch Contributors. See
+ * GitHub history for details.
+ */
+package org.opensearch.security.privileges;
+
+import java.util.Arrays;
+import java.util.Set;
+
+import com.google.common.collect.ImmutableSet;
+import org.hamcrest.Description;
+import org.hamcrest.DiagnosingMatcher;
+
+/**
+ * Provides hamcrest matchers for PrivilegesEvaluatorResponse instances, which can be used with assertThat() calls.
+ */
+public abstract class PrivilegeEvaluatorResponseMatcher extends DiagnosingMatcher<PrivilegesEvaluatorResponse> {
+
+ /**
+ * Asserts that the status of the PrivilegesEvaluatorResponse is "allowed".
+ */
+ public static PrivilegeEvaluatorResponseMatcher isAllowed() {
+ return new PrivilegeEvaluatorResponseMatcher() {
+ @Override
+ public void describeTo(Description description) {
+ description.appendText("Request is fully allowed; isAllowed() returns true");
+ }
+
+ @Override
+ protected boolean matches(PrivilegesEvaluatorResponse response, Description mismatchDescription) {
+ if (!response.isAllowed()) {
+ mismatchDescription.appendText("isAllowed() is false");
+ return false;
+ }
+
+ if (response.isPartiallyOk()) {
+ mismatchDescription.appendText("isPartiallyOk() must be false if isAllowed() is true");
+ return false;
+ }
+
+ if (!response.getMissingPrivileges().isEmpty()) {
+ mismatchDescription.appendText("getMissingPrivileges() must be empty if isAllowed() is true");
+ return false;
+ }
+
+ return true;
+ }
+ };
+ }
+
+ /**
+ * Asserts that the status of the PrivilegesEvaluatorResponse is neither "allowed" or "partially allowed". You can
+ * add missingPrivileges sub-matchers to verify the actually missing privileges.
+ */
+ public static PrivilegeEvaluatorResponseMatcher isForbidden(PrivilegeEvaluatorResponseMatcher... subMatchers) {
+ return new PrivilegeEvaluatorResponseMatcher() {
+ @Override
+ public void describeTo(Description description) {
+ description.appendText("Request is fully forbidden; isAllowed() returns false; isPartiallyOk() returns false");
+
+ for (PrivilegeEvaluatorResponseMatcher subMatcher : subMatchers) {
+ description.appendText("; ");
+ subMatcher.describeTo(description);
+ }
+ }
+
+ @Override
+ protected boolean matches(PrivilegesEvaluatorResponse response, Description mismatchDescription) {
+ if (response.isAllowed()) {
+ mismatchDescription.appendText("isAllowed() is true");
+ return false;
+ }
+
+ if (response.isPartiallyOk()) {
+ mismatchDescription.appendText("isPartiallyOk() is true");
+ return false;
+ }
+
+ for (PrivilegeEvaluatorResponseMatcher subMatcher : subMatchers) {
+ if (!subMatcher.matches(response, mismatchDescription)) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+ };
+ }
+
+ /**
+ * Asserts that the status of the PrivilegesEvaluatorResponse is "partially ok". You can specify the available
+ * indices are parameter.
+ */
+ public static PrivilegeEvaluatorResponseMatcher isPartiallyOk(String... availableIndices) {
+ return new PrivilegeEvaluatorResponseMatcher() {
+ @Override
+ public void describeTo(Description description) {
+ description.appendText(
+ "Request is allowed for a subset of indices; isPartiallyOk() returns true; getAvailableIndices() returns "
+ ).appendValue(Arrays.asList(availableIndices));
+ }
+
+ @Override
+ protected boolean matches(PrivilegesEvaluatorResponse response, Description mismatchDescription) {
+ if (!response.isPartiallyOk()) {
+ mismatchDescription.appendText("isPartiallyOk() is false");
+ return false;
+ }
+
+ if (response.isAllowed()) {
+ mismatchDescription.appendText("isAllowed() must be false if isPartiallyOk() is true");
+ return false;
+ }
+
+ if (!response.getAvailableIndices().equals(ImmutableSet.copyOf(availableIndices))) {
+ mismatchDescription.appendText("getAvailableIndices() is ").appendValue(Arrays.asList(response.getAvailableIndices()));
+ return false;
+ }
+
+ return true;
+ }
+ };
+ }
+
+ /**
+ * Asserts that the missingPrivileges property of a PrivilegesEvaluatorResponse instance equals to the given parameters.
+ * Should be used as a sub-matcher for isForbidden().
+ */
+ public static PrivilegeEvaluatorResponseMatcher missingPrivileges(String... missingPrivileges) {
+ return missingPrivileges(ImmutableSet.copyOf(missingPrivileges));
+ }
+
+ /**
+ * Asserts that the missingPrivileges property of a PrivilegesEvaluatorResponse instance equals to the given parameters.
+ * Should be used as a sub-matcher for isForbidden().
+ */
+ public static PrivilegeEvaluatorResponseMatcher missingPrivileges(Set<String> missingPrivileges) {
+ return new PrivilegeEvaluatorResponseMatcher() {
+ @Override
+ public void describeTo(Description description) {
+ description.appendText("Missing privileges are ");
+ description.appendValue(missingPrivileges);
+ }
+
+ @Override
+ protected boolean matches(PrivilegesEvaluatorResponse response, Description mismatchDescription) {
+ if (!response.getMissingPrivileges().equals(missingPrivileges)) {
+ mismatchDescription.appendText("getMissingPrivileges() returns ").appendValue(response.getMissingPrivileges());
+ return false;
+ }
+
+ return true;
+ }
+ };
+ }
+
+ @Override
+ protected boolean matches(Object o, Description mismatchDescription) {
+ if (!(o instanceof PrivilegesEvaluatorResponse)) {
+ mismatchDescription.appendText("The object is not an instance of PrivilegesEvaluatorResponse: ").appendValue(o);
+ }
+
+ PrivilegesEvaluatorResponse response = (PrivilegesEvaluatorResponse) o;
+
+ if (matches(response, mismatchDescription)) {
+ return true;
+ } else {
+ mismatchDescription.appendText("\n");
+ mismatchDescription.appendText(response.toString());
+ return false;
+ }
+ }
+
+ protected abstract boolean matches(PrivilegesEvaluatorResponse response, Description mismatchDescription);
+
+}