Plugin Security - Initial changes for roles injection #546
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| package com.amazon.opendistroforelasticsearch.security.auth; | ||
|
|
||
| import com.amazon.opendistroforelasticsearch.security.auditlog.AuditLog; | ||
| import com.amazon.opendistroforelasticsearch.security.support.ConfigConstants; | ||
| import com.amazon.opendistroforelasticsearch.security.user.User; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.elasticsearch.common.Strings; | ||
| import org.elasticsearch.common.settings.Settings; | ||
|
|
||
| import org.elasticsearch.common.transport.TransportAddress; | ||
| import org.elasticsearch.common.util.concurrent.ThreadContext; | ||
|
|
||
| import java.net.InetAddress; | ||
| import java.net.UnknownHostException; | ||
| import java.util.Arrays; | ||
| import java.util.HashSet; | ||
| import java.util.Set; | ||
|
|
||
| final public class RoleInjector { | ||
| protected final Logger log = LogManager.getLogger(RoleInjector.class); | ||
| private Boolean injectRoleEnabled; | ||
| private final String injectRoleStr; | ||
| private ThreadContext threadContext = null; | ||
| private final AuditLog auditLog; | ||
|
|
||
| public RoleInjector(final Settings settings, final ThreadContext ctx, final AuditLog auditLog) { | ||
| this.threadContext = ctx; | ||
| this.auditLog = auditLog; | ||
| this.injectRoleEnabled = settings.getAsBoolean(ConfigConstants.OPENDISTRO_SECURITY_INJECT_ROLE_ENABLED, | ||
| false); | ||
| this.injectRoleStr = ctx.getTransient(ConfigConstants.OPENDISTRO_SECURITY_INJECT_ROLE); | ||
|
|
||
| if(log.isDebugEnabled()){ | ||
| log.debug("Injected role enabled: "+injectRoleEnabled()); | ||
| log.debug("Injected role: "+injectRoleStr); | ||
| } | ||
| } | ||
|
|
||
| public boolean injectRoleEnabled() { | ||
| return injectRoleEnabled && (injectRoleStr != null && !injectRoleStr.isEmpty()); | ||
| } | ||
|
|
||
| public Set<String> getInjectedRoles() { | ||
| if (!injectRoleEnabled()) | ||
| return null; | ||
|
|
||
| //todo: any additional checks for user? | ||
| // backend roles | ||
| Set<String> newMappedRoles = new HashSet<>(); | ||
| if (!Strings.isNullOrEmpty(injectRoleStr)) { | ||
| if (injectRoleStr.length() > 0) { | ||
| newMappedRoles.addAll(Arrays.asList(injectRoleStr.split(","))); | ||
| } | ||
| } | ||
| return newMappedRoles; | ||
| } | ||
|
|
||
| public User getUser(){ | ||
| User user = new User("pluginadmin"); | ||
| try { | ||
| InetAddress iAdress = InetAddress.getByName("127.0.0.1"); | ||
| int port = 9300; | ||
| threadContext.putTransient(ConfigConstants.OPENDISTRO_SECURITY_REMOTE_ADDRESS, new TransportAddress(iAdress, port)); | ||
| } catch (UnknownHostException e) { | ||
| log.error("Cannot parse remote IP or port:", e); | ||
| } | ||
| //todo: investigate | ||
| //threadContext.putTransient(ConfigConstants.OPENDISTRO_SECURITY_ORIGIN, AuditLog.Origin.TRANSPORT.toString()); | ||
| return user; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package com.amazon.opendistroforelasticsearch.security.rest; | ||
|
|
||
|
|
||
| import com.amazon.opendistroforelasticsearch.security.privileges.PrivilegesEvaluator; | ||
| import com.amazon.opendistroforelasticsearch.security.rolesinfo.RolesInfoAction; | ||
| import com.amazon.opendistroforelasticsearch.security.rolesinfo.RolesInfoRequest; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.elasticsearch.client.node.NodeClient; | ||
| import org.elasticsearch.common.settings.Settings; | ||
| import org.elasticsearch.common.util.concurrent.ThreadContext; | ||
| import org.elasticsearch.common.xcontent.XContentBuilder; | ||
| import org.elasticsearch.common.xcontent.json.JsonXContent; | ||
| import org.elasticsearch.rest.BaseRestHandler; | ||
| import org.elasticsearch.rest.BytesRestResponse; | ||
| import org.elasticsearch.rest.RestController; | ||
| import org.elasticsearch.rest.RestRequest; | ||
| import org.elasticsearch.rest.RestStatus; | ||
| import org.elasticsearch.rest.action.RestToXContentListener; | ||
| import org.elasticsearch.threadpool.ThreadPool; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
|
|
||
| /** | ||
| * Follwing : Similar to PermissionsInfoAction, | ||
| * Not going with roles/user API, this is giving role names not roles details. | ||
| */ | ||
| public class RestRolesInfoAction extends BaseRestHandler { | ||
|
|
||
| private static final List<Route> routes = Collections.singletonList( | ||
| new Route(RestRequest.Method.GET, "/_opendistro/_security/api/rolesinfo") | ||
| ); | ||
|
|
||
| private final Logger log = LogManager.getLogger(this.getClass()); | ||
| private final PrivilegesEvaluator evaluator; | ||
| private final ThreadContext threadContext; | ||
|
|
||
| public RestRolesInfoAction(final Settings settings, final RestController controller, final PrivilegesEvaluator evaluator, final ThreadPool threadPool) { | ||
| super(); | ||
| this.threadContext = threadPool.getThreadContext(); | ||
| this.evaluator = evaluator; | ||
| } | ||
|
|
||
| @Override | ||
| protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException { | ||
| try { | ||
| RolesInfoRequest rolesInfoRequest = new RolesInfoRequest(); | ||
| return channel -> client.admin().cluster().execute(RolesInfoAction.INSTANCE, rolesInfoRequest, | ||
| new RestToXContentListener<>(channel)); | ||
| } catch (final Exception ex){ | ||
| XContentBuilder builder = JsonXContent.contentBuilder(); | ||
| builder.startObject(); | ||
| builder.field("error", ex.toString()); | ||
| builder.endObject(); | ||
| return channel -> channel.sendResponse(new BytesRestResponse(RestStatus.INTERNAL_SERVER_ERROR, builder)); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public List<Route> routes() { | ||
| return routes; | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return "OpenDistro RolesInfo Action"; | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Version change is only for testing on 7.7.0