forked from opensearch-project/security
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduced legacy impl behind a feature flag
Signed-off-by: Nils Bandener <[email protected]>
- Loading branch information
Showing
23 changed files
with
3,771 additions
and
887 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
155 changes: 155 additions & 0 deletions
155
...tegrationTest/java/org/opensearch/security/privileges/legacy/PrivilegesEvaluatorTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,155 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.privileges.legacy; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope; | ||
| import org.apache.http.HttpStatus; | ||
| import org.junit.ClassRule; | ||
| import org.junit.Test; | ||
| import org.junit.runner.RunWith; | ||
|
|
||
| import org.opensearch.script.mustache.MustachePlugin; | ||
| import org.opensearch.script.mustache.RenderSearchTemplateAction; | ||
| import org.opensearch.security.privileges.PrivilegesEvaluator; | ||
| import org.opensearch.test.framework.TestSecurityConfig; | ||
| import org.opensearch.test.framework.TestSecurityConfig.Role; | ||
| import org.opensearch.test.framework.cluster.ClusterManager; | ||
| import org.opensearch.test.framework.cluster.LocalCluster; | ||
| import org.opensearch.test.framework.cluster.TestRestClient; | ||
|
|
||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
| import static org.hamcrest.Matchers.equalTo; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL; | ||
|
|
||
| @RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class) | ||
| @ThreadLeakScope(ThreadLeakScope.Scope.NONE) | ||
| public class PrivilegesEvaluatorTest { | ||
|
|
||
| protected final static TestSecurityConfig.User NEGATIVE_LOOKAHEAD = new TestSecurityConfig.User("negative_lookahead_user").roles( | ||
| new Role("negative_lookahead_role").indexPermissions("read").on("/^(?!t.*).*/").clusterPermissions("cluster_composite_ops") | ||
| ); | ||
|
|
||
| protected final static TestSecurityConfig.User NEGATED_REGEX = new TestSecurityConfig.User("negated_regex_user").roles( | ||
| new Role("negated_regex_role").indexPermissions("read").on("/^[a-z].*/").clusterPermissions("cluster_composite_ops") | ||
| ); | ||
|
|
||
| protected final static TestSecurityConfig.User SEARCH_TEMPLATE = new TestSecurityConfig.User("search_template_user").roles( | ||
| new Role("search_template_role").indexPermissions("read").on("services").clusterPermissions("cluster_composite_ops") | ||
| ); | ||
|
|
||
| protected final static TestSecurityConfig.User RENDER_SEARCH_TEMPLATE = new TestSecurityConfig.User("render_search_template_user") | ||
| .roles( | ||
| new Role("render_search_template_role").indexPermissions("read") | ||
| .on("services") | ||
| .clusterPermissions(RenderSearchTemplateAction.NAME) | ||
| ); | ||
|
|
||
| private String TEST_QUERY = | ||
| "{\"source\":{\"query\":{\"match\":{\"service\":\"{{service_name}}\"}}},\"params\":{\"service_name\":\"Oracle\"}}"; | ||
|
|
||
| private String TEST_DOC = "{\"source\": {\"title\": \"Spirited Away\"}}"; | ||
|
|
||
| private String TEST_RENDER_SEARCH_TEMPLATE_QUERY = | ||
| "{\"params\":{\"status\":[\"pending\",\"published\"]},\"source\":\"{\\\"query\\\": {\\\"terms\\\": {\\\"status\\\": [\\\"{{#status}}\\\",\\\"{{.}}\\\",\\\"{{/status}}\\\"]}}}\"}"; | ||
|
|
||
| @ClassRule | ||
| public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS) | ||
| .authc(AUTHC_HTTPBASIC_INTERNAL) | ||
| .users(NEGATIVE_LOOKAHEAD, NEGATED_REGEX, SEARCH_TEMPLATE, RENDER_SEARCH_TEMPLATE, TestSecurityConfig.User.USER_ADMIN) | ||
| .plugin(MustachePlugin.class) | ||
| .nodeSettings(Map.of(PrivilegesEvaluator.USE_LEGACY_PRIVILEGE_EVALUATOR.getKey(), true)) | ||
| .build(); | ||
|
|
||
| @Test | ||
| public void testNegativeLookaheadPattern() throws Exception { | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(NEGATIVE_LOOKAHEAD)) { | ||
| assertThat(client.get("*/_search").getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN)); | ||
| assertThat(client.get("r*/_search").getStatusCode(), equalTo(HttpStatus.SC_OK)); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testRegexPattern() throws Exception { | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(NEGATED_REGEX)) { | ||
| assertThat(client.get("*/_search").getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN)); | ||
| assertThat(client.get("r*/_search").getStatusCode(), equalTo(HttpStatus.SC_OK)); | ||
| } | ||
|
|
||
| } | ||
|
|
||
| @Test | ||
| public void testSearchTemplateRequestSuccess() { | ||
| // Insert doc into services index with admin user | ||
| try (TestRestClient client = cluster.getRestClient(TestSecurityConfig.User.USER_ADMIN)) { | ||
| TestRestClient.HttpResponse response = client.postJson("services/_doc", TEST_DOC); | ||
| assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_CREATED)); | ||
| } | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(SEARCH_TEMPLATE)) { | ||
| final String searchTemplateOnServicesIndex = "services/_search/template"; | ||
| final TestRestClient.HttpResponse searchTemplateOnAuthorizedIndexResponse = client.getWithJsonBody( | ||
| searchTemplateOnServicesIndex, | ||
| TEST_QUERY | ||
| ); | ||
| assertThat(searchTemplateOnAuthorizedIndexResponse.getStatusCode(), equalTo(HttpStatus.SC_OK)); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testSearchTemplateRequestUnauthorizedIndex() { | ||
| try (TestRestClient client = cluster.getRestClient(SEARCH_TEMPLATE)) { | ||
| final String searchTemplateOnMoviesIndex = "movies/_search/template"; | ||
| final TestRestClient.HttpResponse searchTemplateOnUnauthorizedIndexResponse = client.getWithJsonBody( | ||
| searchTemplateOnMoviesIndex, | ||
| TEST_QUERY | ||
| ); | ||
| assertThat(searchTemplateOnUnauthorizedIndexResponse.getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN)); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testSearchTemplateRequestUnauthorizedAllIndices() { | ||
| try (TestRestClient client = cluster.getRestClient(SEARCH_TEMPLATE)) { | ||
| final String searchTemplateOnAllIndices = "_search/template"; | ||
| final TestRestClient.HttpResponse searchOnAllIndicesResponse = client.getWithJsonBody(searchTemplateOnAllIndices, TEST_QUERY); | ||
| assertThat(searchOnAllIndicesResponse.getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN)); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testRenderSearchTemplateRequestFailure() { | ||
| try (TestRestClient client = cluster.getRestClient(SEARCH_TEMPLATE)) { | ||
| final String renderSearchTemplate = "_render/template"; | ||
| final TestRestClient.HttpResponse renderSearchTemplateResponse = client.postJson( | ||
| renderSearchTemplate, | ||
| TEST_RENDER_SEARCH_TEMPLATE_QUERY | ||
| ); | ||
| assertThat(renderSearchTemplateResponse.getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN)); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testRenderSearchTemplateRequestSuccess() { | ||
| try (TestRestClient client = cluster.getRestClient(RENDER_SEARCH_TEMPLATE)) { | ||
| final String renderSearchTemplate = "_render/template"; | ||
| final TestRestClient.HttpResponse renderSearchTemplateResponse = client.postJson( | ||
| renderSearchTemplate, | ||
| TEST_RENDER_SEARCH_TEMPLATE_QUERY | ||
| ); | ||
| assertThat(renderSearchTemplateResponse.getStatusCode(), equalTo(HttpStatus.SC_OK)); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.