Authorize Requests bound for extensions in the REST-Layer #2601
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
There was a problem hiding this comment. Do you think it makes more sense to have this as a separate file or as part of the existing privileges evaluator logic? It may be possible to add this as a subroutine of the existing code if you were so inclined. There was a problem hiding this comment. I think it makes sense as a separate file since it takes different parameters to instantiate this evaluator. This is a fresh slate to work with and much smaller in size that the transport layer PrivilegesEvaluator. This PR doesn't cover how index permissions from plugins will be converted to extensions. i.e. will not be able to be ported with this PR alone. There will need to be work done to authorize requests that take in resource names like index patterns. This PR will work for all plugin cluster_permissions. There was a problem hiding this comment. Sounds good to me! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.privileges; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.greenrobot.eventbus.Subscribe; | ||
| import org.opensearch.OpenSearchSecurityException; | ||
| import org.opensearch.cluster.service.ClusterService; | ||
| import org.opensearch.common.settings.Settings; | ||
| import org.opensearch.common.transport.TransportAddress; | ||
| import org.opensearch.common.util.concurrent.ThreadContext; | ||
| import org.opensearch.core.xcontent.NamedXContentRegistry; | ||
| import org.opensearch.security.auditlog.AuditLog; | ||
| import org.opensearch.security.configuration.ClusterInfoHolder; | ||
| import org.opensearch.security.configuration.ConfigurationRepository; | ||
| import org.opensearch.security.securityconf.ConfigModel; | ||
| import org.opensearch.security.securityconf.DynamicConfigModel; | ||
| import org.opensearch.security.securityconf.SecurityRoles; | ||
| import org.opensearch.security.support.ConfigConstants; | ||
| import org.opensearch.security.user.User; | ||
| import org.opensearch.threadpool.ThreadPool; | ||
|
|
||
| import java.util.Set; | ||
|
|
||
| public class RestLayerPrivilegesEvaluator { | ||
| protected final Logger log = LogManager.getLogger(this.getClass()); | ||
| private final ClusterService clusterService; | ||
|
|
||
| private final AuditLog auditLog; | ||
| private ThreadContext threadContext; | ||
|
|
||
| private final ClusterInfoHolder clusterInfoHolder; | ||
| private ConfigModel configModel; | ||
| private DynamicConfigModel dcm; | ||
| private final NamedXContentRegistry namedXContentRegistry; | ||
|
|
||
| public RestLayerPrivilegesEvaluator(final ClusterService clusterService, final ThreadPool threadPool, | ||
| final ConfigurationRepository configurationRepository, | ||
| AuditLog auditLog, final Settings settings, final ClusterInfoHolder clusterInfoHolder, | ||
| NamedXContentRegistry namedXContentRegistry) { | ||
|
|
||
| super(); | ||
| this.clusterService = clusterService; | ||
| this.auditLog = auditLog; | ||
|
|
||
| this.threadContext = threadPool.getThreadContext(); | ||
|
|
||
| this.clusterInfoHolder = clusterInfoHolder; | ||
| this.namedXContentRegistry = namedXContentRegistry; | ||
| } | ||
|
|
||
| @Subscribe | ||
| public void onConfigModelChanged(ConfigModel configModel) { | ||
| this.configModel = configModel; | ||
| } | ||
|
|
||
| @Subscribe | ||
| public void onDynamicConfigModelChanged(DynamicConfigModel dcm) { | ||
| this.dcm = dcm; | ||
| } | ||
|
|
||
| private SecurityRoles getSecurityRoles(Set<String> roles) { | ||
| return configModel.getSecurityRoles().filter(roles); | ||
| } | ||
|
|
||
| public boolean isInitialized() { | ||
| return configModel !=null && configModel.getSecurityRoles() != null && dcm != null; | ||
| } | ||
|
|
||
| public PrivilegesEvaluatorResponse evaluate(final User user, String action0) { | ||
|
There was a problem hiding this comment. This may be hit further up in the call chain. For instance the plugin itself probably cannot get the request to this point if security is not initialized. There was a problem hiding this comment. That's exactly how this would work. This evaluator is used in the REST handler wrapper which means this is executed before the original handler is called. If the request is not authorized, the original handler will never be called. |
||
|
|
||
| if (!isInitialized()) { | ||
| throw new OpenSearchSecurityException("OpenSearch Security is not initialized."); | ||
| } | ||
|
|
||
| final PrivilegesEvaluatorResponse presponse = new PrivilegesEvaluatorResponse(); | ||
|
|
||
| final TransportAddress caller = threadContext.getTransient(ConfigConstants.OPENDISTRO_SECURITY_REMOTE_ADDRESS); | ||
|
|
||
| Set<String> mappedRoles = mapRoles(user, caller); | ||
|
|
||
| presponse.resolvedSecurityRoles.addAll(mappedRoles); | ||
| final SecurityRoles securityRoles = getSecurityRoles(mappedRoles); | ||
|
|
||
| final boolean isDebugEnabled = log.isDebugEnabled(); | ||
| if (isDebugEnabled) { | ||
| log.debug("Evaluate permissions for {} on {}", user, clusterService.localNode().getName()); | ||
| log.debug("Action: {}", action0); | ||
| log.debug("Mapped roles: {}", mappedRoles.toString()); | ||
| } | ||
| if(!securityRoles.impliesExtensionPermissionPermission(action0)) { | ||
| presponse.missingPrivileges.add(action0); | ||
| presponse.allowed = false; | ||
| log.info("No extension-level perm match for {} [Action [{}]] [RolesChecked {}]. No permissions for {}", user, action0, | ||
| securityRoles.getRoleNames(), presponse.missingPrivileges); | ||
| return presponse; | ||
| } else { | ||
| if (isDebugEnabled) { | ||
| log.debug("Allowed because we have extension permissions for {}", action0); | ||
| } | ||
| presponse.allowed = true; | ||
| return presponse; | ||
| } | ||
| } | ||
|
|
||
| public Set<String> mapRoles(final User user, final TransportAddress caller) { | ||
| return this.configModel.mapSecurityRoles(user, caller); | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it possible to parse this from the Hello World config? I know you have made changes in the SDK, I am not sure what would be required to read in these roles as part of the registration/installation process.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that is ultimately where these should go! I wanted to open up a PR to show REST-layer authz in action with an example role. This issue is about letting an extension pre-define roles and sourcing them into the security configuration.