[DRAFT] [Feature] Introduces resource sharing and access-control

[DarshitChanpura]

companion PR: opensearch-project/OpenSearch#16030

Description

Introduces a new authorization mechanism to control access to resources defined by plugins.

This PR also introduces a sample resource plugin to show the APIs in action.

• Category : New feature
• Why these changes are required?
  • At present, plugins have implemented in-house authorization mechanisms for a lack of centralized framework. This PR introduces a centralized way to offload resource permissions check to security plugin. Plugins will leverage the java APIs introduced in core.

Issues Resolved

• Related to [Proposal] Resource Permissions and Sharing #4500

Testing

• automated and manual testing

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[nibix]

This GuiceHolder pattern from the security plugin is IMHO only a hack to get access to dependencies which are available via dependency injection, but not via the createComponents() API in the Plugin interface. The un-hackish way to give plugins access to ResourceService would be to add it to the param list of createComponents().

[DarshitChanpura]

Resource-sharing index gets created successfully upon first cluster start:

[2024-10-04T14:09:04,570][INFO ][o.o.p.PluginsService     ] [80a9970ace0f] PluginService:onIndexModule index:[.opensearch_resource_sharing/G4yJ1aVmRRaQStn45aWdDg]
[2024-10-04T14:09:04,604][INFO ][o.o.c.m.MetadataCreateIndexService] [80a9970ace0f] [.opensearch_resource_sharing] creating index, cause [api], templates [], shards [1]/[1]
[2024-10-04T14:09:04,607][INFO ][o.o.c.r.a.AllocationService] [80a9970ace0f] updating number_of_replicas to [0] for indices [.opensearch_resource_sharing]
[2024-10-04T14:09:04,608][WARN ][o.o.c.r.a.AllocationService] [80a9970ace0f] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2024-10-04T14:09:04,638][INFO ][o.o.p.PluginsService     ] [80a9970ace0f] PluginService:onIndexModule index:[.opensearch_resource_sharing/G4yJ1aVmRRaQStn45aWdDg]
[2024-10-04T14:09:04,748][INFO ][o.o.c.r.a.AllocationService] [80a9970ace0f] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.opensearch_resource_sharing][0]]]).
[2024-10-04T14:09:04,768][INFO ][o.o.s.r.ResourceSharingIndexHandler] [80a9970ace0f] Resource sharing index .opensearch_resource_sharing created.

and subsequent starts show that the index is present:

[2024-10-04T14:11:08,755][INFO ][o.o.s.r.ResourceSharingIndexHandler] [80a9970ace0f] Index .opensearch_resource_sharing already exists.

Sample Resource Plugin loaded successfully:

[2024-10-04T14:49:06,630][INFO ][o.o.s.s.SampleResourcePlugin] [80a9970ace0f] Loaded SampleResourcePlugin components.