forked from opensearch-project/security
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into optional-data-exception-fix
- Loading branch information
Showing
25 changed files
with
853 additions
and
176 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| distributionBase=GRADLE_USER_HOME | ||
| distributionPath=wrapper/dists | ||
| distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip | ||
| distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip | ||
| networkTimeout=10000 | ||
| zipStoreBase=GRADLE_USER_HOME | ||
| zipStorePath=wrapper/dists | ||
| distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225 | ||
| distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| distributionBase=GRADLE_USER_HOME | ||
| distributionPath=wrapper/dists | ||
| distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip | ||
| distributionUrl=https\://services.gradle.org/distributions/gradle-8.4-bin.zip | ||
| networkTimeout=10000 | ||
| zipStoreBase=GRADLE_USER_HOME | ||
| zipStorePath=wrapper/dists | ||
| distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225 | ||
| distributionSha256Sum=3e1af3ae886920c3ac87f7a91f816c0c7c436f276a6eefdb3da152100fef72ae |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
142 changes: 142 additions & 0 deletions
142
src/integrationTest/java/org/opensearch/security/http/ServiceAccountAuthenticationTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,142 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.http; | ||
|
|
||
| import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope; | ||
| import org.apache.hc.core5.http.HttpStatus; | ||
| import org.junit.ClassRule; | ||
| import org.junit.Test; | ||
| import org.junit.runner.RunWith; | ||
| import org.opensearch.test.framework.TestIndex; | ||
| import org.opensearch.test.framework.TestSecurityConfig; | ||
| import org.opensearch.test.framework.cluster.ClusterManager; | ||
| import org.opensearch.test.framework.cluster.LocalCluster; | ||
| import org.opensearch.test.framework.cluster.TestRestClient; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import static org.junit.Assert.assertTrue; | ||
| import static org.junit.Assert.assertNotNull; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_SYSTEM_INDICES_ENABLED_KEY; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_SYSTEM_INDICES_PERMISSIONS_ENABLED_KEY; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ROLES_ENABLED; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_SYSTEM_INDICES_KEY; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.Role.ALL_ACCESS; | ||
|
|
||
| @RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class) | ||
| @ThreadLeakScope(ThreadLeakScope.Scope.NONE) | ||
| public class ServiceAccountAuthenticationTest { | ||
|
|
||
| public static final String SERVICE_ATTRIBUTE = "service"; | ||
|
|
||
| static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin").roles(ALL_ACCESS); | ||
|
|
||
| public static final String SERVICE_ACCOUNT_USER_NAME = "test-service-account"; | ||
|
|
||
| static final TestSecurityConfig.User SERVICE_ACCOUNT_ADMIN_USER = new TestSecurityConfig.User(SERVICE_ACCOUNT_USER_NAME).attr( | ||
| SERVICE_ATTRIBUTE, | ||
| "true" | ||
| ) | ||
| .roles( | ||
| new TestSecurityConfig.Role("test-service-account-role").clusterPermissions("*") | ||
| .indexPermissions("*", "system:admin/system_index") | ||
| .on("*") | ||
| ); | ||
|
|
||
| private static final TestIndex TEST_NON_SYS_INDEX = TestIndex.name("test-non-sys-index") | ||
| .setting("index.number_of_shards", 1) | ||
| .setting("index.number_of_replicas", 0) | ||
| .build(); | ||
|
|
||
| private static final TestIndex TEST_SYS_INDEX = TestIndex.name("test-sys-index") | ||
| .setting("index.number_of_shards", 1) | ||
| .setting("index.number_of_replicas", 0) | ||
| .build(); | ||
|
|
||
| @ClassRule | ||
| public static final LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE) | ||
| .anonymousAuth(false) | ||
| .users(ADMIN_USER, SERVICE_ACCOUNT_ADMIN_USER) | ||
| .nodeSettings( | ||
| Map.of( | ||
| SECURITY_SYSTEM_INDICES_PERMISSIONS_ENABLED_KEY, | ||
| true, | ||
| SECURITY_SYSTEM_INDICES_ENABLED_KEY, | ||
| true, | ||
| SECURITY_RESTAPI_ROLES_ENABLED, | ||
| List.of("user_admin__all_access"), | ||
| SECURITY_SYSTEM_INDICES_KEY, | ||
| List.of(TEST_SYS_INDEX.getName()) | ||
| ) | ||
| ) | ||
| .authc(AUTHC_HTTPBASIC_INTERNAL) | ||
| .indices(TEST_NON_SYS_INDEX, TEST_SYS_INDEX) | ||
| .build(); | ||
|
|
||
| @Test | ||
| public void testClusterHealthWithServiceAccountCred() { | ||
| try (TestRestClient client = cluster.getRestClient(SERVICE_ACCOUNT_ADMIN_USER)) { | ||
| client.confirmCorrectCredentials(SERVICE_ACCOUNT_USER_NAME); | ||
| TestRestClient.HttpResponse response = client.get("_cluster/health"); | ||
| response.assertStatusCode(HttpStatus.SC_FORBIDDEN); | ||
|
|
||
| String responseBody = response.getBody(); | ||
|
|
||
| assertNotNull("Response body should not be null", responseBody); | ||
| assertTrue(responseBody.contains("\"type\":\"security_exception\"")); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testReadSysIndexWithServiceAccountCred() { | ||
| try (TestRestClient client = cluster.getRestClient(SERVICE_ACCOUNT_ADMIN_USER)) { | ||
| client.confirmCorrectCredentials(SERVICE_ACCOUNT_USER_NAME); | ||
| TestRestClient.HttpResponse response = client.get(TEST_SYS_INDEX.getName()); | ||
| response.assertStatusCode(HttpStatus.SC_OK); | ||
|
|
||
| String responseBody = response.getBody(); | ||
|
|
||
| assertNotNull("Response body should not be null", responseBody); | ||
| assertTrue(responseBody.contains(TEST_SYS_INDEX.getName())); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testReadNonSysIndexWithServiceAccountCred() { | ||
| try (TestRestClient client = cluster.getRestClient(SERVICE_ACCOUNT_ADMIN_USER)) { | ||
| client.confirmCorrectCredentials(SERVICE_ACCOUNT_USER_NAME); | ||
| TestRestClient.HttpResponse response = client.get(TEST_NON_SYS_INDEX.getName()); | ||
| response.assertStatusCode(HttpStatus.SC_FORBIDDEN); | ||
|
|
||
| String responseBody = response.getBody(); | ||
|
|
||
| assertNotNull("Response body should not be null", responseBody); | ||
| assertTrue(responseBody.contains("\"type\":\"security_exception\"")); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void testReadBothWithServiceAccountCred() { | ||
| TestRestClient client = cluster.getRestClient(SERVICE_ACCOUNT_ADMIN_USER); | ||
| client.confirmCorrectCredentials(SERVICE_ACCOUNT_USER_NAME); | ||
| TestRestClient.HttpResponse response = client.get((TEST_SYS_INDEX.getName() + "," + TEST_NON_SYS_INDEX.getName())); | ||
| response.assertStatusCode(HttpStatus.SC_FORBIDDEN); | ||
|
|
||
| String responseBody = response.getBody(); | ||
|
|
||
| assertNotNull("Response body should not be null", responseBody); | ||
| assertTrue(responseBody.contains("\"type\":\"security_exception\"")); | ||
|
|
||
| } | ||
| } |
Oops, something went wrong.