Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Optimized privilege evaluation security subject #35

Closed
wants to merge 71 commits into from
Closed

Optimized privilege evaluation security subject #35

wants to merge 71 commits into from

Conversation

cwperks
Copy link
Owner

@cwperks cwperks commented Nov 11, 2024

Description

Rebase of opensearch-project#4665

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

cwperks added 30 commits August 19, 2024 17:12
@cwperks
Implement new extension points in IdentityPlugin and add ContextProvi…
e65b248 
…dingPluginSubject

Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove code from UserService
55a7e45 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove commented out code
44c0d76 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Use guice dependencies
3e17b57 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Move TransportActionDependencies
0add3d8 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Use NamedPrincipal
b76a5b8 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add end to end test to show stronger index protection for plugins
2da6f2a 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add end to end test to show stronger index protection for plugins
9cf80ae 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Move to constructor
21fc225 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove unused constant
f08f311 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add test that demonstrates cluster action forbidden when running with…
2de9a5f 
… plugin user

Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add bulk index test
22795df 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Ensure bulk request with mix of actions blocks as expected
e075ae8 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Use subclass instead of attribute
e12f673 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Rename TransportActionDependencies to PluginContextSwitcher
f9adcc4 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Prevent pluginUser from being serialized to nodes before 2.17.0 for b…
2074dab 
…ackwards compatibility

Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Demonstrate how a role can be created in-memory to re-use authz
0960ce0 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add missing license headers
8c2b7ba 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove unused code
675f20a 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove unused field
8d3eb1c 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Implement getCurrentSubject
115fa0e 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Use transport for cluster health tests
f6650eb 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Show use of default
77b728d 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Show an example of switching subjects within a transport action
a649257 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Show example of attaching subject to ActionRequest
7170c82 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Revert "Show example of attaching subject to ActionRequest"
9c205a6 
This reverts commit 7170c82.

Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove copy of SystemIndexRegistry and use exposed methods from core
690144e 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Merge branch 'main' into security-subject
b18d3aa
@cwperks
Fix failing tests
e781e37 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Fix SystemIndexPermissionEnabledTests tests
3c60808 
Signed-off-by: Craig Perkins <[email protected]>
cwperks and others added 27 commits September 20, 2024 15:16
@cwperks
Change calls to isPluginUser and create InMemorySecurityRoles
e5855ab 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Add missing license header
b8c333c 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Use plugin: prefix
9b0c3df 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Remove PluginUser
abea484 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Merge branch 'main' into security-subject
86c3336
@cwperks
Remove Identity FeatureFlag
ed13ecb 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Fix tests
68ff270 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Merge branch 'main' into security-subject
70bb6ef
@cwperks
Merge branch 'main' into security-subject
dbb723a
@cwperks
Merge branch 'main' into security-subject
275a346
@cwperks
Address code review feedback
0216cc0 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Create common method for getting SecurityRoles and move plugin specif…
05890d5 
…ic logic into method

Signed-off-by: Craig Perkins <[email protected]>
@akolarkunnu
Improve error message when a node with an incorrectly configured cert…
e0fb8fc 
…ificate attempts to connect (opensearch-project#4818)

Signed-off-by: Abdul Muneer Kolarkunnu <[email protected]>
@dependabot
Bump com.google.errorprone:error_prone_annotations from 2.33.0 to 2.3…
f81faed 
…4.0 (opensearch-project#4822)

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.passay:passay from 1.6.5 to 1.6.6 (opensearch-project#4821)
c11a891 
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump ch.qos.logback:logback-classic from 1.5.10 to 1.5.11 (opensearch…
1b207a8 
…-project#4823)

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cwperks
Fix issue in HashingStoredFieldVisitor with stored fields (opensearch…
8d7259d 
…-project#4826)

Signed-off-by: Craig Perkins <[email protected]>
@willyborankin
Bump gradle to 8.10.2 (opensearch-project#4828)
3edfac8 
Signed-off-by: Andrey Pleskach <[email protected]>
@cwperks
Ensure that dual mode enabled flag from cluster settings can get prop…
811f26d 
…agated to core (opensearch-project#4820)

Signed-off-by: Craig Perkins <[email protected]>
@willyborankin
Refactor SSL Configuration (opensearch-project#4671)
db6e7dc
@derek-ho
Add release notes for 2.18 (opensearch-project#4834)
8b71209 
Signed-off-by: Derek Ho <[email protected]>
@cwperks
Generalize public key reading in the JWT authenticator (opensearch-pr…
eb7f821 
…oject#4833)

Signed-off-by: Craig Perkins <[email protected]>
@parislarkins
Allow skipping hot reload dn validation (opensearch-project#4752)
c8cacf1 
Signed-off-by: Paris Larkins <[email protected]>
Signed-off-by: Paris Larkins <[email protected]>
@cwperks
Merge branch 'main' into security-subject
877fd42
@cwperks
Merge branch 'security-subject' into optimized-privilege-evaluation-s…
c9699c5 
…ecurity-subject
@cwperks
WIP on adapting to optimized privilege evaluation
19d4362 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Get cluster actions working
0a8924d 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks cwperks closed this Nov 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@reta reta Awaiting requested review from reta reta is a code owner

@willyborankin willyborankin Awaiting requested review from willyborankin willyborankin is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@cwperks @akolarkunnu @willyborankin @derek-ho @parislarkins