-
Notifications
You must be signed in to change notification settings - Fork 299
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
securityadmin: Replace TransportClient by RestHighLevelClient (#1638)
Signed-off-by: rs-eliatra <[email protected]>
- Loading branch information
1 parent
0b63577
commit 81a43c2
Showing
14 changed files
with
1,026 additions
and
418 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
src/main/java/org/opensearch/security/rest/SecurityConfigUpdateAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.security.rest; | ||
|
|
||
| import com.google.common.collect.ImmutableList; | ||
| import org.opensearch.client.node.NodeClient; | ||
| import org.opensearch.common.settings.Settings; | ||
| import org.opensearch.common.util.concurrent.ThreadContext; | ||
| import org.opensearch.rest.*; | ||
| import org.opensearch.rest.action.RestActions.NodesResponseRestListener; | ||
| import org.opensearch.security.action.configupdate.ConfigUpdateAction; | ||
| import org.opensearch.security.action.configupdate.ConfigUpdateRequest; | ||
| import org.opensearch.security.configuration.AdminDNs; | ||
| import org.opensearch.security.ssl.transport.PrincipalExtractor; | ||
| import org.opensearch.security.ssl.util.SSLRequestHelper; | ||
| import org.opensearch.security.support.ConfigConstants; | ||
| import org.opensearch.security.user.User; | ||
| import org.opensearch.threadpool.ThreadPool; | ||
|
|
||
| import java.io.IOException; | ||
| import java.nio.file.Path; | ||
| import java.util.List; | ||
|
|
||
| import static org.opensearch.rest.RestRequest.Method.PUT; | ||
| import static org.opensearch.security.dlic.rest.support.Utils.addRoutesPrefix; | ||
|
|
||
| public class SecurityConfigUpdateAction extends BaseRestHandler { | ||
|
|
||
| private static final List<Route> routes = addRoutesPrefix(ImmutableList.of( | ||
| new Route(PUT, "/configupdate")), | ||
| "/_plugins/_security"); | ||
|
|
||
| private final ThreadContext threadContext; | ||
| private final AdminDNs adminDns; | ||
| private final Settings settings; | ||
| private final Path configPath; | ||
| private final PrincipalExtractor principalExtractor; | ||
|
|
||
| public SecurityConfigUpdateAction(final Settings settings, final RestController controller, final ThreadPool threadPool, final AdminDNs adminDns, | ||
| Path configPath, PrincipalExtractor principalExtractor) { | ||
| super(); | ||
| this.threadContext = threadPool.getThreadContext(); | ||
| this.adminDns = adminDns; | ||
| this.settings = settings; | ||
| this.configPath = configPath; | ||
| this.principalExtractor = principalExtractor; | ||
| } | ||
|
|
||
| @Override public List<Route> routes() { | ||
| return routes; | ||
| } | ||
|
|
||
| @Override protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException { | ||
| String[] configTypes = request.paramAsStringArrayOrEmptyIfAll("config_types"); | ||
|
|
||
| SSLRequestHelper.SSLInfo sslInfo = SSLRequestHelper.getSSLInfo(settings, configPath, request, principalExtractor); | ||
|
|
||
| if (sslInfo == null) { | ||
| return channel -> channel.sendResponse(new BytesRestResponse(RestStatus.FORBIDDEN, "")); | ||
| } | ||
|
|
||
| final User user = threadContext.getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER); | ||
|
|
||
| //only allowed for admins | ||
| if (user == null || !adminDns.isAdmin(user)) { | ||
| return channel -> channel.sendResponse(new BytesRestResponse(RestStatus.FORBIDDEN, "")); | ||
| } else { | ||
| ConfigUpdateRequest configUpdateRequest = new ConfigUpdateRequest(configTypes); | ||
| return channel -> { | ||
| client.execute(ConfigUpdateAction.INSTANCE, configUpdateRequest, new NodesResponseRestListener<>(channel)); | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| @Override public String getName() { | ||
| return "Security config update"; | ||
| } | ||
|
|
||
| } |
121 changes: 121 additions & 0 deletions
121
src/main/java/org/opensearch/security/rest/SecurityWhoAmIAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.security.rest; | ||
|
|
||
| import com.google.common.collect.ImmutableList; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.opensearch.client.node.NodeClient; | ||
| import org.opensearch.common.settings.Settings; | ||
| import org.opensearch.common.xcontent.XContentBuilder; | ||
| import org.opensearch.rest.BaseRestHandler; | ||
| import org.opensearch.rest.BytesRestResponse; | ||
| import org.opensearch.rest.RestChannel; | ||
| import org.opensearch.rest.RestController; | ||
| import org.opensearch.rest.RestRequest; | ||
| import org.opensearch.rest.RestStatus; | ||
| import org.opensearch.security.configuration.AdminDNs; | ||
| import org.opensearch.security.ssl.transport.PrincipalExtractor; | ||
| import org.opensearch.security.ssl.util.SSLRequestHelper; | ||
| import org.opensearch.security.ssl.util.SSLRequestHelper.SSLInfo; | ||
| import org.opensearch.security.support.ConfigConstants; | ||
| import org.opensearch.security.support.WildcardMatcher; | ||
| import org.opensearch.threadpool.ThreadPool; | ||
|
|
||
| import java.io.IOException; | ||
| import java.nio.file.Path; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
| import static org.opensearch.rest.RestRequest.Method.GET; | ||
| import static org.opensearch.rest.RestRequest.Method.POST; | ||
| import static org.opensearch.security.dlic.rest.support.Utils.addRoutesPrefix; | ||
|
|
||
|
|
||
| public class SecurityWhoAmIAction extends BaseRestHandler { | ||
|
|
||
| private static final List<Route> routes = addRoutesPrefix(ImmutableList.of( | ||
| new Route(GET, "/whoami"), | ||
| new Route(POST, "/whoami")), | ||
| "/_plugins/_security"); | ||
|
|
||
| private final Logger log = LogManager.getLogger(this.getClass()); | ||
| private final AdminDNs adminDns; | ||
| private final Settings settings; | ||
| private final Path configPath; | ||
| private final PrincipalExtractor principalExtractor; | ||
| private final List<String> nodesDn ; | ||
|
|
||
| public SecurityWhoAmIAction(final Settings settings, final RestController controller, | ||
| final ThreadPool threadPool, final AdminDNs adminDns, Path configPath, PrincipalExtractor principalExtractor) { | ||
| super(); | ||
| this.adminDns = adminDns; | ||
| this.settings = settings; | ||
| this.configPath = configPath; | ||
| this.principalExtractor = principalExtractor; | ||
|
|
||
| nodesDn = settings.getAsList(ConfigConstants.SECURITY_NODES_DN, Collections.emptyList()); | ||
| } | ||
|
|
||
| @Override | ||
| public List<Route> routes() { | ||
| return routes; | ||
| } | ||
|
|
||
| @Override | ||
| protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException { | ||
| return new RestChannelConsumer() { | ||
|
|
||
| @Override | ||
| public void accept(RestChannel channel) throws Exception { | ||
| XContentBuilder builder = channel.newBuilder(); | ||
| BytesRestResponse response = null; | ||
|
|
||
| try { | ||
|
|
||
| SSLInfo sslInfo = SSLRequestHelper.getSSLInfo(settings, configPath, request, principalExtractor); | ||
|
|
||
| if(sslInfo == null) { | ||
| response = new BytesRestResponse(RestStatus.FORBIDDEN, "No security data"); | ||
| } else { | ||
|
|
||
| final String dn = sslInfo.getPrincipal(); | ||
| final boolean isAdmin = adminDns.isAdminDN(dn); | ||
| final boolean isNodeCertificateRequest = dn != null && WildcardMatcher.from(nodesDn, true).matchAny(dn); | ||
|
|
||
| builder.startObject(); | ||
| builder.field("dn", dn); | ||
| builder.field("is_admin", isAdmin); | ||
| builder.field("is_node_certificate_request", isNodeCertificateRequest); | ||
| builder.endObject(); | ||
|
|
||
| response = new BytesRestResponse(RestStatus.OK, builder); | ||
|
|
||
| } | ||
| } catch (final Exception e1) { | ||
| log.error(e1.toString(), e1); | ||
| builder = channel.newBuilder(); | ||
| builder.startObject(); | ||
| builder.field("error", e1.toString()); | ||
| builder.endObject(); | ||
| response = new BytesRestResponse(RestStatus.INTERNAL_SERVER_ERROR, builder); | ||
| } finally { | ||
| if (builder != null) { | ||
| builder.close(); | ||
| } | ||
| } | ||
|
|
||
| channel.sendResponse(response); | ||
| } | ||
| }; | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return "Security Plugin Who am i"; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.