Deprecation check for Auth realm setting structure (#36664)

Adds a deprecation check for changes to the structure of authentication realm settings.
elastic · Jan 2, 2019 · c4b8232 · c4b8232
1 parent 8d40f4b
commit c4b8232
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 0 deletions.
diff --git a/...ugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/DeprecationChecks.java b/...ugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/DeprecationChecks.java
@@ -43,6 +43,7 @@ private DeprecationChecks() {
             NodeDeprecationChecks::indexThreadPoolCheck,
             NodeDeprecationChecks::bulkThreadPoolCheck,
             NodeDeprecationChecks::tribeNodeCheck,
+            NodeDeprecationChecks::authRealmsTypeCheck,
             NodeDeprecationChecks::httpPipeliningCheck,
             NodeDeprecationChecks::discoveryConfigurationCheck,
             NodeDeprecationChecks::azureRepositoryChanges,

diff --git a/.../deprecation/src/main/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecks.java b/.../deprecation/src/main/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecks.java
@@ -98,6 +98,22 @@ static DeprecationIssue tribeNodeCheck(List<NodeInfo> nodeInfos, List<NodeStats>
         return null;
     }
 
+    static DeprecationIssue authRealmsTypeCheck(List<NodeInfo> nodeInfos, List<NodeStats> nodeStats) {
+        List<String> nodesFound = nodeInfos.stream()
+            .filter(nodeInfo -> nodeInfo.getSettings().getGroups("xpack.security.authc.realms").size() > 0)
+            .map(nodeInfo -> nodeInfo.getNode().getName())
+            .collect(Collectors.toList());
+
+        if (nodesFound.size() > 0) {
+            return new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
+                "Security realm settings structure changed",
+                "https://www.elastic.co/guide/en/elasticsearch/reference/master/breaking-changes-7.0.html" +
+                    "#include-realm-type-in-setting",
+                "nodes have authentication realm configuration which must be updated at time of upgrade to 7.0: " + nodesFound);
+        }
+        return null;
+    }
+
     static DeprecationIssue httpPipeliningCheck(List<NodeInfo> nodeInfos, List<NodeStats> nodeStats) {
         List<String> nodesFound = nodeInfos.stream()
             .filter(nodeInfo -> nodeInfo.getSettings().hasValue(HttpTransportSettings.SETTING_PIPELINING.getKey()))

diff --git a/...ecation/src/test/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecksTests.java b/...ecation/src/test/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecksTests.java
@@ -114,6 +114,17 @@ public void testTribeNodeCheck() {
         assertSettingsAndIssue(tribeSetting, randomAlphaOfLength(5), expected);
     }
 
+    public void testAuthenticationRealmTypeCheck() {
+        String realm = randomAlphaOfLengthBetween(1, 20);
+        String authRealmType = "xpack.security.authc.realms." + realm + ".type";
+        DeprecationIssue expected = new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
+            "Security realm settings structure changed",
+            "https://www.elastic.co/guide/en/elasticsearch/reference/master/breaking-changes-7.0.html" +
+                "#include-realm-type-in-setting",
+            "nodes have authentication realm configuration which must be updated at time of upgrade to 7.0: [node_check]");
+        assertSettingsAndIssue(authRealmType, randomAlphaOfLength(5), expected);
+    }
+
     public void testHttpPipeliningCheck() {
         DeprecationIssue expected = new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
             "HTTP pipelining setting removed as pipelining is now mandatory",