Test unknown named application privileges

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ApplicationPermission.java

@@ -173,6 +173,14 @@ public Set<String> getResourcePatterns(ApplicationPrivilege privilege) {
             .collect(Collectors.toSet());
     }
 
+    public Set<String> getResourcePatternsByName(ApplicationPrivilege privilege) {
+        return permissions.stream()
+            .filter(e -> e.privilege.getApplication().equals(privilege.getApplication()) && e.privilege.name().equals(privilege.name()))
+            .map(e -> e.resourceNames)
+            .flatMap(Set::stream)
+            .collect(Collectors.toSet());
+    }
+
     private static class PermissionEntry {
         private final ApplicationPrivilege privilege;
         private final Predicate<String> application;
@@ -191,18 +199,18 @@ private boolean grants(ApplicationPrivilege other, Automaton resource) {
         }
 
         private boolean matchesPrivilege(ApplicationPrivilege other) {
-            if (this.privilege.equals(other)) {
-                return true;
-            }
-            if (this.application.test(other.getApplication()) == false) {
+            assert other.name().size() <= 1 : "can only compare to singletons but got [" + other + "]";
+            if (application.test(other.getApplication()) == false) {
                 return false;
             }
             if (Operations.isTotal(privilege.getAutomaton())) {
                 return true;
             }
-            return Operations.isEmpty(privilege.getAutomaton()) == false
-                && Operations.isEmpty(other.getAutomaton()) == false
-                && Operations.subsetOf(other.getAutomaton(), privilege.getAutomaton());
+            // If the privilege we are checking is not stored (i.e., maps to no action patterns) check by name instead
+            if (Operations.isEmpty(other.getAutomaton())) {
+                return privilege.name().containsAll(other.name());
+            }
+            return Operations.subsetOf(other.getAutomaton(), privilege.getAutomaton());
         }
 
         @Override

x-pack/plugin/security/qa/security-basic/src/javaRestTest/java/org/elasticsearch/xpack/security/HasApplicationPrivilegesIT.java

@@ -151,6 +151,32 @@ public void testUserWithWildcardPrivileges() throws Exception {
         }
     }
 
+    public void testNamed() throws IOException {
+        createApplicationPrivilege("app", "write", new String[] { "action:write/*" });
+        createRole("correct", "app", new String[] { "read" }, new String[] { "*" });
+        createRole("wrong", "app", new String[] { "read", randomFrom("create", "write") }, new String[] { "*" });
+
+        var password = new SecureString("password-123");
+        createUser("correct", password, Set.of("correct"));
+        createUser("wrong", password, Set.of("wrong"));
+
+        {
+            var reqOptions = RequestOptions.DEFAULT.toBuilder()
+                .addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue("correct", password))
+                .build();
+            var actual = hasPrivilege(reqOptions, "app", new String[] { "read" }, new String[] { "resource" });
+            assertSinglePrivilege(actual, "resource", "read", true);
+        }
+
+        {
+            var reqOptions = RequestOptions.DEFAULT.toBuilder()
+                .addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue("wrong", password))
+                .build();
+            var actual = hasPrivilege(reqOptions, "app", new String[] { "read" }, new String[] { "resource" });
+            assertSinglePrivilege(actual, "resource", "read", true);
+        }
+    }
+
     private void assertSinglePrivilege(
         List<ResourcePrivileges> hasPrivilegesResult,
         String expectedResource,

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/RBACEngine.java

@@ -734,7 +734,7 @@ static GetUserPrivilegesResponse buildUserPrivilegesResponseObject(Role userRole
         final Set<RoleDescriptor.ApplicationResourcePrivileges> application = new LinkedHashSet<>();
         for (String applicationName : userRole.application().getApplicationNames()) {
             for (ApplicationPrivilege privilege : userRole.application().getPrivileges(applicationName)) {
-                final Set<String> resources = userRole.application().getResourcePatterns(privilege);
+                final Set<String> resources = userRole.application().getResourcePatternsByName(privilege);
                 if (resources.isEmpty()) {
                     logger.trace("No resources defined in application privilege {}", privilege);
                 } else {