Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test unknown named application privileges #104863

Draft
wants to merge 8 commits into
base: main
Choose a base branch
from
Draft

Test unknown named application privileges #104863

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
e5cdee7
Test unknown named application privileges
n1v0lg Jan 29, 2024
8bd6be0
Merge branch 'main' into unknown-named-application-privileges
n1v0lg Feb 1, 2024
03f6e09
WIP fix
n1v0lg Feb 1, 2024
f3f8076
Smaller diff
n1v0lg Feb 1, 2024
b4be2e2
im holding this wrong
n1v0lg Feb 1, 2024
56c5f4b
Comment
n1v0lg Feb 1, 2024
2d1e75e
Merge branch 'main' into unknown-named-application-privileges
n1v0lg Feb 2, 2024
0d8035d
Hack around get user privs
n1v0lg Feb 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions ...ic/src/javaRestTest/java/org/elasticsearch/xpack/security/HasApplicationPrivilegesIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,32 @@ public void testUserWithWildcardPrivileges() throws Exception {
}
}

public void testNamed() throws IOException {
createApplicationPrivilege("app", "write", new String[] { "action:write/*" });
createRole("correct", "app", new String[] { "read" }, new String[] { "*" });
createRole("wrong", "app", new String[] { "read", randomFrom("create", "write") }, new String[] { "*" });
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only difference between the roles: "single" unknown privilege or unknown privilege + plus another (known or unknown, doesn't matter).


var password = new SecureString("password-123");
createUser("correct", password, Set.of("correct"));
createUser("wrong", password, Set.of("wrong"));

{
var reqOptions = RequestOptions.DEFAULT.toBuilder()
.addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue("correct", password))
.build();
var actual = hasPrivilege(reqOptions, "app", new String[] { "read" }, new String[] { "resource" });
assertSinglePrivilege(actual, "resource", "read", true);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This works and is expected behavior based on: #33928 (comment)

}

{
var reqOptions = RequestOptions.DEFAULT.toBuilder()
.addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue("wrong", password))
.build();
var actual = hasPrivilege(reqOptions, "app", new String[] { "read" }, new String[] { "resource" });
assertSinglePrivilege(actual, "resource", "read", true);
Copy link
Contributor Author

@n1v0lg n1v0lg Jan 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This fails but shouldn't.

Copy link
Contributor Author

@n1v0lg n1v0lg Jan 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the problem:

elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ApplicationPermission.java

Line 194 in 79f801b

if (this.privilege.equals(other)) {

We are checking for equality, but when there's more than one privilege on the Role, we fail this check since name is Set.of("create", "read") for the privilege on the role, and it does not equal Set.of("read") -- the privilege from the request (i.e., other)

}
}

private void assertSinglePrivilege(
List<ResourcePrivileges> hasPrivilegesResult,
String expectedResource,
Expand Down