-
Notifications
You must be signed in to change notification settings - Fork 24.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Kerberos] Add bootstrap checks for kerberos realm #31548
Changes from 2 commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License; | ||
* you may not use this file except in compliance with the Elastic License. | ||
*/ | ||
|
||
package org.elasticsearch.xpack.security.authc.kerberos; | ||
|
||
import org.elasticsearch.bootstrap.BootstrapCheck; | ||
import org.elasticsearch.bootstrap.BootstrapContext; | ||
import org.elasticsearch.common.Strings; | ||
import org.elasticsearch.common.settings.Settings; | ||
import org.elasticsearch.env.Environment; | ||
import org.elasticsearch.xpack.core.security.authc.RealmSettings; | ||
import org.elasticsearch.xpack.core.security.authc.kerberos.KerberosRealmSettings; | ||
|
||
import java.nio.file.Files; | ||
import java.nio.file.Path; | ||
|
||
/** | ||
* This class is used to perform bootstrap checks for kerberos realm. | ||
*/ | ||
public class KerberosRealmBootstrapCheck implements BootstrapCheck { | ||
private final Environment env; | ||
|
||
public KerberosRealmBootstrapCheck(final Environment env) { | ||
this.env = env; | ||
} | ||
|
||
@Override | ||
public BootstrapCheckResult check(final BootstrapContext context) { | ||
final Settings realmsSettings = RealmSettings.get(context.settings); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I would recommend using There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks, Tim. Addressed this. |
||
boolean isKerberosRealmConfigured = false; | ||
for (final String name : realmsSettings.names()) { | ||
final Settings realmSettings = realmsSettings.getAsSettings(name); | ||
final String type = realmSettings.get("type"); | ||
if (Strings.hasText(type) == false) { | ||
return BootstrapCheckResult.failure("missing realm type for [" + name + "] realm"); | ||
} | ||
if (KerberosRealmSettings.TYPE.equals(type)) { | ||
if (isKerberosRealmConfigured) { | ||
return BootstrapCheckResult.failure( | ||
"multiple [" + type + "] realms are configured. [" + type + "] can only have one such realm configured"); | ||
} | ||
isKerberosRealmConfigured = true; | ||
|
||
final Path keytabPath = env.configFile().resolve(KerberosRealmSettings.HTTP_SERVICE_KEYTAB_PATH.get(realmSettings)); | ||
if (Files.exists(keytabPath) == false) { | ||
return BootstrapCheckResult.failure("configured service key tab file [" + keytabPath + "] does not exist"); | ||
} | ||
} | ||
} | ||
return BootstrapCheckResult.success(); | ||
} | ||
|
||
@Override | ||
public boolean alwaysEnforce() { | ||
return true; | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,115 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License; | ||
* you may not use this file except in compliance with the Elastic License. | ||
*/ | ||
|
||
package org.elasticsearch.xpack.security.authc.kerberos; | ||
|
||
import org.elasticsearch.bootstrap.BootstrapCheck; | ||
import org.elasticsearch.bootstrap.BootstrapContext; | ||
import org.elasticsearch.common.settings.Settings; | ||
import org.elasticsearch.env.TestEnvironment; | ||
import org.elasticsearch.test.ESTestCase; | ||
import org.elasticsearch.xpack.core.security.authc.RealmSettings; | ||
import org.elasticsearch.xpack.core.security.authc.kerberos.KerberosRealmSettings; | ||
import org.elasticsearch.xpack.core.security.authc.pki.PkiRealmSettings; | ||
import org.elasticsearch.xpack.security.authc.kerberos.support.KerberosTestCase; | ||
|
||
import java.io.IOException; | ||
import java.nio.file.Path; | ||
|
||
import static org.hamcrest.Matchers.equalTo; | ||
import static org.hamcrest.Matchers.is; | ||
import static org.hamcrest.Matchers.notNullValue; | ||
|
||
public class KerberosRealmBootstrapCheckTests extends ESTestCase { | ||
|
||
public void testBootstrapCheckFailsForMultipleKerberosRealms() throws IOException { | ||
final Path tempDir = createTempDir(); | ||
final Settings settings1 = buildKerberosRealmSettings("kerb1", false, tempDir); | ||
final Settings settings2 = buildKerberosRealmSettings("kerb2", false, tempDir); | ||
final Settings settings3 = realm("pki1", PkiRealmSettings.TYPE, Settings.builder()).build(); | ||
final Settings settings = | ||
Settings.builder().put("path.home", tempDir).put(settings1).put(settings2).put(settings3).build(); | ||
final BootstrapContext context = new BootstrapContext(settings, null); | ||
final KerberosRealmBootstrapCheck kerbRealmBootstrapCheck = | ||
new KerberosRealmBootstrapCheck(TestEnvironment.newEnvironment(settings)); | ||
final BootstrapCheck.BootstrapCheckResult result = kerbRealmBootstrapCheck.check(context); | ||
assertThat(result, is(notNullValue())); | ||
assertThat(result.isFailure(), is(true)); | ||
assertThat(result.getMessage(), equalTo("multiple [" + KerberosRealmSettings.TYPE + "] realms are configured. [" | ||
+ KerberosRealmSettings.TYPE + "] can only have one such realm configured")); | ||
} | ||
|
||
public void testBootstrapCheckFailsForMissingKeytabFile() throws IOException { | ||
final Path tempDir = createTempDir(); | ||
final Settings settings = | ||
Settings.builder().put("path.home", tempDir).put(buildKerberosRealmSettings("kerb1", true, tempDir)).build(); | ||
final BootstrapContext context = new BootstrapContext(settings, null); | ||
final KerberosRealmBootstrapCheck kerbRealmBootstrapCheck = | ||
new KerberosRealmBootstrapCheck(TestEnvironment.newEnvironment(settings)); | ||
final BootstrapCheck.BootstrapCheckResult result = kerbRealmBootstrapCheck.check(context); | ||
assertThat(result, is(notNullValue())); | ||
assertThat(result.isFailure(), is(true)); | ||
assertThat(result.getMessage(), | ||
equalTo("configured service key tab file [" + tempDir.resolve("kerb1.keytab").toString() + "] does not exist")); | ||
} | ||
|
||
public void testBootstrapCheckFailsForMissingRealmType() throws IOException { | ||
final Path tempDir = createTempDir(); | ||
final String name = "kerb1"; | ||
final Settings settings1 = buildKerberosRealmSettings("kerb1", false, tempDir); | ||
final Settings settings2 = realm(name, randomFrom("", " "), Settings.builder()).build(); | ||
final Settings settings = | ||
Settings.builder().put("path.home", tempDir).put(settings1).put(settings2).build(); | ||
final BootstrapContext context = new BootstrapContext(settings, null); | ||
final KerberosRealmBootstrapCheck kerbRealmBootstrapCheck = | ||
new KerberosRealmBootstrapCheck(TestEnvironment.newEnvironment(settings)); | ||
final BootstrapCheck.BootstrapCheckResult result = kerbRealmBootstrapCheck.check(context); | ||
assertThat(result, is(notNullValue())); | ||
assertThat(result.isFailure(), is(true)); | ||
assertThat(result.getMessage(), equalTo("missing realm type for [" + name + "] realm")); | ||
} | ||
|
||
public void testBootstrapCheckSucceedsForCorrectConfiguration() throws IOException { | ||
final Path tempDir = createTempDir(); | ||
final Settings finalSettings = | ||
Settings.builder().put("path.home", tempDir).put(buildKerberosRealmSettings("kerb1", false, tempDir)).build(); | ||
final BootstrapContext context = new BootstrapContext(finalSettings, null); | ||
final KerberosRealmBootstrapCheck kerbRealmBootstrapCheck = | ||
new KerberosRealmBootstrapCheck(TestEnvironment.newEnvironment(finalSettings)); | ||
final BootstrapCheck.BootstrapCheckResult result = kerbRealmBootstrapCheck.check(context); | ||
assertThat(result, is(notNullValue())); | ||
assertThat(result.isSuccess(), is(true)); | ||
} | ||
|
||
public void testBootstrapCheckSucceedsForNoKerberosRealms() throws IOException { | ||
final Path tempDir = createTempDir(); | ||
final Settings finalSettings = Settings.builder().put("path.home", tempDir).build(); | ||
final BootstrapContext context = new BootstrapContext(finalSettings, null); | ||
final KerberosRealmBootstrapCheck kerbRealmBootstrapCheck = | ||
new KerberosRealmBootstrapCheck(TestEnvironment.newEnvironment(finalSettings)); | ||
final BootstrapCheck.BootstrapCheckResult result = kerbRealmBootstrapCheck.check(context); | ||
assertThat(result, is(notNullValue())); | ||
assertThat(result.isSuccess(), is(true)); | ||
} | ||
|
||
private Settings buildKerberosRealmSettings(final String name, final boolean missingKeytab, final Path tempDir) throws IOException { | ||
final Settings.Builder builder = Settings.builder(); | ||
if (missingKeytab == false) { | ||
KerberosTestCase.writeKeyTab(tempDir.resolve(name + ".keytab"), null); | ||
} | ||
builder.put(KerberosTestCase.buildKerberosRealmSettings(tempDir.resolve(name + ".keytab").toString())); | ||
return realm(name, KerberosRealmSettings.TYPE, builder).build(); | ||
} | ||
|
||
private Settings.Builder realm(final String name, final String type, final Settings.Builder settings) { | ||
final String prefix = RealmSettings.PREFIX + name + "."; | ||
if (type != null) { | ||
settings.put("type", type); | ||
} | ||
final Settings.Builder builder = Settings.builder().put(settings.normalizePrefix(prefix).build(), false); | ||
return builder; | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you be more detailed here about the checks and why we have these checks?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, addressed the javadocs.