[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

DarshitChanpura · 2023-09-27T21:23:37Z

Associated PRs: opensearch-project/security#3416

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff
Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2023-09-27T21:31:53Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26409/
CommitID: 6e1f9f0
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-27T21:35:13Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26410/
CommitID: 09f4339
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-27T21:51:55Z

Compatibility status:

Checks if related components are compatible with change 71e6c2d

Incompatible components

Skipped components

Compatible components

github-actions · 2023-09-28T19:00:02Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26456/
CommitID: 15b4d6a
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

…re (opensearch-project#9842) (opensearch-project#9848) (cherry picked from commit e4a1841) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…pensearch-project#9832) (opensearch-project#9844) * introducing zstd compression codec plugin * Moving zstd compression codec as a plugin * introducing zstd compression codec plugin * Adding checks to EngineConfig and fixing tests * incorporating review comments * fixing tests * introducing zstd compression codec plugin * addressing review comments * nit fixes * implementing codec aliases * addressing review comments * review comments * moving codec aliases to custom codec * adding zstd default codec for backward compatibility * renaming to deprecated codec * incorporating review comments * nit fixes --------- (cherry picked from commit 76f1b52) (cherry picked from commit 90310c3) Signed-off-by: Sarthak Aggarwal <sarthagg@amazon.com> Signed-off-by: Prabhakar Sithanandam <backslasht@users.noreply.github.com> Signed-off-by: Andrew Ross <andrross@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Sarthak Aggarwal <sarthagg@amazon.com> Co-authored-by: Prabhakar Sithanandam <backslasht@users.noreply.github.com>

This plugin has been moved to its own [repository][1]. [1]: https://github.com/opensearch-project/custom-codecs Signed-off-by: Andrew Ross <andrross@amazon.com>

…ct#8679) Implement on behalf of token passing for extensions Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Ryan Liang <jiallian@amazon.com> Co-authored-by: Ryan Liang <jiallian@amazon.com> Co-authored-by: Peter Nied <peternied@hotmail.com>

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Signed-off-by: Ryan Liang <jiallian@amazon.com>

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

github-actions · 2023-09-28T19:27:45Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26457/
CommitID: 184b7c4
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-28T19:37:59Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26458/
CommitID: 903f180
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

github-actions · 2023-09-28T20:49:22Z

Gradle Check (Jenkins) Run Completed with:

RESULT: ❌
URL:
CommitID: 3b6f0e1
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

DarshitChanpura · 2023-09-29T16:48:43Z

@RyanL1997 @scrawfor99 @cwperks Could you please review this?

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

github-actions · 2023-09-29T17:54:47Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26481/
CommitID: 165721b
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-09-29T18:06:18Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26480/
CommitID: 3c3b7c6
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

stephen-crawford · 2023-10-02T14:33:04Z

CHANGELOG.md

@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Implement Visitor Design pattern in QueryBuilder to enable the capability to traverse through the complex QueryBuilder tree. ([#10110](https://github.com/opensearch-project/OpenSearch/pull/10110))
 - Add capability to restrict async durability mode for remote indexes ([#10189](https://github.com/opensearch-project/OpenSearch/pull/10189))
 - Add Doc Status Counter for Indexing Engine ([#4562](https://github.com/opensearch-project/OpenSearch/issues/4562))
+- Adds changes related On-behalf-Of and Service Accounts feature ([#10258](https://github.com/opensearch-project/OpenSearch/pull/10258))


Suggested change

- Adds changes related On-behalf-Of and Service Accounts feature ([#10258](https://github.com/opensearch-project/OpenSearch/pull/10258))

- Adds changes related to On-behalf-Of and Service Accounts feature ([#10258](https://github.com/opensearch-project/OpenSearch/pull/10258))

stephen-crawford · 2023-10-02T14:35:02Z

server/src/main/java/org/opensearch/discovery/InitializeExtensionSecurityRequest.java

I would recommend putting all logic inside the standard initialize transport action similar to what was done on the main branch.

stephen-crawford · 2023-10-02T14:36:23Z

server/src/main/java/org/opensearch/discovery/InitializeExtensionSecurityResponse.java

Same as above, I think we want to use a single transport action as was done in main.

stephen-crawford · 2023-10-02T14:36:51Z

server/src/main/java/org/opensearch/extensions/ExtensionsManager.java

@@ -74,8 +83,10 @@ public class ExtensionsManager {
    public static final String REQUEST_EXTENSION_REGISTER_TRANSPORT_ACTIONS = "internal:discovery/registertransportactions";
    public static final String REQUEST_REST_EXECUTE_ON_EXTENSION_ACTION = "internal:extensions/restexecuteonextensiontaction";
    public static final String REQUEST_EXTENSION_HANDLE_TRANSPORT_ACTION = "internal:extensions/handle-transportaction";
+    public static final String REQUEST_EXTENSION_ISSUE_SERVICE_ACCOUNT = "internal:extensions/issue-service-account";


I believe this was removed from the final implementation--for the changes we actually need you can look at: #9618

stephen-crawford · 2023-10-02T14:38:53Z

server/src/main/java/org/opensearch/extensions/action/IssueServiceAccountRequest.java

Going to be part of the same initialization request.

stephen-crawford · 2023-10-02T14:39:00Z

server/src/main/java/org/opensearch/extensions/action/IssueServiceAccountResponse.java

Same as above.

Provide service accounts tokens to extensions This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com> (cherry picked from commit 994e115)

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

github-actions · 2023-10-02T20:12:07Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26624/
CommitID: 9c755a3
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-10-02T20:16:38Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26625/
CommitID: 2be819c
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-10-02T20:20:02Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26626/
CommitID: 961c56d
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura · 2023-10-02T20:31:46Z

@scrawfor99 @RyanL1997 please review this when you get a chance

github-actions · 2023-10-02T20:35:59Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/26628/
CommitID: 71e6c2d
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

DarshitChanpura · 2023-10-18T22:25:25Z

@scrawfor99 @RyanL1997 please let me know if this needs to be re-opened.

DarshitChanpura mentioned this pull request Sep 27, 2023

[2.x] Adds On-Behalf-Of authentication mechanism and service account capability opensearch-project/security#3416

Closed

3 tasks

opensearch-trigger-bot bot and others added 7 commits September 28, 2023 15:14

Remove custom-codecs plugin (opensearch-project#9947)

7e9a876

This plugin has been moved to its own [repository][1]. [1]: https://github.com/opensearch-project/custom-codecs Signed-off-by: Andrew Ross <andrross@amazon.com>

Just need to wait for service account merge

9136aea

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Add service account changes minus tests

cec24b0

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Grant getClassLoader

3b23737

Signed-off-by: Ryan Liang <jiallian@amazon.com>

DarshitChanpura force-pushed the OBOAndService branch from 15b4d6a to 184b7c4 Compare September 28, 2023 19:15

Fixes spotless errors and replaces sysout with logger statement

903f180

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura force-pushed the OBOAndService branch from 184b7c4 to 903f180 Compare September 28, 2023 19:21

Cleans up unwanted changes

3b6f0e1

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura self-assigned this Sep 29, 2023

DarshitChanpura added 2 commits September 29, 2023 13:32

Adds this PR to change log

3c3b7c6

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Merge branch '2.x' into OBOAndService

165721b

peternied changed the title ~~[2.x] Adds changes related On-behalf-Of and Service Accounts feature~~ [2.x] Adds changes related OnBehalfOf and Service Accounts feature Sep 29, 2023

stephen-crawford reviewed Oct 2, 2023

View reviewed changes

DarshitChanpura changed the title ~~[2.x] Adds changes related OnBehalfOf and Service Accounts feature~~ [2.x] Adds changes related to OnBehalfOf and Service Accounts feature Oct 2, 2023

stephen-crawford and others added 2 commits October 2, 2023 16:00

Fixes CHANGELOG entry

9c755a3

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura added 2 commits October 2, 2023 16:03

Merge branch '2.x' into OBOAndService

2be819c

Removes unneeded files

961c56d

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Fixes precommit failure

71e6c2d

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

RyanL1997 mentioned this pull request Oct 16, 2023

[META] On-Behalf-Of Authentication opensearch-project/security#2573

Closed

35 tasks

DarshitChanpura closed this Oct 18, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

DarshitChanpura commented Sep 27, 2023 •

edited

Loading

github-actions bot commented Sep 27, 2023

github-actions bot commented Sep 27, 2023

github-actions bot commented Sep 27, 2023 •

edited

Loading

github-actions bot commented Sep 28, 2023

github-actions bot commented Sep 28, 2023

github-actions bot commented Sep 28, 2023

github-actions bot commented Sep 28, 2023

DarshitChanpura commented Sep 29, 2023

github-actions bot commented Sep 29, 2023

github-actions bot commented Sep 29, 2023

stephen-crawford Oct 2, 2023

stephen-crawford Oct 2, 2023

stephen-crawford Oct 2, 2023

stephen-crawford Oct 2, 2023

stephen-crawford Oct 2, 2023

stephen-crawford Oct 2, 2023

github-actions bot commented Oct 2, 2023

github-actions bot commented Oct 2, 2023

github-actions bot commented Oct 2, 2023

DarshitChanpura commented Oct 2, 2023

github-actions bot commented Oct 2, 2023

DarshitChanpura commented Oct 18, 2023

	- Adds changes related On-behalf-Of and Service Accounts feature ([#10258](https://github.com/opensearch-project/OpenSearch/pull/10258))
	- Adds changes related to On-behalf-Of and Service Accounts feature ([#10258](https://github.com/opensearch-project/OpenSearch/pull/10258))

[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

[2.x] Adds changes related to OnBehalfOf and Service Accounts feature #10258

Conversation

DarshitChanpura commented Sep 27, 2023 • edited Loading

Check List

github-actions bot commented Sep 27, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 27, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 27, 2023 • edited Loading

Compatibility status:

Incompatible components

Skipped components

Compatible components

github-actions bot commented Sep 28, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 28, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 28, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 28, 2023

Gradle Check (Jenkins) Run Completed with:

DarshitChanpura commented Sep 29, 2023

github-actions bot commented Sep 29, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 29, 2023

Gradle Check (Jenkins) Run Completed with:

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

stephen-crawford Oct 2, 2023

Choose a reason for hiding this comment

github-actions bot commented Oct 2, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 2, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 2, 2023

Gradle Check (Jenkins) Run Completed with:

DarshitChanpura commented Oct 2, 2023

github-actions bot commented Oct 2, 2023

Gradle Check (Jenkins) Run Completed with:

DarshitChanpura commented Oct 18, 2023

DarshitChanpura commented Sep 27, 2023 •

edited

Loading

github-actions bot commented Sep 27, 2023 •

edited

Loading