Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

InjectSecurity - inject User object in UserInfo in threadContext #396

Merged
merged 3 commits into from
Apr 13, 2023
Merged

InjectSecurity - inject User object in UserInfo in threadContext #396

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0053ee6
Added user_info injection of User object in InjectSecurity
petardz Apr 11, 2023
98eb7f1
Added better logging, comments and unit test
petardz Apr 13, 2023
a85eba0
spotless fix
petardz Apr 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions src/main/java/org/opensearch/commons/InjectSecurity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,14 @@
import static org.opensearch.commons.ConfigConstants.OPENSEARCH_SECURITY_USE_INJECTED_USER_FOR_PLUGINS;

import java.util.List;
import java.util.StringJoiner;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.opensearch.common.Strings;
import org.opensearch.common.settings.Settings;
import org.opensearch.common.util.concurrent.ThreadContext;
import org.opensearch.commons.authuser.User;

/**
* For background jobs usage only. User or Roles injection can be done using transport layer only.
Expand Down Expand Up @@ -104,7 +106,7 @@ public void inject(final String user, final List<String> roles) {

/**
* Injects user.
* @param user
* @param user name
*/
public void injectUser(final String user) {
if (Strings.isNullOrEmpty(user)) {
Expand All @@ -115,8 +117,27 @@ public void injectUser(final String user) {
threadContext.putTransient(INJECTED_USER, user);
log.debug("{}, InjectSecurity - inject roles: {}", Thread.currentThread().getName(), id);
} else {
log.error("{}, InjectSecurity- most likely thread context corruption : {}", Thread.currentThread().getName(), id);
log.error("{}, InjectSecurity - most likely thread context corruption : {}", Thread.currentThread().getName(), id);
}
}

/**
* Injects user object into user info.
* @param user
*/
public void injectUserInfo(final User user) {
if (user == null) {
return;
}
if (threadContext.getTransient(ConfigConstants.OPENSEARCH_SECURITY_USER_INFO_THREAD_CONTEXT) != null) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we log in the error message the value present in threadContext.getTransient(ConfigConstants.OPENSEARCH_SECURITY_USER_INFO_THREAD_CONTEXT)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the error message may not be that useful.
Can you add in the comment of this method that this should only be used within plugin after stash the context and injecting user permission? I think this is the only use case of this method.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@eirsep @bowenlan-amzn

Added comments, better logging and unit test

log.error("{}, InjectSecurity - most likely thread context corruption : {}", Thread.currentThread().getName(), id);
return;
}
StringJoiner joiner = new StringJoiner("|");
joiner.add(user.getName());
joiner.add(java.lang.String.join(",", user.getBackendRoles()));
joiner.add(java.lang.String.join(",", user.getRoles()));
Comment on lines +146 to +149
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there already a method to reuse for combining these?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't find one. ISM has one in SecurityUtils (generateUserString)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the source of where this ThreadContext header is populated from the security plugin: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java#L197-L209

This is done in the PrivilegesEvaluator which is called from the SecurityFilter which is the first action filter that is applied before a transport request is executed on a node.

mappedRoles in this method is the set of roles that are resolved to as part of the roles resolution process which is calculating via a roles mapping like:

# mapping for role1
role1
{
  "backend_roles" : [ "starfleet", "captains", "defectors" ],
  "hosts" : [ "*.starfleetintranet.com" ],
  "users" : [ "kirk", "spock" ],
  "and_backend_roles": ["enterprise", "voyager"] // User must have all backend roles in this list to be mapped to role1
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cwperks thanks for checking on this. If there's any possible regression in the future, please help track it in some issue.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bowenlan-amzn No regression that I can see. I saw this PR and wanted to get familiar with what it was introducing. I thought I'd leave a fly-by comment for future reference in case anyone wants to know where this threadcontext header originally comes from.

threadContext.putTransient(ConfigConstants.OPENSEARCH_SECURITY_USER_INFO_THREAD_CONTEXT, joiner.toString());
}

/**
Expand Down