Skip to content

Commit 3de18de

Browse files
peterniedpeternied
authored
Merge branch 'main' into downgrade-gradle
2 parents 1cf6394 + 920701e commit 3de18de

93 files changed

Lines changed: 4213 additions & 2306 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -47,17 +47,6 @@ jobs:
4747
restore-keys: |
4848
${{ runner.os }}-gradle-
4949
50-
51-
- name: Checkstyle
52-
run: ./gradlew clean checkstyleMain checkstyleTest
53-
54-
- name: Set up JDK for test
55-
if: matrix.jdk == 17
56-
uses: actions/setup-java@v2
57-
with:
58-
distribution: temurin # Temurin is a distribution of adoptium
59-
java-version: ${{ matrix.jdk }}
60-
6150
- name: Run Tests
6251
run: ./gradlew clean build -Dbuild.snapshot=false -x test
6352

‎build.gradle‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -341,8 +341,6 @@ bundle.doLast() {
341341

342342
tasks.assemble.dependsOn(bundle)
343343
tasks.bundle.dependsOn(createPluginDescriptor)
344-
tasks.assemble.dependsOn(bundleSecurityAdminStandalone)
345-
tasks.assemble.dependsOn(bundleSecurityAdminStandaloneTarGz)
346344

347345
clean {
348346
delete 'data/'

‎release-notes/opensearch-security.release-notes-1.3.0.0.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
## 2022-03-15 Version 1.3.0.0
2+
3+
Compatible with OpenSearch 1.3.0
4+
5+
### Enhancements
6+
7+
* Adds CI support for Java 8, 11 and 14 ([#1580](https://github.com/opensearch-project/security/pull/1580))
8+
* Updates the test retry-count to give flaky tests more chances to pass ([#1601](https://github.com/opensearch-project/security/pull/1601))
9+
* Adds support for OPENSEARCH_JAVA_HOME ([#1603](https://github.com/opensearch-project/security/pull/1603))
10+
* Adds auto delete workflow for backport branches ([#1604](https://github.com/opensearch-project/security/pull/1604))
11+
* Create the plugin-descriptor programmatically ([#1623](https://github.com/opensearch-project/security/pull/1623))
12+
* Add test to make sure exception causes aren't sent to callers ([#1639](https://github.com/opensearch-project/security/pull/1639))
13+
* Switch gradle to info logging for improved test debugging ([#1646](https://github.com/opensearch-project/security/pull/1646))
14+
* Remove artifact step from CI workflow ([#1645](https://github.com/opensearch-project/security/pull/1645))
15+
* Adds ssl script ([#1530](https://github.com/opensearch-project/security/pull/1530))
16+
* Adds Java-17 to CI matrix ([#1609](https://github.com/opensearch-project/security/pull/1609))
17+
* Reverts ssl script PR ([#1637](https://github.com/opensearch-project/security/pull/1637))
18+
* Remove java17 from 1.3 build matrix ([#1668](https://github.com/opensearch-project/security/pull/1668))
19+
20+
### Bug fixes
21+
22+
* Bumps JJWT version ([#1589](https://github.com/opensearch-project/security/pull/1589))
23+
* Updates backport workflow with custom branch and github app ([#1597](https://github.com/opensearch-project/security/pull/1597))
24+
* Always run checks on PRs ([#1615](https://github.com/opensearch-project/security/pull/1615))
25+
* Adds 'opens' command-line argument for java.io libraries to unblock build ([#1616](https://github.com/opensearch-project/security/pull/1616))
26+
* Adds jacoco report and pass the location to codecov ([#1617](https://github.com/opensearch-project/security/pull/1617))
27+
* Fixes the settings of roles_separator ([#1618](https://github.com/opensearch-project/security/pull/1618))
28+
* Use standard opensearch.version property ([#1622](https://github.com/opensearch-project/security/pull/1622))
29+
30+
31+
### Maintenance
32+
33+
* Updates bug template ([#1582](https://github.com/opensearch-project/security/pull/1582))
34+
* Updates jackson-databind library version ([#1584](https://github.com/opensearch-project/security/pull/1584))
35+
* Upgrades Kafka version ([#1598](https://github.com/opensearch-project/security/pull/1598))
36+
* Upgrades Guava version ([#1594](https://github.com/opensearch-project/security/pull/1594))
37+
* Update maintainers list ([#1607](https://github.com/opensearch-project/security/pull/1607))
38+
* Exclude velocity 1.7 from OpenSAML dependency ([#1606](https://github.com/opensearch-project/security/pull/1606))
39+
* Migrate build system to gradle ([#1592](https://github.com/opensearch-project/security/pull/1592))
40+
* Updates documentation for practices for maintainers ([#1611](https://github.com/opensearch-project/security/pull/1611))
41+
* Remove jcenter repository ([#1625](https://github.com/opensearch-project/security/pull/1625))
42+
* Remove '-SNAPSHOT' from opensearch.version in plugin descriptor ([#1634](https://github.com/opensearch-project/security/pull/1634))
43+
* Add git ignore for VScode IDE settings ([#1629](https://github.com/opensearch-project/security/pull/1629))
44+
* Remove netty-tcnative dependency to unblock security plugin build on ARM64 ([#1649](https://github.com/opensearch-project/security/pull/1649))
45+
* Add plugin-descriptor.properties to .gitignore ([#1651](https://github.com/opensearch-project/security/pull/1651))
46+
* Removes Github DCO action as it is replaced by Github app ([1657](https://github.com/opensearch-project/security/pull/1657))
47+
* Configure ML reserved roles and system indices ([#1662](https://github.com/opensearch-project/security/pull/1662))
48+
* Release Notes for 1.3.0.0 ([#1671](https://github.com/opensearch-project/security/pull/1671))

‎src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@
5757
import org.opensearch.security.dlic.rest.api.SecurityRestApiActions;
5858
import org.opensearch.security.filter.SecurityRestFilter;
5959
import org.opensearch.security.http.SecurityHttpServerTransport;
60+
import org.opensearch.security.rest.SecurityConfigUpdateAction;
61+
import org.opensearch.security.rest.SecurityWhoAmIAction;
6062
import org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin;
6163
import org.opensearch.security.ssl.rest.SecuritySSLReloadCertsAction;
6264
import org.opensearch.security.ssl.rest.SecuritySSLCertsInfoAction;
@@ -108,6 +110,7 @@
108110
import org.opensearch.index.IndexModule;
109111
import org.opensearch.index.cache.query.QueryCache;
110112
import org.opensearch.index.shard.SearchOperationListener;
113+
import org.opensearch.indices.IndicesService;
111114
import org.opensearch.indices.SystemIndexDescriptor;
112115
import org.opensearch.indices.breaker.CircuitBreakerService;
113116
import org.opensearch.plugins.ClusterPlugin;
@@ -459,7 +462,8 @@ public List<RestHandler> getRestHandlers(Settings settings, RestController restC
459462
handlers.add(new DashboardsInfoAction(settings, restController, Objects.requireNonNull(evaluator), Objects.requireNonNull(threadPool)));
460463
handlers.add(new TenantInfoAction(settings, restController, Objects.requireNonNull(evaluator), Objects.requireNonNull(threadPool),
461464
Objects.requireNonNull(cs), Objects.requireNonNull(adminDns), Objects.requireNonNull(cr)));
462-
465+
handlers.add(new SecurityConfigUpdateAction(settings, restController,Objects.requireNonNull(threadPool), adminDns, configPath, principalExtractor));
466+
handlers.add(new SecurityWhoAmIAction(settings ,restController,Objects.requireNonNull(threadPool), adminDns, configPath, principalExtractor));
463467
if (sslCertReloadEnabled) {
464468
handlers.add(new SecuritySSLReloadCertsAction(settings, restController, sks, Objects.requireNonNull(threadPool), Objects.requireNonNull(adminDns)));
465469
}
@@ -776,7 +780,7 @@ public Collection<Object> createComponents(Client localClient, ClusterService cl
776780
auditLog = new NullAuditLog();
777781
privilegesInterceptor = new PrivilegesInterceptor(resolver, clusterService, localClient, threadPool);
778782
} else {
779-
dlsFlsValve = new DlsFlsValveImpl();
783+
dlsFlsValve = new DlsFlsValveImpl(settings, localClient, clusterService, resolver, xContentRegistry, threadPool.getThreadContext());
780784
auditLog = new AuditLogImpl(settings, configPath, localClient, threadPool, resolver, clusterService, environment);
781785
privilegesInterceptor = new PrivilegesInterceptorImpl(resolver, clusterService, localClient, threadPool);
782786
}
@@ -795,10 +799,10 @@ public Collection<Object> createComponents(Client localClient, ClusterService cl
795799
// DLS-FLS is enabled if not client and not disabled and not SSL only.
796800
final boolean dlsFlsEnabled = !SSLConfig.isSslOnlyMode();
797801
evaluator = new PrivilegesEvaluator(clusterService, threadPool, cr, resolver, auditLog,
798-
settings, privilegesInterceptor, cih, irr, dlsFlsEnabled);
799-
800-
sf = new SecurityFilter(localClient, settings, evaluator, adminDns, dlsFlsValve, auditLog, threadPool, cs, compatConfig, irr, backendRegistry);
802+
settings, privilegesInterceptor, cih, irr, dlsFlsEnabled, namedXContentRegistry);
801803

804+
sf = new SecurityFilter(localClient, settings, evaluator, adminDns, dlsFlsValve, auditLog, threadPool, cs, compatConfig, irr, backendRegistry, namedXContentRegistry);
805+
802806
final String principalExtractorClass = settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_PRINCIPAL_EXTRACTOR_CLASS, null);
803807

804808
if(principalExtractorClass == null) {
@@ -1122,12 +1126,14 @@ public static class GuiceHolder implements LifecycleComponent {
11221126

11231127
private static RepositoriesService repositoriesService;
11241128
private static RemoteClusterService remoteClusterService;
1129+
private static IndicesService indicesService;
11251130

11261131
@Inject
11271132
public GuiceHolder(final RepositoriesService repositoriesService,
1128-
final TransportService remoteClusterService) {
1133+
final TransportService remoteClusterService, IndicesService indicesService) {
11291134
GuiceHolder.repositoriesService = repositoriesService;
11301135
GuiceHolder.remoteClusterService = remoteClusterService.getRemoteClusterService();
1136+
GuiceHolder.indicesService = indicesService;
11311137
}
11321138

11331139
public static RepositoriesService getRepositoriesService() {
@@ -1138,6 +1144,10 @@ public static RemoteClusterService getRemoteClusterService() {
11381144
return remoteClusterService;
11391145
}
11401146

1147+
public static IndicesService getIndicesService() {
1148+
return indicesService;
1149+
}
1150+
11411151
@Override
11421152
public void close() {
11431153
}

‎src/main/java/org/opensearch/security/action/configupdate/ConfigUpdateNodeResponse.java‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,10 @@
3737
import org.opensearch.cluster.node.DiscoveryNode;
3838
import org.opensearch.common.io.stream.StreamInput;
3939
import org.opensearch.common.io.stream.StreamOutput;
40+
import org.opensearch.common.xcontent.ToXContentObject;
41+
import org.opensearch.common.xcontent.XContentBuilder;
4042

41-
public class ConfigUpdateNodeResponse extends BaseNodeResponse {
43+
public class ConfigUpdateNodeResponse extends BaseNodeResponse implements ToXContentObject {
4244

4345
private String[] updatedConfigTypes;
4446
private String message;
@@ -78,4 +80,14 @@ public void writeTo(StreamOutput out) throws IOException {
7880
public String toString() {
7981
return "ConfigUpdateNodeResponse [updatedConfigTypes=" + Arrays.toString(updatedConfigTypes) + ", message=" + message + "]";
8082
}
83+
84+
@Override
85+
public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
86+
builder.startObject();
87+
builder.field("updated_config_types", updatedConfigTypes);
88+
builder.field("updated_config_size", updatedConfigTypes == null ? 0: updatedConfigTypes.length);
89+
builder.field("message", message);
90+
builder.endObject();
91+
return builder;
92+
}
8193
}

‎src/main/java/org/opensearch/security/action/configupdate/ConfigUpdateResponse.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,15 @@
3838
import org.opensearch.cluster.ClusterName;
3939
import org.opensearch.common.io.stream.StreamInput;
4040
import org.opensearch.common.io.stream.StreamOutput;
41+
import org.opensearch.common.xcontent.ToXContentObject;
42+
import org.opensearch.common.xcontent.XContentBuilder;
4143

42-
public class ConfigUpdateResponse extends BaseNodesResponse<ConfigUpdateNodeResponse> {
44+
public class ConfigUpdateResponse extends BaseNodesResponse<ConfigUpdateNodeResponse> implements ToXContentObject {
4345

4446
public ConfigUpdateResponse(StreamInput in) throws IOException {
4547
super(in);
4648
}
47-
49+
4850
public ConfigUpdateResponse(final ClusterName clusterName, List<ConfigUpdateNodeResponse> nodes, List<FailedNodeException> failures) {
4951
super(clusterName, nodes, failures);
5052
}
@@ -58,4 +60,16 @@ public List<ConfigUpdateNodeResponse> readNodesFrom(final StreamInput in) throws
5860
public void writeNodesTo(final StreamOutput out, List<ConfigUpdateNodeResponse> nodes) throws IOException {
5961
out.writeList(nodes);
6062
}
63+
64+
@Override
65+
public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
66+
builder.startObject("configupdate_response");
67+
builder.field("nodes", getNodesMap());
68+
builder.field("node_size", getNodes().size());
69+
builder.field("has_failures", hasFailures());
70+
builder.field("failures_size", failures().size());
71+
builder.endObject();
72+
73+
return builder;
74+
}
6175
}

0 commit comments

Comments
 (0)