Remove support for v6 configuration by nibix · Pull Request #4546 · opensearch-project/security

nibix · 2024-07-11T08:33:27Z

Description

This solves #4493 and removes support for v6 configuration. On master, v6 configuration is not usable any more anyway, see #4745 for the verification.

As an additional benefit, this makes it possible to use SecurityDynamicConfiguration<> instances in a generically type-safe manner. So far, one usually needs to use SecurityDynamicConfiguration<?> instances and do unsafe casts.

If it is desired to continue supporting v6 configuration for OpenSearch 2.x, there's the PR #4753 for that.

Category: Refactoring
Why these changes are required? - Minimize duplicate logic for privilege evaluation, remove unnecessary code
What is the old behavior before changes and new behavior after changes? - Any try to use v6 configuration is now fail-fast

Issues Resolved

Solves [RFC] Retire support for V6 configuration #4493

Check List

Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

DarshitChanpura

Changes look good to me @nibix. Could you please check and resolve the conflict?

src/main/java/org/opensearch/security/securityconf/impl/CType.java

src/test/java/org/opensearch/security/securityconf/SecurityRolesPermissionsV6Test.java

nibix · 2024-07-12T07:43:05Z

BTW, I felt that I should describe the idea of the change a bit more in detail. See the updated description of this PR.

cwperks · 2024-09-06T19:07:32Z

With this change, would a user still be able to use the Migrate API to change the documents stored in the security index to the V7 format?

If a user uses securityadmin to export the security index, what format will the generated yml files be in?

nibix · 2024-09-10T09:43:02Z

@cwperks

With this change, would a user still be able to use the Migrate API to change the documents stored in the security index to the V7 format?
If a user uses securityadmin to export the security index, what format will the generated yml files be in?

In the end, it is up to us to define these behaviors. I would expect that both functionalities remain unaffected. Thus, exporting the configuratin will yield v6/v1 configuration files. Also, the migrate API and the migrate command continue to work as before.

cwperks · 2024-09-18T13:31:05Z

In the end, it is up to us to define these behaviors. I would expect that both functionalities remain unaffected. Thus, exporting the configuratin will yield v6/v1 configuration files. Also, the migrate API and the migrate command continue to work as before.

Sounds good. What work is remaining on this PR in order to flip it from Draft?

nibix · 2024-09-19T12:39:50Z

@cwperks

What work is remaining on this PR in order to flip it from Draft?

Mainly reviewing test failures and reviewing the special cases, like migration and API - as mentioned above.

So, I would then focus on this again?

cwperks · 2024-09-19T13:34:50Z

If its an enabler for #4380, then IMO I think we should move this forward

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

codecov · 2024-09-25T05:44:02Z

Codecov Report

Attention: Patch coverage is 66.51376% with 73 lines in your changes missing coverage. Please review.

Project coverage is 67.97%. Comparing base (a62e99a) to head (5ebe500).
Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...a/org/opensearch/security/tools/SecurityAdmin.java	23.07%	30 Missing and 10 partials ⚠️
...ch/security/securityconf/DynamicConfigFactory.java	60.00%	10 Missing and 6 partials ⚠️
...a/org/opensearch/security/DefaultObjectMapper.java	0.00%	6 Missing ⚠️
...earch/security/configuration/ConfigurationMap.java	84.00%	2 Missing and 2 partials ⚠️
...g/opensearch/security/securityconf/impl/CType.java	92.30%	2 Missing and 1 partial ⚠️
...ecurityconf/impl/SecurityDynamicConfiguration.java	84.21%	0 Missing and 3 partials ⚠️
...ecurity/configuration/ConfigurationRepository.java	93.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4546      +/-   ##
==========================================
+ Coverage   65.59%   67.97%   +2.38%     
==========================================
  Files         319      310       -9     
  Lines       22470    20924    -1546     
  Branches     3604     3318     -286     
==========================================
- Hits        14739    14224     -515     
+ Misses       5921     4952     -969     
+ Partials     1810     1748      -62

Files with missing lines	Coverage Δ
...ty/configuration/ConfigurationLoaderSecurity7.java	`70.00% <100.00%> (+0.70%)`	⬆️
...arch/security/dlic/rest/api/AbstractApiAction.java	`83.33% <ø> (ø)`
...earch/security/dlic/rest/api/AccountApiAction.java	`60.56% <ø> (ø)`
.../security/dlic/rest/api/ActionGroupsApiAction.java	`78.18% <ø> (ø)`
...rch/security/dlic/rest/api/AllowlistApiAction.java	`89.47% <ø> (ø)`
...nsearch/security/dlic/rest/api/AuditApiAction.java	`90.76% <ø> (-3.08%)`	⬇️
...curity/dlic/rest/api/AuthTokenProcessorAction.java	`90.90% <ø> (ø)`
.../security/dlic/rest/api/CertificatesApiAction.java	`35.13% <ø> (ø)`
...security/dlic/rest/api/ConfigUpgradeApiAction.java	`72.97% <100.00%> (ø)`
...ch/security/dlic/rest/api/FlushCacheApiAction.java	`64.00% <100.00%> (-1.39%)`	⬇️
... and 30 more

... and 13 files with indirect coverage changes

src/main/java/org/opensearch/security/configuration/ConfigurationMap.java

src/main/java/org/opensearch/security/configuration/ConfigurationRepository.java

src/test/resources/legacy/securityconfig_v6/action_groups.yml

cwperks

Left one minor comment. This change LGTM!

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

nibix · 2024-10-02T07:11:55Z

@willyborankin @cwperks I did one more minor commit: 5ebe500 ... could you please re-approve?

cwperks · 2024-10-02T14:54:47Z

@willyborankin @cwperks I did one more minor commit: 5ebe500 ... could you please re-approve?

Done

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com> Signed-off-by: Terry Quigley <terry.quigley@sas.com>

nibix requested review from DarshitChanpura, RyanL1997, cliu123, cwperks, peternied, reta, stephen-crawford and willyborankin as code owners July 11, 2024 08:33

nibix changed the title ~~Auto-convert V6 configuration instances into V7 configuration instaces~~ Auto-convert V6 configuration instances into V7 configuration instances Jul 11, 2024

nibix mentioned this pull request Jul 11, 2024

[RFC] Retire support for V6 configuration #4493

Closed

nibix marked this pull request as draft July 11, 2024 16:01

DarshitChanpura reviewed Jul 11, 2024

View reviewed changes

src/main/java/org/opensearch/security/securityconf/impl/CType.java Show resolved Hide resolved

src/test/java/org/opensearch/security/securityconf/SecurityRolesPermissionsV6Test.java Show resolved Hide resolved

nibix force-pushed the config-improvements branch from 0ab5f5f to 6bb6de4 Compare July 12, 2024 08:35

nibix mentioned this pull request Jul 17, 2024

Optimized Privilege Evaluation #4380

Merged

3 tasks

nibix force-pushed the config-improvements branch from 950c447 to 1540e23 Compare September 21, 2024 06:48

This was referenced Sep 21, 2024

Fixed use of rolesMappingConfiguration in InternalUsersApiActionValidationTest #4744

Merged

Auto-convert V6 configuration instances into V7 configuration instances (for OpenSearch 2.x only) #4753

Merged

nibix force-pushed the config-improvements branch from 14fdac9 to 5631248 Compare September 24, 2024 07:54

nibix changed the title ~~Auto-convert V6 configuration instances into V7 configuration instances~~ Remove support for v6 configuration Sep 24, 2024

nibix marked this pull request as ready for review September 24, 2024 08:04

nibix added 4 commits September 25, 2024 06:32

V6 configurations now get auto-converted into V7 configurations

f86f1fe

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

Deleted unused classes

abbc3e7

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

Removed v6 configuration related code

f3a6f44

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

Removed v6 configuration related code

e997aed

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

nibix added 3 commits September 25, 2024 06:52

Fixes

2239566

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

Removed v6 stuff from securityadmin

dc50298

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

Removed unnecessary mockito stubbings

7f5bc7d

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

nibix force-pushed the config-improvements branch from f4e59b0 to 7f5bc7d Compare September 25, 2024 05:08

Fix

407b8f6

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

willyborankin previously approved these changes Sep 25, 2024

View reviewed changes

cwperks reviewed Oct 1, 2024

View reviewed changes

src/main/java/org/opensearch/security/configuration/ConfigurationMap.java Show resolved Hide resolved

cwperks reviewed Oct 1, 2024

View reviewed changes

src/main/java/org/opensearch/security/configuration/ConfigurationRepository.java Outdated Show resolved Hide resolved

cwperks reviewed Oct 1, 2024

View reviewed changes

src/test/resources/legacy/securityconfig_v6/action_groups.yml Show resolved Hide resolved

cwperks previously approved these changes Oct 1, 2024

View reviewed changes

Rolled back unnecessary change

5ebe500

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>

nibix dismissed stale reviews from cwperks and willyborankin via 5ebe500 October 2, 2024 07:10

willyborankin approved these changes Oct 2, 2024

View reviewed changes

cwperks approved these changes Oct 2, 2024

View reviewed changes

cwperks merged commit 830b341 into opensearch-project:main Oct 2, 2024

terryquigleysas pushed a commit to terryquigleysas/security that referenced this pull request Oct 3, 2024

Remove support for v6 configuration (opensearch-project#4546)

5cb285f

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com> Signed-off-by: Terry Quigley <terry.quigley@sas.com>

nibix mentioned this pull request Oct 24, 2024

[Question] Remove config V6 models #2967

Closed

cwperks mentioned this pull request Mar 19, 2025

[BUG] Upgrade OS from 2.19.0 to 3.0.0-alpha1, the OS can't start up #5191

Closed

nibix mentioned this pull request Mar 20, 2025

Moving on with Optimized Privilege Evaluation for 3.0 release #5181

Closed

Conversation

nibix commented Jul 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Check List

Uh oh!

DarshitChanpura left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nibix commented Jul 12, 2024

Uh oh!

cwperks commented Sep 6, 2024

Uh oh!

nibix commented Sep 10, 2024

Uh oh!

cwperks commented Sep 18, 2024

Uh oh!

nibix commented Sep 19, 2024

Uh oh!

cwperks commented Sep 19, 2024

Uh oh!

codecov bot commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cwperks left a comment

Choose a reason for hiding this comment

Uh oh!

nibix commented Oct 2, 2024

Uh oh!

cwperks commented Oct 2, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nibix commented Jul 11, 2024 •

edited

Loading

codecov bot commented Sep 25, 2024 •

edited

Loading