Skip to content

Commit e1021c2

Browse files
RyanL1997RyanL1997
committed
Refactor the bwc mode into roleSecurityMode
Signed-off-by: Ryan Liang <jiallian@amazon.com>
1 parent c1a825b commit e1021c2

5 files changed

Lines changed: 16 additions & 35 deletions

File tree

‎src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1119,23 +1119,6 @@ public Settings additionalSettings() {
11191119
}
11201120
return builder.build();
11211121
}
1122-
// CS-SUPPRESS-SINGLE: RegexpSingleline get Extensions Settings
1123-
1124-
@Override
1125-
public List<Setting<?>> getExtensionSettings() {
1126-
List<Setting<?>> extensionSettings = new ArrayList<Setting<?>>();
1127-
1128-
extensionSettings.add(
1129-
Setting.boolSetting(
1130-
ConfigConstants.EXTENSIONS_BWC_PLUGIN_MODE,
1131-
ConfigConstants.EXTENSIONS_BWC_PLUGIN_MODE_DEFAULT,
1132-
Property.ExtensionScope,
1133-
Property.Final
1134-
)
1135-
);
1136-
return extensionSettings;
1137-
}
1138-
// CS-ENFORCE-SINGLE:
11391122

11401123
@Override
11411124
public List<Setting<?>> getSettings() {

‎src/main/java/org/opensearch/security/action/onbehalf/CreateOnBehalfOfTokenAction.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,10 @@ public void accept(RestChannel channel) throws Exception {
135135
.map(value -> Math.min(value, OBO_MAX_EXPIRY_SECONDS)) // Max duration seconds are 600
136136
.orElse(OBO_DEFAULT_EXPIRY_SECONDS); // Fallback to default
137137

138+
final Boolean roleSecurityMode = Optional.ofNullable(requestBody.get("roleSecurityMode"))
139+
.map(value -> (Boolean) value)
140+
.orElse(false); // Default to false if null
141+
138142
final String service = (String) requestBody.getOrDefault("service", "self-issued");
139143
final User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER);
140144
Set<String> mappedRoles = mapRoles(user, /*Do not include host based mappings*/ null);
@@ -148,7 +152,8 @@ public void accept(RestChannel channel) throws Exception {
148152
service,
149153
tokenDuration,
150154
mappedRoles.stream().collect(Collectors.toList()),
151-
user.getRoles().stream().collect(Collectors.toList())
155+
user.getRoles().stream().collect(Collectors.toList()),
156+
roleSecurityMode
152157
);
153158
builder.field("authenticationToken", token);
154159
builder.field("durationSeconds", tokenDuration);

‎src/main/java/org/opensearch/security/auth/BackendRegistry.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ private User impersonate(final RestRequest request, final User originalUser) thr
608608
for (final AuthDomain authDomain : restAuthDomains) {
609609
final AuthenticationBackend authenticationBackend = authDomain.getBackend();
610610

611-
//Skip over the OnBehalfOfAuthenticator since it is not compatible for user impersonation
611+
// Skip over the OnBehalfOfAuthenticator since it is not compatible for user impersonation
612612
if (authDomain.getHttpAuthenticator() instanceof OnBehalfOfAuthenticator) {
613613
continue;
614614
}

‎src/main/java/org/opensearch/security/authtoken/jwt/JwtVendor.java‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131

3232
import org.opensearch.common.settings.Settings;
3333
import org.opensearch.security.ssl.util.ExceptionUtils;
34-
import org.opensearch.security.support.ConfigConstants;
3534

3635
public class JwtVendor {
3736
private static final Logger logger = LogManager.getLogger(JwtVendor.class);
@@ -42,7 +41,6 @@ public class JwtVendor {
4241
private final JsonWebKey signingKey;
4342
private final JoseJwtProducer jwtProducer;
4443
private final LongSupplier timeProvider;
45-
private final Boolean bwcModeEnabled;
4644
private final EncryptionDecryptionUtil encryptionDecryptionUtil;
4745

4846
public JwtVendor(final Settings settings, final Optional<LongSupplier> timeProvider) {
@@ -64,12 +62,6 @@ public JwtVendor(final Settings settings, final Optional<LongSupplier> timeProvi
6462
} else {
6563
this.timeProvider = () -> System.currentTimeMillis() / 1000;
6664
}
67-
// CS-SUPPRESS-SINGLE: RegexpSingleline get Extensions Settings
68-
this.bwcModeEnabled = settings.getAsBoolean(
69-
ConfigConstants.EXTENSIONS_BWC_PLUGIN_MODE,
70-
ConfigConstants.EXTENSIONS_BWC_PLUGIN_MODE_DEFAULT
71-
);
72-
// CS-ENFORCE-SINGLE
7365
}
7466

7567
/*
@@ -114,7 +106,8 @@ public String createJwt(
114106
String audience,
115107
Integer expirySeconds,
116108
List<String> roles,
117-
List<String> backendRoles
109+
List<String> backendRoles,
110+
Boolean roleSecruityMode
118111
) throws Exception {
119112
final long nowAsMillis = timeProvider.getAsLong();
120113
final Instant nowAsInstant = Instant.ofEpochMilli(timeProvider.getAsLong());
@@ -147,7 +140,7 @@ public String createJwt(
147140
throw new Exception("Roles cannot be null");
148141
}
149142

150-
if (bwcModeEnabled && backendRoles != null) {
143+
if (roleSecruityMode && backendRoles != null) {
151144
String listOfBackendRoles = String.join(",", backendRoles);
152145
jwtClaims.setProperty("br", listOfBackendRoles);
153146
}

‎src/test/java/org/opensearch/security/authtoken/jwt/JwtVendorTest.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public void testCreateJwtWithRoles() throws Exception {
6767
Long expectedExp = currentTime.getAsLong() + expirySeconds;
6868

6969
JwtVendor jwtVendor = new JwtVendor(settings, Optional.of(currentTime));
70-
String encodedJwt = jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, backendRoles);
70+
String encodedJwt = jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, backendRoles, false);
7171

7272
JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(encodedJwt);
7373
JwtToken jwt = jwtConsumer.getJwtToken();
@@ -84,7 +84,7 @@ public void testCreateJwtWithRoles() throws Exception {
8484
}
8585

8686
@Test
87-
public void testCreateJwtWithBackwardsCompatibilityMode() throws Exception {
87+
public void testCreateJwtWithRoleSecurityMode() throws Exception {
8888
String issuer = "cluster_0";
8989
String subject = "admin";
9090
String audience = "audience_0";
@@ -104,7 +104,7 @@ public void testCreateJwtWithBackwardsCompatibilityMode() throws Exception {
104104
Long expectedExp = currentTime.getAsLong() + expirySeconds;
105105

106106
JwtVendor jwtVendor = new JwtVendor(settings, Optional.of(currentTime));
107-
String encodedJwt = jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, backendRoles);
107+
String encodedJwt = jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, backendRoles, true);
108108

109109
JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(encodedJwt);
110110
JwtToken jwt = jwtConsumer.getJwtToken();
@@ -134,7 +134,7 @@ public void testCreateJwtWithBadExpiry() {
134134

135135
Throwable exception = Assert.assertThrows(RuntimeException.class, () -> {
136136
try {
137-
jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, List.of());
137+
jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, List.of(), false);
138138
} catch (Exception e) {
139139
throw new RuntimeException(e);
140140
}
@@ -154,7 +154,7 @@ public void testCreateJwtWithBadEncryptionKey() {
154154

155155
Throwable exception = Assert.assertThrows(RuntimeException.class, () -> {
156156
try {
157-
new JwtVendor(settings, Optional.empty()).createJwt(issuer, subject, audience, expirySeconds, roles, List.of());
157+
new JwtVendor(settings, Optional.empty()).createJwt(issuer, subject, audience, expirySeconds, roles, List.of(), false);
158158
} catch (Exception e) {
159159
throw new RuntimeException(e);
160160
}
@@ -175,7 +175,7 @@ public void testCreateJwtWithBadRoles() {
175175

176176
Throwable exception = Assert.assertThrows(RuntimeException.class, () -> {
177177
try {
178-
jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, List.of());
178+
jwtVendor.createJwt(issuer, subject, audience, expirySeconds, roles, List.of(), false);
179179
} catch (Exception e) {
180180
throw new RuntimeException(e);
181181
}

0 commit comments

Comments
 (0)