|
| 1 | +/* |
| 2 | + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one |
| 3 | + * or more contributor license agreements. Licensed under the Elastic License; |
| 4 | + * you may not use this file except in compliance with the Elastic License. |
| 5 | + */ |
| 6 | + |
| 7 | +package org.elasticsearch.integration; |
| 8 | + |
| 9 | +import org.elasticsearch.client.Request; |
| 10 | +import org.elasticsearch.common.settings.SecureString; |
| 11 | +import org.elasticsearch.xpack.core.security.authc.support.Hasher; |
| 12 | +import org.junit.Before; |
| 13 | + |
| 14 | +import java.io.IOException; |
| 15 | + |
| 16 | +public class CreateDocsIndexPrivilegeTests extends AbstractPrivilegeTestCase { |
| 17 | + private static final String INDEX_NAME = "index-1"; |
| 18 | + private static final String CREATE_DOC_USER = "create_doc_user"; |
| 19 | + private String jsonDoc = "{ \"name\" : \"elasticsearch\", \"body\": \"foo bar\" }"; |
| 20 | + private static final String ROLES = |
| 21 | + "all_indices_role:\n" + |
| 22 | + " indices:\n" + |
| 23 | + " - names: '*'\n" + |
| 24 | + " privileges: [ all ]\n" + |
| 25 | + "create_doc_role:\n" + |
| 26 | + " indices:\n" + |
| 27 | + " - names: '*'\n" + |
| 28 | + " privileges: [ create_doc ]\n"; |
| 29 | + |
| 30 | + private static final String USERS_ROLES = |
| 31 | + "all_indices_role:admin\n" + |
| 32 | + "create_doc_role:" + CREATE_DOC_USER + "\n"; |
| 33 | + |
| 34 | + @Override |
| 35 | + protected boolean addMockHttpTransport() { |
| 36 | + return false; // enable http |
| 37 | + } |
| 38 | + |
| 39 | + @Override |
| 40 | + protected String configRoles() { |
| 41 | + return super.configRoles() + "\n" + ROLES; |
| 42 | + } |
| 43 | + |
| 44 | + @Override |
| 45 | + protected String configUsers() { |
| 46 | + final String usersPasswdHashed = new String(Hasher.resolve( |
| 47 | + randomFrom("pbkdf2", "pbkdf2_1000", "bcrypt", "bcrypt9")).hash(new SecureString("passwd".toCharArray()))); |
| 48 | + |
| 49 | + return super.configUsers() + |
| 50 | + "admin:" + usersPasswdHashed + "\n" + |
| 51 | + CREATE_DOC_USER + ":" + usersPasswdHashed + "\n"; |
| 52 | + } |
| 53 | + |
| 54 | + @Override |
| 55 | + protected String configUsersRoles() { |
| 56 | + return super.configUsersRoles() + USERS_ROLES; |
| 57 | + } |
| 58 | + |
| 59 | + @Before |
| 60 | + public void insertBaseDocumentsAsAdmin() throws Exception { |
| 61 | + Request request = new Request("PUT", "/" + INDEX_NAME + "/_doc/1"); |
| 62 | + request.setJsonEntity(jsonDoc); |
| 63 | + request.addParameter("refresh", "true"); |
| 64 | + assertAccessIsAllowed("admin", request); |
| 65 | + } |
| 66 | + |
| 67 | + public void testCreateDocUserCanIndexNewDocumentsWithAutoGeneratedId() throws IOException { |
| 68 | + assertAccessIsAllowed(CREATE_DOC_USER, "POST", "/" + INDEX_NAME + "/_doc", "{ \"foo\" : \"bar\" }"); |
| 69 | + } |
| 70 | + |
| 71 | + public void testCreateDocUserCanIndexNewDocumentsWithExternalIdAndOpTypeIsCreate() throws IOException { |
| 72 | + assertAccessIsAllowed(CREATE_DOC_USER, randomFrom("PUT", "POST"), "/" + INDEX_NAME + "/_doc/2?op_type=create", "{ \"foo\" : " + |
| 73 | + "\"bar\" }"); |
| 74 | + } |
| 75 | + |
| 76 | + public void testCreateDocUserIsDeniedToIndexNewDocumentsWithExternalIdAndOpTypeIsIndex() throws IOException { |
| 77 | + assertAccessIsDenied(CREATE_DOC_USER, randomFrom("PUT", "POST"), "/" + INDEX_NAME + "/_doc/3", "{ \"foo\" : \"bar\" }"); |
| 78 | + } |
| 79 | + |
| 80 | + public void testCreateDocUserIsDeniedToIndexUpdatesToExistingDocument() throws IOException { |
| 81 | + assertAccessIsDenied(CREATE_DOC_USER, "POST", "/" + INDEX_NAME + "/_doc/1/_update", "{ \"doc\" : { \"foo\" : \"baz\" } }"); |
| 82 | + assertAccessIsDenied(CREATE_DOC_USER, "PUT", "/" + INDEX_NAME + "/_doc/1", "{ \"foo\" : \"baz\" }"); |
| 83 | + } |
| 84 | + |
| 85 | + public void testCreateDocUserCanIndexNewDocumentsWithAutoGeneratedIdUsingBulkApi() throws IOException { |
| 86 | + assertAccessIsAllowed(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 87 | + "/" + INDEX_NAME + "/_bulk", "{ \"index\" : { } }\n{ \"foo\" : \"bar\" }\n"); |
| 88 | + } |
| 89 | + |
| 90 | + public void testCreateDocUserCanIndexNewDocumentsWithAutoGeneratedIdAndOpTypeCreateUsingBulkApi() throws IOException { |
| 91 | + assertAccessIsAllowed(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 92 | + "/" + INDEX_NAME + "/_bulk", "{ \"create\" : { } }\n{ \"foo\" : \"bar\" }\n"); |
| 93 | + } |
| 94 | + |
| 95 | + public void testCreateDocUserCanIndexNewDocumentsWithExternalIdAndOpTypeIsCreateUsingBulkApi() throws IOException { |
| 96 | + assertAccessIsAllowed(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 97 | + "/" + INDEX_NAME + "/_bulk", "{ \"create\" : { \"_id\" : \"4\" } }\n{ \"foo\" : \"bar\" }\n"); |
| 98 | + } |
| 99 | + |
| 100 | + public void testCreateDocUserIsDeniedToIndexNewDocumentsWithExternalIdAndOpTypeIsIndexUsingBulkApi() throws IOException { |
| 101 | + assertBodyHasAccessIsDenied(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 102 | + "/" + INDEX_NAME + "/_bulk", "{ \"index\" : { \"_id\" : \"5\" } }\n{ \"foo\" : \"bar\" }\n"); |
| 103 | + } |
| 104 | + |
| 105 | + public void testCreateDocUserIsDeniedToIndexUpdatesToExistingDocumentUsingBulkApi() throws IOException { |
| 106 | + assertBodyHasAccessIsDenied(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 107 | + "/" + INDEX_NAME + "/_bulk", "{ \"index\" : { \"_id\" : \"1\" } }\n{ \"doc\" : {\"foo\" : \"bazbaz\"} }\n"); |
| 108 | + assertBodyHasAccessIsDenied(CREATE_DOC_USER, randomFrom("PUT", "POST"), |
| 109 | + "/" + INDEX_NAME + "/_bulk", "{ \"update\" : { \"_id\" : \"1\" } }\n{ \"doc\" : {\"foo\" : \"bazbaz\"} }\n"); |
| 110 | + } |
| 111 | + |
| 112 | +} |
0 commit comments