Skip to content

5990: Fix security plugin issue #20822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Deepti24 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

5990: Fix security plugin issue #20822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
25fdcdc
5990: Fix security plugin issue
dchauhan3-blip Mar 10, 2026
b06469a
5990: Fix checkstyle
Deepti24 Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion server/src/main/java/org/opensearch/action/ActionModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -500,6 +500,7 @@
import org.opensearch.rest.action.search.RestSearchAction;
import org.opensearch.rest.action.search.RestSearchScrollAction;
import org.opensearch.tasks.Task;
import org.opensearch.telemetry.tracing.TracerContextStorage;
import org.opensearch.threadpool.ThreadPool;
import org.opensearch.transport.client.node.NodeClient;
import org.opensearch.usage.UsageService;
Expand Down Expand Up @@ -594,9 +595,13 @@ public ActionModule(
new RestHeaderDefinition(WorkloadGroupTask.WORKLOAD_GROUP_ID_HEADER, false)
)
).collect(Collectors.toSet());
Set<String> transients = Stream.concat(
actionPlugins.stream().flatMap(p -> p.getTransients().stream()),
Stream.of(TracerContextStorage.CURRENT_SPAN)
).collect(Collectors.toSet());
UnaryOperator<RestHandler> restWrapper = null;
for (ActionPlugin plugin : actionPlugins) {
UnaryOperator<RestHandler> newRestWrapper = plugin.getRestHandlerWrapper(threadPool.getThreadContext(), headers);
UnaryOperator<RestHandler> newRestWrapper = plugin.getRestHandlerWrapper(threadPool.getThreadContext(), headers, transients);

@reta reta Mar 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Deepti24 this change is unclear to me: the span, if propagated, should be set in thread context (transient headers), there should be no custom logic involved (ideally) to carry it forward

@Deepti24 Deepti24 Mar 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @reta , @cwperks has opened a separate PR to fix this issue in thread propagation itself : https://github.com/cwperks/OpenSearch/pull/345/changes
I think that would be smaller fix for this

But to explain the issue, there is a bug in security plugin (due to how restore and stash Context work).
So I tried to follow the pattern of how headersToCopy are used, tried doing same for transientsToCopy. Then would use that in security plugin as mentioned below:
https://github.com/opensearch-project/security/pull/6000/changes
But yes, ideally we should follow the pattern you mentioned.

@cwperks cwperks Mar 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@reta there's a bug on the restore path described here: #20822 (comment)

The transient headers are correctly propagating from parent tc -> stashed tc, but not from stashed tc -> restored parent tc.

if (newRestWrapper != null) {
logger.debug("Using REST wrapper from plugin " + plugin.getClass().getName());
if (restWrapper != null) {
Expand Down
16 changes: 16 additions & 0 deletions server/src/main/java/org/opensearch/plugins/ActionPlugin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,13 @@ default Collection<RestHeaderDefinition> getRestHeaders() {
return Collections.emptyList();
}

/**
* Returns transients which should be copied through context propagation
*/
default Collection<String> getTransients() {
return Collections.emptyList();
}

/**
* Returns headers which should be copied from internal requests into tasks.
*/
Expand Down Expand Up @@ -149,6 +156,15 @@ default Collection<String> getTaskHeaders() {
*
* Note: Only one installed plugin may implement a rest wrapper.
*/
default UnaryOperator<RestHandler> getRestHandlerWrapper(
ThreadContext threadContext,
Set<RestHeaderDefinition> headersToCopy,
Set<String> transients
) {
return this.getRestHandlerWrapper(threadContext);
}

@Deprecated(forRemoval = true)
default UnaryOperator<RestHandler> getRestHandlerWrapper(ThreadContext threadContext, Set<RestHeaderDefinition> headersToCopy) {
return this.getRestHandlerWrapper(threadContext);
}
Expand Down
2 changes: 1 addition & 1 deletion ...rc/main/java/org/opensearch/telemetry/tracing/ThreadContextBasedTracerContextStorage.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ public Map<String, Object> transients(Map<String, Object> source) {
final Map<String, Object> transients = new HashMap<>();
if (source.containsKey(CURRENT_SPAN)) {
final SpanReference current = (SpanReference) source.get(CURRENT_SPAN);
if (current != null) {
if (current != null && current.getSpan() != null) {
transients.put(CURRENT_SPAN, new SpanReference(current.getSpan()));
}
}
Expand Down
59 changes: 59 additions & 0 deletions server/src/test/java/org/opensearch/action/ActionModuleTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,11 +53,13 @@
import org.opensearch.rest.RestChannel;
import org.opensearch.rest.RestController;
import org.opensearch.rest.RestHandler;
import org.opensearch.rest.RestHeaderDefinition;
import org.opensearch.rest.RestRequest;
import org.opensearch.rest.RestRequest.Method;
import org.opensearch.rest.action.RestMainAction;
import org.opensearch.tasks.Task;
import org.opensearch.tasks.TaskManager;
import org.opensearch.telemetry.tracing.TracerContextStorage;
import org.opensearch.test.OpenSearchTestCase;
import org.opensearch.threadpool.TestThreadPool;
import org.opensearch.threadpool.ThreadPool;
Expand All @@ -66,9 +68,11 @@

import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Set;
import java.util.function.Supplier;
import java.util.function.UnaryOperator;

import static java.util.Collections.emptyList;
import static java.util.Collections.singletonList;
Expand Down Expand Up @@ -274,4 +278,59 @@ public List<Route> routes() {
threadPool.shutdown();
}
}

public void testTransientsCollectedFromPluginsAndCore() {

ThreadPool threadPool = new TestThreadPool("test");
try {
// Create a plugin that tracks what transients it receives
final Set<String>[] receivedTransients = new Set[1];
ActionPlugin testPlugin = new ActionPlugin() {
@Override
public Collection<String> getTransients() {
return List.of("custom_transient");
}

@Override
public UnaryOperator<RestHandler> getRestHandlerWrapper(
ThreadContext threadContext,
Set<RestHeaderDefinition> headersToCopy,
Set<String> transients
) {
// Capture the transients passed to this method
receivedTransients[0] = transients;
return handler -> handler;
}
};
List<ActionPlugin> plugins = List.of(testPlugin);

SettingsModule settings = new SettingsModule(Settings.EMPTY);
UsageService usageService = new UsageService();
ActionModule actionModule = new ActionModule(
settings.getSettings(),
new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
settings.getIndexScopedSettings(),
settings.getClusterSettings(),
settings.getSettingsFilter(),
threadPool,
plugins,
null,
null,
usageService,
null,
new IdentityService(Settings.EMPTY, mock(ThreadPool.class), new ArrayList<>()),
new ExtensionsManager(Set.of(), new IdentityService(Settings.EMPTY, mock(ThreadPool.class), List.of()))
);

// Verify transients were passed to the plugin
assertNotNull("Plugin should have received transients", receivedTransients[0]);
assertTrue("Should contain custom transient from plugin", receivedTransients[0].contains("custom_transient"));
assertTrue("Should contain core CURRENT_SPAN", receivedTransients[0].contains(TracerContextStorage.CURRENT_SPAN));
} catch (IOException e) {
throw new RuntimeException(e);
} finally {
threadPool.shutdown();
}
}

}
10 changes: 10 additions & 0 deletions ...st/java/org/opensearch/telemetry/tracing/ThreadContextBasedTracerContextStorageTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
import org.junit.After;
import org.junit.Before;

import java.util.HashMap;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.ExecutionException;
Expand Down Expand Up @@ -269,4 +271,12 @@ public void testSpanNotPropagatedToChildSystemThreadContext() {
assertThat(threadContext.getTransient(ThreadContextBasedTracerContextStorage.CURRENT_SPAN), is(not(nullValue())));
assertThat(threadContextStorage.get(ThreadContextBasedTracerContextStorage.CURRENT_SPAN), is(nullValue()));
}

public void testNullSpanWithinSpanReference() {
SpanReference spanReference = new SpanReference(null);
Map<String, Object> source = new HashMap<>();
source.put(ThreadContextBasedTracerContextStorage.CURRENT_SPAN, spanReference);
ThreadContextBasedTracerContextStorage context = (ThreadContextBasedTracerContextStorage) threadContextStorage;
assertTrue(context.transients(source).isEmpty());
}
}
Loading