diff --git a/CHANGELOG.md b/CHANGELOG.md index 304a71de72..d00370b5d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Optimize getFieldFilter to only return a predicate when index has FLS restrictions for user ([#5777](https://github.com/opensearch-project/security/pull/5777)) - Performance optimizations for building internal authorization data structures upon config updates ([#5988](https://github.com/opensearch-project/security/pull/5988)) - Make encryption_key optional for obo token authenticator ([#6017](https://github.com/opensearch-project/security/pull/6017) +- [Resource Sharing] Using custom action prefixes for sample resource plugin ([#6020](https://github.com/opensearch-project/security/pull/6020) - Enable basic authentication for gRPC transport ([#6005](https://github.com/opensearch-project/security/pull/6005)) - Allow specifying parentType and parentIdField in ResourceProvider ([#5735](https://github.com/opensearch-project/security/pull/5735)) - [Resource Sharing] Allow specifying default access level in resource access levels yml file ([#6018](https://github.com/opensearch-project/security/pull/6018)) diff --git a/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java b/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java index 9c470a841b..862a5a1ef8 100644 --- a/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java +++ b/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java @@ -65,10 +65,9 @@ public final class TestUtils { "resource_sharing_test_user_Limited_Perms" ).roles( new TestSecurityConfig.Role("shared_role_limited_perms").clusterPermissions( - "cluster:admin/sample-resource-plugin/get", - "cluster:admin/sample-resource-plugin/search", - "cluster:admin/sample-resource-plugin/create", - "cluster:admin/security/resource/share", + "sampleresource:get", + "sampleresource:search", + "sampleresource:create", "cluster:admin/security/resource/share" ).indexPermissions("indices:data/read*").on(RESOURCE_INDEX_NAME) ); diff --git a/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DryRunAccessTests.java b/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DryRunAccessTests.java index 3fa0b94af7..dcc5f54b4b 100644 --- a/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DryRunAccessTests.java +++ b/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DryRunAccessTests.java @@ -100,12 +100,12 @@ public void testDryRunAccess() throws Exception { HttpResponse resp = client.putJson(SAMPLE_RESOURCE_CREATE_ENDPOINT + "?perform_permission_check=true", sample); resp.assertStatusCode(HttpStatus.SC_OK); assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false)); - assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/create"))); + assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:create"))); resp = client.get(SAMPLE_RESOURCE_GET_ENDPOINT + "/" + adminResId + "?perform_permission_check=true"); resp.assertStatusCode(HttpStatus.SC_OK); assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false)); - assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/get"))); + assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:get"))); } // share resource at readonly level with no_access_user @@ -123,7 +123,7 @@ public void testDryRunAccess() throws Exception { resp = client.postJson(SAMPLE_RESOURCE_UPDATE_ENDPOINT + "/" + adminResId + "?perform_permission_check=true", updatePayload); resp.assertStatusCode(HttpStatus.SC_OK); assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false)); - assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/update"))); + assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:update"))); // cannot share resource resp = client.putJson( @@ -148,7 +148,7 @@ public void testDryRunAccess() throws Exception { resp = client.delete(SAMPLE_RESOURCE_DELETE_ENDPOINT + "/" + adminResId + "?perform_permission_check=true"); resp.assertStatusCode(HttpStatus.SC_OK); assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false)); - assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/delete"))); + assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:delete"))); } // share resource at full-access level with no_access_user diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/CreateResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/CreateResourceAction.java index 3e73b95f79..53da66edd0 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/CreateResourceAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/CreateResourceAction.java @@ -21,7 +21,7 @@ public class CreateResourceAction extends ActionType { /** * Create sample resource action name */ - public static final String NAME = "cluster:admin/sample-resource-plugin/create"; + public static final String NAME = "sampleresource:create"; private CreateResourceAction() { super(NAME, CreateResourceResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/UpdateResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/UpdateResourceAction.java index ec5f84adfb..b30b77b026 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/UpdateResourceAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/UpdateResourceAction.java @@ -21,7 +21,7 @@ public class UpdateResourceAction extends ActionType { /** * Update sample resource action name */ - public static final String NAME = "cluster:admin/sample-resource-plugin/update"; + public static final String NAME = "sampleresource:update"; private UpdateResourceAction() { super(NAME, CreateResourceResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/delete/DeleteResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/delete/DeleteResourceAction.java index d7410e6388..180bcca277 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/delete/DeleteResourceAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/delete/DeleteResourceAction.java @@ -21,7 +21,7 @@ public class DeleteResourceAction extends ActionType { /** * Delete sample resource action name */ - public static final String NAME = "cluster:admin/sample-resource-plugin/delete"; + public static final String NAME = "sampleresource:delete"; private DeleteResourceAction() { super(NAME, DeleteResourceResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/get/GetResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/get/GetResourceAction.java index 0249a06501..645c295383 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/get/GetResourceAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/get/GetResourceAction.java @@ -21,7 +21,7 @@ public class GetResourceAction extends ActionType { /** * Get sample resource action name */ - public static final String NAME = "cluster:admin/sample-resource-plugin/get"; + public static final String NAME = "sampleresource:get"; private GetResourceAction() { super(NAME, GetResourceResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/search/SearchResourceAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/search/SearchResourceAction.java index ef139938a8..407e99e3ab 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/search/SearchResourceAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/search/SearchResourceAction.java @@ -18,7 +18,7 @@ public class SearchResourceAction extends ActionType { public static final SearchResourceAction INSTANCE = new SearchResourceAction(); - public static final String NAME = "cluster:admin/sample-resource-plugin/search"; + public static final String NAME = "sampleresource:search"; private SearchResourceAction() { super(NAME, SearchResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/CreateResourceGroupAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/CreateResourceGroupAction.java index a5eba1cea5..7ec8a8ab33 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/CreateResourceGroupAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/CreateResourceGroupAction.java @@ -21,7 +21,7 @@ public class CreateResourceGroupAction extends ActionType /** * Get sample resource group action name */ - public static final String NAME = "cluster:admin/sample-resource-plugin/group/get"; + public static final String NAME = "sampleresourcegroup:get"; private GetResourceGroupAction() { super(NAME, GetResourceGroupResponse::new); diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/search/SearchResourceGroupAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/search/SearchResourceGroupAction.java index 8b0a2c6b37..66f4b54a01 100644 --- a/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/search/SearchResourceGroupAction.java +++ b/sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/search/SearchResourceGroupAction.java @@ -18,7 +18,7 @@ public class SearchResourceGroupAction extends ActionType { public static final SearchResourceGroupAction INSTANCE = new SearchResourceGroupAction(); - public static final String NAME = "cluster:admin/sample-resource-plugin/group/search"; + public static final String NAME = "sampleresourcegroup:search"; private SearchResourceGroupAction() { super(NAME, SearchResponse::new); diff --git a/sample-resource-plugin/src/main/resources/resource-access-levels.yml b/sample-resource-plugin/src/main/resources/resource-access-levels.yml index 656c1a27da..c3d7af2c66 100644 --- a/sample-resource-plugin/src/main/resources/resource-access-levels.yml +++ b/sample-resource-plugin/src/main/resources/resource-access-levels.yml @@ -3,32 +3,37 @@ resource_types: sample_read_only: default: true allowed_actions: - - "cluster:admin/sample-resource-plugin/get" + - "sampleresource:get" sample_read_write: allowed_actions: - - "cluster:admin/sample-resource-plugin/*" + - "sampleresource:*" sample_full_access: allowed_actions: - - "cluster:admin/sample-resource-plugin/*" + - "sampleresource:*" - "cluster:admin/security/resource/share" sample-resource-group: sample_group_read_only: default: true allowed_actions: - - "cluster:admin/sample-resource-plugin/group/get" # TODO: can sample-resource access levels be referenced here? i.e. sample_read_only - - "cluster:admin/sample-resource-plugin/get" + - "sampleresourcegroup:get" + # group read-only also grants read on child resources + - "sampleresource:get" + - "sampleresource:search" sample_group_read_write: allowed_actions: - - "cluster:admin/sample-resource-plugin/group/*" - - "cluster:admin/sample-resource-plugin/*" + - "sampleresourcegroup:*" + # group read-write also grants read/write on child resources + - "sampleresource:get" + - "sampleresource:search" + - "sampleresource:update" sample_group_full_access: allowed_actions: - - "cluster:admin/sample-resource-plugin/group/*" - - "cluster:admin/sample-resource-plugin/*" - - "cluster:admin/security/resource/group/share" + - "sampleresourcegroup:*" + # group full-access grants full access on child resources + - "sampleresource:*" - "cluster:admin/security/resource/share" diff --git a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluatorImpl.java b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluatorImpl.java index e05695ed70..b14c5aeff3 100644 --- a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluatorImpl.java +++ b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluatorImpl.java @@ -599,7 +599,8 @@ public static boolean isClusterPerm(String action0) { || (action0.startsWith(MultiSearchAction.NAME)) || (action0.equals(MultiTermVectorsAction.NAME)) || (action0.equals(ReindexAction.NAME)) - || (action0.equals(RenderSearchTemplateAction.NAME))); + || (action0.equals(RenderSearchTemplateAction.NAME)) + || !action0.startsWith("indices:")); } private boolean checkFilteredAliases(Resolved requestedResolved, String action, boolean isDebugEnabled) {