Skip to content

Commit 3e09876

Browse files
rjernstrjernst
committed
Convert token service license object to LicensedFeature (elastic#79284)
This commit moves the token service license checks to use the new LicensedFeature class.
1 parent 1df96c5 commit 3e09876

File tree

13 files changed

+62
-178
lines changed

13 files changed

+62
-178
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ public class XPackLicenseState {
4141
* Each value defines the licensed state necessary for the feature to be allowed.
4242
*/
4343
public enum Feature {
44-
SECURITY_AUDITING(OperationMode.GOLD, false),
45-
SECURITY_TOKEN_SERVICE(OperationMode.STANDARD, false),
4644

4745
MACHINE_LEARNING(OperationMode.PLATINUM, true),
4846

‎x-pack/plugin/core/src/test/java/org/elasticsearch/license/XPackLicenseStateTests.java‎

Lines changed: 0 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
import org.elasticsearch.common.settings.Settings;
1010
import org.elasticsearch.common.util.iterable.Iterables;
1111
import org.elasticsearch.license.License.OperationMode;
12-
import org.elasticsearch.license.XPackLicenseState.Feature;
1312
import org.elasticsearch.test.ESTestCase;
1413
import org.elasticsearch.xpack.core.XPackField;
1514
import org.elasticsearch.xpack.core.XPackSettings;
@@ -88,122 +87,6 @@ public static OperationMode randomBasicStandardOrGold() {
8887
return randomFrom(BASIC, STANDARD, GOLD);
8988
}
9089

91-
public void testSecurityDefaults() {
92-
Settings settings = Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build();
93-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
94-
assertThat(licenseState.isSecurityEnabled(), is(true));
95-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(true));
96-
97-
licenseState = TestUtils.newTestLicenseState();
98-
assertSecurityNotAllowed(licenseState);
99-
}
100-
101-
public void testTransportSslDoesNotAutomaticallyEnableSecurityOnTrialLicense() {
102-
Settings settings = Settings.builder().put(XPackSettings.TRANSPORT_SSL_ENABLED.getKey(), true).build();
103-
final XPackLicenseState licenseState= new XPackLicenseState(settings, () -> 0);
104-
assertSecurityNotAllowed(licenseState);
105-
}
106-
107-
public void testSecurityBasicWithoutExplicitSecurityEnabled() {
108-
XPackLicenseState licenseState = TestUtils.newTestLicenseState();
109-
licenseState.update(BASIC, true, null);
110-
111-
assertThat(licenseState.isSecurityEnabled(), is(false));
112-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(false));
113-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(false));
114-
115-
assertThat(licenseState.isSecurityEnabled(), is(false));
116-
}
117-
118-
public void testSecurityBasicWithExplicitSecurityEnabled() {
119-
final Settings settings = Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build();
120-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
121-
licenseState.update(BASIC, true, null);
122-
assertThat(licenseState.isSecurityEnabled(), is(true));
123-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(false));
124-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(false));
125-
126-
assertThat(licenseState.isSecurityEnabled(), is(true));
127-
}
128-
129-
public void testSecurityStandard() {
130-
Settings settings = randomFrom(Settings.EMPTY,
131-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
132-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
133-
licenseState.update(STANDARD, true, null);
134-
135-
assertThat(licenseState.isSecurityEnabled(), is(true));
136-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(false));
137-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
138-
}
139-
140-
public void testSecurityStandardExpired() {
141-
Settings settings = randomFrom(Settings.EMPTY,
142-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
143-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
144-
licenseState.update(STANDARD, false, null);
145-
146-
assertThat(licenseState.isSecurityEnabled(), is(true));
147-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(false));
148-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
149-
}
150-
151-
public void testSecurityGold() {
152-
Settings settings = randomFrom(Settings.EMPTY,
153-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
154-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
155-
licenseState.update(GOLD, true, null);
156-
157-
assertThat(licenseState.isSecurityEnabled(), is(true));
158-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(true));
159-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
160-
}
161-
162-
public void testSecurityGoldExpired() {
163-
Settings settings = randomFrom(Settings.EMPTY,
164-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
165-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
166-
licenseState.update(GOLD, false, null);
167-
168-
assertThat(licenseState.isSecurityEnabled(), is(true));
169-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(true));
170-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
171-
}
172-
173-
public void testSecurityPlatinum() {
174-
Settings settings = randomFrom(Settings.EMPTY,
175-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
176-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
177-
licenseState.update(PLATINUM, true, null);
178-
179-
assertThat(licenseState.isSecurityEnabled(), is(true));
180-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(true));
181-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
182-
}
183-
184-
public void testSecurityPlatinumExpired() {
185-
Settings settings = randomFrom(Settings.EMPTY,
186-
Settings.builder().put(XPackSettings.SECURITY_ENABLED.getKey(), true).build());
187-
XPackLicenseState licenseState = new XPackLicenseState(settings, () -> 0);
188-
licenseState.update(PLATINUM, false, null);
189-
190-
assertThat(licenseState.isSecurityEnabled(), is(true));
191-
assertThat(licenseState.checkFeature(Feature.SECURITY_AUDITING), is(true));
192-
assertThat(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE), is(true));
193-
}
194-
195-
public void testNewTrialDefaultsSecurityOff() {
196-
XPackLicenseState licenseState = TestUtils.newTestLicenseState();
197-
licenseState.update(TRIAL, true, null);
198-
199-
assertThat(licenseState.isSecurityEnabled(), is(false));
200-
assertSecurityNotAllowed(licenseState);
201-
}
202-
203-
private void assertSecurityNotAllowed(XPackLicenseState licenseState) {
204-
assertThat(licenseState.isSecurityEnabled(), is(false));
205-
}
206-
20790
public void testSecurityAckBasicToNotGoldOrStandard() {
20891
OperationMode toMode = randomFrom(OperationMode.values(), mode -> mode != GOLD && mode != STANDARD);
20992
assertAckMessages(XPackField.SECURITY, BASIC, toMode, 0);

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,6 @@
4343
import org.elasticsearch.common.util.concurrent.EsExecutors;
4444
import org.elasticsearch.common.util.concurrent.ThreadContext;
4545
import org.elasticsearch.common.util.set.Sets;
46-
import org.elasticsearch.xcontent.NamedXContentRegistry;
47-
import org.elasticsearch.xcontent.XContentBuilder;
4846
import org.elasticsearch.env.Environment;
4947
import org.elasticsearch.env.NodeEnvironment;
5048
import org.elasticsearch.http.HttpServerTransport;
@@ -82,6 +80,8 @@
8280
import org.elasticsearch.transport.TransportRequestHandler;
8381
import org.elasticsearch.transport.nio.NioGroupFactory;
8482
import org.elasticsearch.watcher.ResourceWatcherService;
83+
import org.elasticsearch.xcontent.NamedXContentRegistry;
84+
import org.elasticsearch.xcontent.XContentBuilder;
8585
import org.elasticsearch.xpack.core.XPackField;
8686
import org.elasticsearch.xpack.core.XPackPlugin;
8787
import org.elasticsearch.xpack.core.XPackSettings;
@@ -228,8 +228,8 @@
228228
import org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener;
229229
import org.elasticsearch.xpack.security.authz.accesscontrol.OptOutQueryCache;
230230
import org.elasticsearch.xpack.security.authz.interceptor.BulkShardRequestInterceptor;
231-
import org.elasticsearch.xpack.security.authz.interceptor.IndicesAliasesRequestInterceptor;
232231
import org.elasticsearch.xpack.security.authz.interceptor.DlsFlsLicenseRequestInterceptor;
232+
import org.elasticsearch.xpack.security.authz.interceptor.IndicesAliasesRequestInterceptor;
233233
import org.elasticsearch.xpack.security.authz.interceptor.RequestInterceptor;
234234
import org.elasticsearch.xpack.security.authz.interceptor.ResizeRequestInterceptor;
235235
import org.elasticsearch.xpack.security.authz.interceptor.SearchRequestInterceptor;
@@ -351,7 +351,9 @@ public class Security extends Plugin implements SystemIndexPlugin, IngestPlugin,
351351
public static final LicensedFeature.Momentary IP_FILTERING_FEATURE =
352352
LicensedFeature.momentaryLenient(null, "security_ip_filtering", License.OperationMode.GOLD);
353353
public static final LicensedFeature.Momentary AUDITING_FEATURE =
354-
LicensedFeature.momentaryLenient(null, "security_auditing", License.OperationMode.GOLD);
354+
LicensedFeature.momentaryLenient(null, "security-auditing", License.OperationMode.GOLD);
355+
public static final LicensedFeature.Momentary TOKEN_SERVICE_FEATURE =
356+
LicensedFeature.momentaryLenient(null, "security-token-service", License.OperationMode.STANDARD);
355357

356358
private static final String REALMS_FEATURE_FAMILY = "security-realms";
357359
// Builtin realms (file/native) realms are Basic licensed, so don't need to be checked or tracked
@@ -629,7 +631,7 @@ Collection<Object> createComponents(Client client, ThreadPool threadPool, Cluste
629631
);
630632
final CompositeRolesStore allRolesStore = new CompositeRolesStore(settings, roleProviders,
631633
privilegeStore, threadPool.getThreadContext(), getLicenseState(), fieldPermissionsCache, apiKeyService,
632-
serviceAccountService, dlsBitsetCache.get(),
634+
serviceAccountService, dlsBitsetCache.get(),
633635
new DeprecationRoleDescriptorConsumer(clusterService, threadPool));
634636
securityIndex.get().addStateListener(allRolesStore::onSecurityIndexStateChange);
635637

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@
9393
import org.elasticsearch.xpack.core.security.authc.TokenMetadata;
9494
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
9595
import org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult;
96+
import org.elasticsearch.xpack.security.Security;
9697
import org.elasticsearch.xpack.security.support.FeatureNotEnabledException;
9798
import org.elasticsearch.xpack.security.support.FeatureNotEnabledException.Feature;
9899
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
@@ -1591,12 +1592,12 @@ private static String getTokenIdFromDocumentId(String docId) {
15911592

15921593
private boolean isEnabled() {
15931594
return enabled && licenseState.isSecurityEnabled() &&
1594-
licenseState.checkFeature(XPackLicenseState.Feature.SECURITY_TOKEN_SERVICE);
1595+
Security.TOKEN_SERVICE_FEATURE.check(licenseState);
15951596
}
15961597

15971598
private void ensureEnabled() {
15981599
if (licenseState.isSecurityEnabled() == false ||
1599-
licenseState.checkFeature(XPackLicenseState.Feature.SECURITY_TOKEN_SERVICE) == false) {
1600+
Security.TOKEN_SERVICE_FEATURE.check(licenseState) == false) {
16001601
throw LicenseUtils.newComplianceException("security tokens");
16011602
}
16021603
if (enabled == false) {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/action/oauth2/TokenBaseRestHandler.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
import org.elasticsearch.common.settings.Settings;
1313
import org.elasticsearch.license.LicenseUtils;
1414
import org.elasticsearch.license.XPackLicenseState;
15-
import org.elasticsearch.license.XPackLicenseState.Feature;
1615
import org.elasticsearch.rest.RestRequest;
16+
import org.elasticsearch.xpack.security.Security;
1717
import org.elasticsearch.xpack.security.rest.action.SecurityBaseRestHandler;
1818

1919
/**
@@ -32,7 +32,7 @@ protected Exception checkFeatureAvailable(RestRequest request) {
3232
Exception failedFeature = super.checkFeatureAvailable(request);
3333
if (failedFeature != null) {
3434
return failedFeature;
35-
} else if (licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE)) {
35+
} else if (Security.TOKEN_SERVICE_FEATURE.check(licenseState)) {
3636
return null;
3737
} else {
3838
logger.info("Security tokens are not available under the current [{}] license", licenseState.getOperationMode().description());

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/oidc/TransportOpenIdConnectLogoutActionTests.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
package org.elasticsearch.xpack.security.action.oidc;
88

99
import com.nimbusds.jwt.JWT;
10+
1011
import org.elasticsearch.action.ActionListener;
1112
import org.elasticsearch.action.bulk.BulkAction;
1213
import org.elasticsearch.action.bulk.BulkItemResponse;
@@ -32,8 +33,7 @@
3233
import org.elasticsearch.env.Environment;
3334
import org.elasticsearch.env.TestEnvironment;
3435
import org.elasticsearch.index.shard.ShardId;
35-
import org.elasticsearch.license.XPackLicenseState;
36-
import org.elasticsearch.license.XPackLicenseState.Feature;
36+
import org.elasticsearch.license.MockLicenseState;
3737
import org.elasticsearch.tasks.Task;
3838
import org.elasticsearch.test.ClusterServiceUtils;
3939
import org.elasticsearch.threadpool.ThreadPool;
@@ -47,13 +47,14 @@
4747
import org.elasticsearch.xpack.core.security.authc.Authentication;
4848
import org.elasticsearch.xpack.core.security.authc.RealmConfig;
4949
import org.elasticsearch.xpack.core.security.authc.oidc.OpenIdConnectRealmSettings;
50+
import org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper;
5051
import org.elasticsearch.xpack.core.security.user.User;
5152
import org.elasticsearch.xpack.core.ssl.SSLService;
53+
import org.elasticsearch.xpack.security.Security;
5254
import org.elasticsearch.xpack.security.authc.Realms;
5355
import org.elasticsearch.xpack.security.authc.TokenService;
5456
import org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectRealm;
5557
import org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectTestCase;
56-
import org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper;
5758
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
5859
import org.junit.After;
5960
import org.junit.Before;
@@ -181,9 +182,9 @@ public void setup() throws Exception {
181182

182183
final ClusterService clusterService = ClusterServiceUtils.createClusterService(threadPool);
183184

184-
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
185+
final MockLicenseState licenseState = mock(MockLicenseState.class);
185186
when(licenseState.isSecurityEnabled()).thenReturn(true);
186-
when(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE)).thenReturn(true);
187+
when(licenseState.isAllowed(Security.TOKEN_SERVICE_FEATURE)).thenReturn(true);
187188

188189
tokenService = new TokenService(settings, Clock.systemUTC(), client, licenseState, new SecurityContext(settings, threadContext),
189190
securityIndex, securityIndex, clusterService);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/action/saml/TransportSamlInvalidateSessionActionTests.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@
88

99
import org.apache.lucene.search.TotalHits;
1010
import org.elasticsearch.ExceptionsHelper;
11-
import org.elasticsearch.action.ActionType;
1211
import org.elasticsearch.action.ActionListener;
1312
import org.elasticsearch.action.ActionRequest;
1413
import org.elasticsearch.action.ActionResponse;
14+
import org.elasticsearch.action.ActionType;
1515
import org.elasticsearch.action.bulk.BulkAction;
1616
import org.elasticsearch.action.bulk.BulkItemResponse;
1717
import org.elasticsearch.action.bulk.BulkRequest;
@@ -35,20 +35,16 @@
3535
import org.elasticsearch.cluster.service.ClusterService;
3636
import org.elasticsearch.common.UUIDs;
3737
import org.elasticsearch.common.bytes.BytesReference;
38-
import org.elasticsearch.core.PathUtils;
3938
import org.elasticsearch.common.settings.Settings;
4039
import org.elasticsearch.common.util.concurrent.ThreadContext;
41-
import org.elasticsearch.xcontent.DeprecationHandler;
42-
import org.elasticsearch.xcontent.NamedXContentRegistry;
43-
import org.elasticsearch.xcontent.XContentType;
40+
import org.elasticsearch.core.PathUtils;
4441
import org.elasticsearch.env.Environment;
4542
import org.elasticsearch.env.TestEnvironment;
4643
import org.elasticsearch.index.query.BoolQueryBuilder;
4744
import org.elasticsearch.index.query.QueryBuilder;
4845
import org.elasticsearch.index.query.TermQueryBuilder;
4946
import org.elasticsearch.index.shard.ShardId;
50-
import org.elasticsearch.license.XPackLicenseState;
51-
import org.elasticsearch.license.XPackLicenseState.Feature;
47+
import org.elasticsearch.license.MockLicenseState;
5248
import org.elasticsearch.search.SearchHit;
5349
import org.elasticsearch.search.SearchHits;
5450
import org.elasticsearch.tasks.Task;
@@ -57,6 +53,9 @@
5753
import org.elasticsearch.threadpool.ThreadPool;
5854
import org.elasticsearch.transport.Transport;
5955
import org.elasticsearch.transport.TransportService;
56+
import org.elasticsearch.xcontent.DeprecationHandler;
57+
import org.elasticsearch.xcontent.NamedXContentRegistry;
58+
import org.elasticsearch.xcontent.XContentType;
6059
import org.elasticsearch.xpack.core.XPackSettings;
6160
import org.elasticsearch.xpack.core.security.SecurityContext;
6261
import org.elasticsearch.xpack.core.security.action.saml.SamlInvalidateSessionRequest;
@@ -68,6 +67,7 @@
6867
import org.elasticsearch.xpack.core.security.authc.esnative.NativeRealmSettings;
6968
import org.elasticsearch.xpack.core.security.authc.saml.SamlRealmSettings;
7069
import org.elasticsearch.xpack.core.security.user.User;
70+
import org.elasticsearch.xpack.security.Security;
7171
import org.elasticsearch.xpack.security.authc.Realms;
7272
import org.elasticsearch.xpack.security.authc.TokenService;
7373
import org.elasticsearch.xpack.security.authc.saml.SamlLogoutRequestHandler;
@@ -206,9 +206,9 @@ void doExecute(ActionType<Response> action, Request request, ActionListener<Resp
206206
when(securityIndex.aliasName()).thenReturn(".security");
207207
when(securityIndex.freeze()).thenReturn(securityIndex);
208208

209-
final XPackLicenseState licenseState = mock(XPackLicenseState.class);
209+
final MockLicenseState licenseState = mock(MockLicenseState.class);
210210
when(licenseState.isSecurityEnabled()).thenReturn(true);
211-
when(licenseState.checkFeature(Feature.SECURITY_TOKEN_SERVICE)).thenReturn(true);
211+
when(licenseState.isAllowed(Security.TOKEN_SERVICE_FEATURE)).thenReturn(true);
212212

213213
final ClusterService clusterService = ClusterServiceUtils.createClusterService(threadPool);
214214
final SecurityContext securityContext = new SecurityContext(settings, threadContext);

0 commit comments

Comments
 (0)