honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/x-pack/plugin/security/build.gradle

327 lines
15 KiB
Groovy
Raw Normal View History

Build: Replace references to x-pack-elasticsearch paths with helper methods (elastic/x-pack-elasticsearch#3748) In order to more easily integrate xpack once it moves into the elasticsearch repo, references to the existing x-pack-elasticsearch need to be reduced. This commit introduces a few helper "methods" available to any project within xpack (through gradle project extension properties, as closures). All refeerences to project paths now use these helper methods, except for those pertaining to bwc, which will be handled in a followup. Original commit: elastic/x-pack-elasticsearch@850668744c7188f3ca8d6ff561c99fbd8995288e
2018-01-27 00:48:30 -05:00
evaluationDependsOn(xpackModule('core'))
Force evaluation order between sub-plugins and core We are relying on the fact that :x-pack-elasticsearch:plugin:core is configured before these. This happens when these projects are alphabetically after core, but is not the case when they are not (ccr). To address this, we simplfy be explicit about evaluation order in all sub-plugins. Relates elastic/x-pack-elasticsearch#3663 Original commit: elastic/x-pack-elasticsearch@755f84258b8f2a8558de4437e76a3e9cc03d5b69
2018-01-22 10:55:03 -05:00
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
apply plugin: 'elasticsearch.esplugin'
Apply publishing to genreate pom (#33094)
2018-08-27 01:44:06 -04:00
apply plugin: 'nebula.maven-scm'
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
esplugin {
name 'x-pack-security'
description 'Elasticsearch Expanded Pack Plugin - Security'
classname 'org.elasticsearch.xpack.security.Security'
requiresKeystore true
extendedPlugins = ['x-pack-core']
}
Create skeleton for plugin split (elastic/x-pack-elasticsearch#3233) This creates a basic skeleton for the plugin split by adding folders and example `build.gradle` files. It also includes a non-implemented `migrate-plugins.sh` script that we can fill in at a later time. Relates to elastic/x-pack-elasticsearch#2925 Original commit: elastic/x-pack-elasticsearch@2ab035d6b671b00478a8587c77fc16b9e2512311
2017-12-08 11:41:32 -05:00
archivesBaseName = 'x-pack-security'
dependencies {
Build: Rework shadow plugin configuration (#32409) This reworks how we configure the `shadow` plugin in the build. The major change is that we no longer bundle dependencies in the `compile` configuration, instead we bundle dependencies in the new `bundle` configuration. This feels more right because it is a little more "opt in" rather than "opt out" and the name of the `bundle` configuration is a little more obvious. As an neat side effect of this, the `runtimeElements` configuration used when one project depends on another now contains exactly the dependencies needed to run the project so you no longer need to reference projects that use the shadow plugin like this: ``` testCompile project(path: ':client:rest-high-level', configuration: 'shadow') ``` You can instead use the much more normal: ``` testCompile "org.elasticsearch.client:elasticsearch-rest-high-level-client:${version}" ```
2018-08-21 20:03:28 -04:00
// "org.elasticsearch.plugin:x-pack-core:${version}" doesn't work with idea because the testArtifacts are also here
compileOnly project(path: xpackModule('core'), configuration: 'default')
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
compileOnly project(path: ':modules:transport-netty4', configuration: 'runtime')
Build: Replace provided configuration with compileOnly (elastic/x-pack-elasticsearch#3868) This is the xpack side of elastic/elasticsearch#28564 Original commit: elastic/x-pack-elasticsearch@60033824a4220bd4be8790a8f508c2e1f7340ea6
2018-02-09 14:30:43 -05:00
compileOnly project(path: ':plugins:transport-nio', configuration: 'runtime')
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
Build: Replace references to x-pack-elasticsearch paths with helper methods (elastic/x-pack-elasticsearch#3748) In order to more easily integrate xpack once it moves into the elasticsearch repo, references to the existing x-pack-elasticsearch need to be reduced. This commit introduces a few helper "methods" available to any project within xpack (through gradle project extension properties, as closures). All refeerences to project paths now use these helper methods, except for those pertaining to bwc, which will be handled in a followup. Original commit: elastic/x-pack-elasticsearch@850668744c7188f3ca8d6ff561c99fbd8995288e
2018-01-27 00:48:30 -05:00
testCompile project(path: xpackModule('monitoring'))
SQL: Refactor package names of sql-proto and sql-shared-proto projects (#31622) - renames project `sql-proto` to `sql-action`, - renames package `sql.plugin` to `sql.action` - renames project `sql-shared-client` to `sql-client` - renames package `sql.shard.client` to `sql.client` - renames project `sql-shared-proto` to `sql-proto` Closes #31593
2018-06-28 08:56:16 -04:00
testCompile project(path: xpackModule('sql:sql-action'))
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
Build: Replace references to x-pack-elasticsearch paths with helper methods (elastic/x-pack-elasticsearch#3748) In order to more easily integrate xpack once it moves into the elasticsearch repo, references to the existing x-pack-elasticsearch need to be reduced. This commit introduces a few helper "methods" available to any project within xpack (through gradle project extension properties, as closures). All refeerences to project paths now use these helper methods, except for those pertaining to bwc, which will be handled in a followup. Original commit: elastic/x-pack-elasticsearch@850668744c7188f3ca8d6ff561c99fbd8995288e
2018-01-27 00:48:30 -05:00
testCompile project(path: xpackModule('core'), configuration: 'testArtifacts')
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
Security: upgrade unboundid ldapsdk to 4.0.8 (#34247) This commit upgrades the unboundid ldapsdk to version 4.0.8. The primary driver for upgrading is a fix that prevents this library from rewrapping Error instances that would normally bubble up to the UncaughtExceptionHandler and terminate the JVM. Other notable changes include some fixes related to connection handling in the library's connection pool implementation. Closes #33175
2018-10-03 14:31:19 -04:00
compile 'com.unboundid:unboundid-ldapsdk:4.0.8'
Remove BouncyCastle dependency from runtime (#32193) * Remove BouncyCastle dependency from runtime This commit introduces a new gradle project that contains the classes that have a dependency on BouncyCastle. For the default distribution, It builds a jar from those and in puts it in a subdirectory of lib (/tools/security-cli) along with the BouncyCastle jars. This directory is then passed in the ES_ADDITIONAL_CLASSPATH_DIRECTORIES of the CLI tools that use these classes. BouncyCastle is removed as a runtime dependency (remains as a compileOnly one) from x-pack core and x-pack security.
2018-07-20 17:03:58 -04:00
compileOnly 'org.bouncycastle:bcprov-jdk15on:1.59'
compileOnly 'org.bouncycastle:bcpkix-jdk15on:1.59'
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
// the following are all SAML dependencies - might as well download the whole internet
compile "org.opensaml:opensaml-core:3.3.0"
compile "org.opensaml:opensaml-saml-api:3.3.0"
compile "org.opensaml:opensaml-saml-impl:3.3.0"
compile "org.opensaml:opensaml-messaging-api:3.3.0"
compile "org.opensaml:opensaml-messaging-impl:3.3.0"
compile "org.opensaml:opensaml-security-api:3.3.0"
compile "org.opensaml:opensaml-security-impl:3.3.0"
compile "org.opensaml:opensaml-profile-api:3.3.0"
compile "org.opensaml:opensaml-profile-impl:3.3.0"
compile "org.opensaml:opensaml-xmlsec-api:3.3.0"
compile "org.opensaml:opensaml-xmlsec-impl:3.3.0"
compile "org.opensaml:opensaml-soap-api:3.3.0"
compile "org.opensaml:opensaml-soap-impl:3.3.0"
compile "org.opensaml:opensaml-storage-api:3.3.0"
compile "org.opensaml:opensaml-storage-impl:3.3.0"
compile "net.shibboleth.utilities:java-support:7.3.0"
compile "org.apache.santuario:xmlsec:2.0.8"
compile "io.dropwizard.metrics:metrics-core:3.2.2"
compile "org.cryptacular:cryptacular:1.2.0"
compile "org.slf4j:slf4j-api:${versions.slf4j}"
compile "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
compile "org.apache.httpcomponents:httpclient:${versions.httpclient}"
compile "org.apache.httpcomponents:httpcore:${versions.httpcore}"
compile "org.apache.httpcomponents:httpasyncclient:${versions.httpasyncclient}"
compile "org.apache.httpcomponents:httpcore-nio:${versions.httpcore}"
compile "org.apache.httpcomponents:httpclient-cache:${versions.httpclient}"
[Kerberos] Add Kerberos authentication support (#32263) This commit adds support for Kerberos authentication with a platinum license. Kerberos authentication support relies on SPNEGO, which is triggered by challenging clients with a 401 response with the `WWW-Authenticate: Negotiate` header. A SPNEGO client will then provide a Kerberos ticket in the `Authorization` header. The tickets are validated using Java's built-in GSS support. The JVM uses a vm wide configuration for Kerberos, so there can be only one Kerberos realm. This is enforced by a bootstrap check that also enforces the existence of the keytab file. In many cases a fallback authentication mechanism is needed when SPNEGO authentication is not available. In order to support this, the DefaultAuthenticationFailureHandler now takes a list of failure response headers. For example, one realm can provide a `WWW-Authenticate: Negotiate` header as its default and another could provide `WWW-Authenticate: Basic` to indicate to the client that basic authentication can be used in place of SPNEGO. In order to test Kerberos, unit tests are run against an in-memory KDC that is backed by an in-memory ldap server. A QA project has also been added to test against an actual KDC, which is provided by the krb5kdc fixture. Closes #30243
2018-07-24 10:44:26 -04:00
compile 'com.google.guava:guava:19.0'
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
Add an OpenID Connect authentication realm (#40674) (#41178) This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. This is a backport of #40674
2019-04-15 05:41:16 -04:00
// Dependencies for oidc
compile "com.nimbusds:oauth2-oidc-sdk:6.5"
compile "com.nimbusds:nimbus-jose-jwt:4.41.2"
compile "com.nimbusds:lang-tag:1.4.4"
compile "com.sun.mail:jakarta.mail:1.6.3"
compile "net.jcip:jcip-annotations:1.0"
compile "net.minidev:json-smart:2.3"
compile "net.minidev:accessors-smart:1.2"
compile "org.ow2.asm:asm:7.1"
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
testCompile 'org.elasticsearch:securemock:1.2'
testCompile "org.elasticsearch:mocksocket:${versions.mocksocket}"
//testCompile "org.yaml:snakeyaml:${versions.snakeyaml}"
[Kerberos] Add Kerberos authentication support (#32263) This commit adds support for Kerberos authentication with a platinum license. Kerberos authentication support relies on SPNEGO, which is triggered by challenging clients with a 401 response with the `WWW-Authenticate: Negotiate` header. A SPNEGO client will then provide a Kerberos ticket in the `Authorization` header. The tickets are validated using Java's built-in GSS support. The JVM uses a vm wide configuration for Kerberos, so there can be only one Kerberos realm. This is enforced by a bootstrap check that also enforces the existence of the keytab file. In many cases a fallback authentication mechanism is needed when SPNEGO authentication is not available. In order to support this, the DefaultAuthenticationFailureHandler now takes a list of failure response headers. For example, one realm can provide a `WWW-Authenticate: Negotiate` header as its default and another could provide `WWW-Authenticate: Basic` to indicate to the client that basic authentication can be used in place of SPNEGO. In order to test Kerberos, unit tests are run against an in-memory KDC that is backed by an in-memory ldap server. A QA project has also been added to test against an actual KDC, which is provided by the krb5kdc fixture. Closes #30243
2018-07-24 10:44:26 -04:00
// Test dependencies for Kerberos (MiniKdc)
testCompile('commons-io:commons-io:2.5')
testCompile('org.apache.kerby:kerb-simplekdc:1.1.1')
testCompile('org.apache.kerby:kerb-client:1.1.1')
testCompile('org.apache.kerby:kerby-config:1.1.1')
testCompile('org.apache.kerby:kerb-core:1.1.1')
testCompile('org.apache.kerby:kerby-pkix:1.1.1')
testCompile('org.apache.kerby:kerby-asn1:1.1.1')
testCompile('org.apache.kerby:kerby-util:1.1.1')
testCompile('org.apache.kerby:kerb-common:1.1.1')
testCompile('org.apache.kerby:kerb-crypto:1.1.1')
testCompile('org.apache.kerby:kerb-util:1.1.1')
testCompile('org.apache.kerby:token-provider:1.1.1')
testCompile('com.nimbusds:nimbus-jose-jwt:4.41.2')
testCompile('net.jcip:jcip-annotations:1.0')
testCompile('org.apache.kerby:kerb-admin:1.1.1')
testCompile('org.apache.kerby:kerb-server:1.1.1')
testCompile('org.apache.kerby:kerb-identity:1.1.1')
testCompile('org.apache.kerby:kerby-xdr:1.1.1')
// LDAP backend support for SimpleKdcServer
testCompile('org.apache.kerby:kerby-backend:1.1.1')
testCompile('org.apache.kerby:ldap-backend:1.1.1')
testCompile('org.apache.kerby:kerb-identity:1.1.1')
testCompile('org.apache.directory.api:api-ldap-client-api:1.0.0')
testCompile('org.apache.directory.api:api-ldap-schema-data:1.0.0')
testCompile('org.apache.directory.api:api-ldap-codec-core:1.0.0')
testCompile('org.apache.directory.api:api-ldap-extras-aci:1.0.0')
testCompile('org.apache.directory.api:api-ldap-extras-codec:1.0.0')
testCompile('org.apache.directory.api:api-ldap-extras-codec-api:1.0.0')
testCompile('commons-pool:commons-pool:1.6')
testCompile('commons-collections:commons-collections:3.2')
testCompile('org.apache.mina:mina-core:2.0.17')
testCompile('org.apache.directory.api:api-util:1.0.1')
testCompile('org.apache.directory.api:api-i18n:1.0.1')
testCompile('org.apache.directory.api:api-ldap-model:1.0.1')
testCompile('org.apache.directory.api:api-asn1-api:1.0.1')
testCompile('org.apache.directory.api:api-asn1-ber:1.0.1')
testCompile('org.apache.servicemix.bundles:org.apache.servicemix.bundles.antlr:2.7.7_5')
testCompile('org.apache.directory.server:apacheds-core-api:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-i18n:2.0.0-M24')
testCompile('org.apache.directory.api:api-ldap-extras-util:1.0.0')
testCompile('net.sf.ehcache:ehcache:2.10.4')
testCompile('org.apache.directory.server:apacheds-kerberos-codec:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-protocol-ldap:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-protocol-shared:2.0.0-M24')
testCompile('org.apache.directory.jdbm:apacheds-jdbm1:2.0.0-M3')
testCompile('org.apache.directory.server:apacheds-jdbm-partition:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-xdbm-partition:2.0.0-M24')
testCompile('org.apache.directory.api:api-ldap-extras-sp:1.0.0')
testCompile('org.apache.directory.server:apacheds-test-framework:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-core-annotations:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-ldif-partition:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-mavibot-partition:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-protocol-kerberos:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-server-annotations:2.0.0-M24')
testCompile('org.apache.directory.api:api-ldap-codec-standalone:1.0.0')
testCompile('org.apache.directory.api:api-ldap-net-mina:1.0.0')
testCompile('org.apache.directory.server:ldap-client-test:2.0.0-M24')
testCompile('org.apache.directory.server:apacheds-interceptor-kerberos:2.0.0-M24')
testCompile('org.apache.directory.mavibot:mavibot:1.0.0-M8')
Create skeleton for plugin split (elastic/x-pack-elasticsearch#3233) This creates a basic skeleton for the plugin split by adding folders and example `build.gradle` files. It also includes a non-implemented `migrate-plugins.sh` script that we can fill in at a later time. Relates to elastic/x-pack-elasticsearch#2925 Original commit: elastic/x-pack-elasticsearch@2ab035d6b671b00478a8587c77fc16b9e2512311
2017-12-08 11:41:32 -05:00
}
Make -try xlint warning disabled by default. (#40833) Many gradle projects specifically use the -try exclude flag, because there are many cases where auto-closeable resource ignore is never referenced in body of corresponding try statement. Suppressing this warning specifically in each case that it happens using `@SuppressWarnings("try")` would be very verbose. This change removes `-try` from any gradle project and adds it to the build plugin. Also this change removes exclude flags from gradle projects that is already specified in build plugin (for example -deprecation). Relates to #40366
2019-04-05 02:01:56 -04:00
compileJava.options.compilerArgs << "-Xlint:-rawtypes,-unchecked"
compileTestJava.options.compilerArgs << "-Xlint:-rawtypes,-unchecked"
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
Avoid sharing source directories as it breaks intellij (#40877) * Avoid sharing source directories as it breaks intellij * Subprojects share main project output classes directory * Fix jar hell * Fix sql security with ssl integ tests * Relax dependency ordering rule so we don't explode on cycles
2019-04-08 10:05:12 -04:00
processTestResources {
from(project(xpackModule('core')).file('src/main/config'))
from(project(xpackModule('core')).file('src/test/resources'))
}
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
configurations {
testArtifacts.extendsFrom testRuntime
}
task testJar(type: Jar) {
appendix 'test'
from sourceSets.test.output
}
artifacts {
// normal es plugins do not publish the jar but we need to since users need it for Transport Clients and extensions
archives jar
testArtifacts testJar
}
Avoid sharing source directories as it breaks intellij (#40877) * Avoid sharing source directories as it breaks intellij * Subprojects share main project output classes directory * Fix jar hell * Fix sql security with ssl integ tests * Relax dependency ordering rule so we don't explode on cycles
2019-04-08 10:05:12 -04:00
Create skeleton for plugin split (elastic/x-pack-elasticsearch#3233) This creates a basic skeleton for the plugin split by adding folders and example `build.gradle` files. It also includes a non-implemented `migrate-plugins.sh` script that we can fill in at a later time. Relates to elastic/x-pack-elasticsearch#2925 Original commit: elastic/x-pack-elasticsearch@2ab035d6b671b00478a8587c77fc16b9e2512311
2017-12-08 11:41:32 -05:00
dependencyLicenses {
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
mapping from: /java-support|opensaml-.*/, to: 'shibboleth'
Build: Cleanup gradle files (elastic/x-pack-elasticsearch#3867) There were a number of leftover unnecessary elements in the module build.gradle files that were holdovers from copying the original plugin build.gradle. This commit removes these elements. Original commit: elastic/x-pack-elasticsearch@08babbd5207f08f2a28a111bc24c74e81792a199
2018-02-07 19:58:09 -05:00
mapping from: /http.*/, to: 'httpclient'
Create skeleton for plugin split (elastic/x-pack-elasticsearch#3233) This creates a basic skeleton for the plugin split by adding folders and example `build.gradle` files. It also includes a non-implemented `migrate-plugins.sh` script that we can fill in at a later time. Relates to elastic/x-pack-elasticsearch#2925 Original commit: elastic/x-pack-elasticsearch@2ab035d6b671b00478a8587c77fc16b9e2512311
2017-12-08 11:41:32 -05:00
}
Remove copy-pasted code (elastic/x-pack-elasticsearch#4298) * Remove copy-pasted code An examination of the x-pack source code revealed copy-pasted code in ActiveDirectoryGroupsResolver in the binarySidToStringSid method. I have replaced this with an apache2 implementation from the apache directory studio project. Furthermore, I have added a test that leverages a real binary/string SID pair retrieved from an active directory domain controller. The apache2-based implementation is exempt for the license checker. Original commit: elastic/x-pack-elasticsearch@81a7471261b9854b2f3b3ce95a6eae4287b465e1
2018-04-19 09:12:15 -04:00
licenseHeaders {
// This class was sourced from apache directory studio for some microsoft-specific logic
excludes << 'org/elasticsearch/xpack/security/authc/ldap/ActiveDirectorySIDUtil.java'
}
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
forbiddenPatterns {
exclude '**/*.key'
exclude '**/*.p12'
exclude '**/*.der'
exclude '**/*.zip'
}
forbiddenApisMain {
Add an OpenID Connect authentication realm (#40674) (#41178) This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. This is a backport of #40674
2019-04-15 05:41:16 -04:00
signaturesFiles += files('forbidden/ldap-signatures.txt', 'forbidden/xml-signatures.txt', 'forbidden/oidc-signatures.txt')
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
}
// classes are missing, e.g. com.ibm.icu.lang.UCharacter
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
thirdPartyAudit {
ignoreMissingClasses (
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
// SAML dependencies
// [missing classes] Some cli utilities that we don't use depend on these missing JCommander classes
'com.beust.jcommander.JCommander',
'com.beust.jcommander.converters.BaseConverter',
// [missing classes] Shibboleth + OpenSAML have servlet support that we don't use
'javax.servlet.AsyncContext',
'javax.servlet.DispatcherType',
'javax.servlet.Filter',
'javax.servlet.FilterChain',
'javax.servlet.FilterConfig',
'javax.servlet.RequestDispatcher',
'javax.servlet.ServletContext',
'javax.servlet.ServletException',
'javax.servlet.ServletInputStream',
'javax.servlet.ServletOutputStream',
'javax.servlet.ServletRequest',
'javax.servlet.ServletResponse',
'javax.servlet.http.Cookie',
'javax.servlet.http.HttpServletRequest',
'javax.servlet.http.HttpServletResponse',
'javax.servlet.http.HttpServletResponseWrapper',
'javax.servlet.http.HttpSession',
'javax.servlet.http.Part',
// [missing classes] Shibboleth + OpenSAML have velocity support that we don't use
'org.apache.velocity.VelocityContext',
'org.apache.velocity.app.VelocityEngine',
'org.apache.velocity.context.Context',
'org.apache.velocity.exception.VelocityException',
'org.apache.velocity.runtime.RuntimeServices',
'org.apache.velocity.runtime.log.LogChute',
'org.apache.velocity.runtime.resource.loader.StringResourceLoader',
'org.apache.velocity.runtime.resource.util.StringResourceRepository',
// [missing classes] OpenSAML depends on Apache XML security which depends on Xalan, but only for functionality that OpenSAML doesn't use
'org.apache.xml.dtm.DTM',
'org.apache.xml.utils.PrefixResolver',
'org.apache.xml.utils.PrefixResolverDefault',
'org.apache.xpath.Expression',
'org.apache.xpath.NodeSetDTM',
'org.apache.xpath.XPath',
'org.apache.xpath.XPathContext',
'org.apache.xpath.compiler.FunctionTable',
'org.apache.xpath.functions.Function',
'org.apache.xpath.objects.XNodeSet',
'org.apache.xpath.objects.XObject',
// [missing classes] OpenSAML storage has an optional LDAP storage impl
'org.ldaptive.AttributeModification',
'org.ldaptive.AttributeModificationType',
'org.ldaptive.Connection',
'org.ldaptive.DeleteOperation',
'org.ldaptive.DeleteRequest',
'org.ldaptive.LdapAttribute',
'org.ldaptive.LdapEntry',
'org.ldaptive.LdapException',
'org.ldaptive.ModifyOperation',
'org.ldaptive.ModifyRequest',
'org.ldaptive.Response',
'org.ldaptive.ResultCode',
'org.ldaptive.SearchOperation',
'org.ldaptive.SearchRequest',
'org.ldaptive.SearchResult',
'org.ldaptive.ext.MergeOperation',
'org.ldaptive.ext.MergeRequest',
'org.ldaptive.pool.ConnectionPool',
'org.ldaptive.pool.PooledConnectionFactory',
// [missing classes] OpenSAML storage has an optional JSON-backed storage impl
'javax.json.Json',
'javax.json.JsonException',
'javax.json.JsonNumber',
'javax.json.JsonObject',
'javax.json.JsonReader',
'javax.json.JsonValue$ValueType',
'javax.json.JsonValue',
'javax.json.stream.JsonGenerator',
// [missing classes] OpenSAML storage has an optional JPA storage impl
'javax.persistence.EntityManager',
'javax.persistence.EntityManagerFactory',
'javax.persistence.EntityTransaction',
'javax.persistence.LockModeType',
Run Third party audit with forbidden APIs CLI (part3/3) (#33052) The new implementation is functional equivalent with the old, ant based one. It parses task standard error to get the missing classes and violations in the same way. I considered re-using ForbiddenApisCliTask but Gradle makes it hard to build inheritance with tasks that have task actions , since the order of the task actions can't be controlled. This inheritance isn't dully desired either as the third party audit task is much more opinionated and we don't want to expose some of the configuration. We could probably extract a common base class without any task actions, but probably more trouble than it's worth. Closes #31715
2018-08-28 03:03:30 -04:00
'javax.persistence.Query',
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
// [missing classes] OpenSAML storage and HttpClient cache have optional memcache support
'net.spy.memcached.CASResponse',
'net.spy.memcached.CASValue',
'net.spy.memcached.MemcachedClient',
'net.spy.memcached.MemcachedClientIF',
'net.spy.memcached.CachedData',
'net.spy.memcached.internal.OperationFuture',
'net.spy.memcached.transcoders.Transcoder',
// [missing classes] Http Client cache has optional ehcache support
'net.sf.ehcache.Ehcache',
'net.sf.ehcache.Element',
// [missing classes] SLF4j includes an optional class that depends on an extension class (!)
Add an OpenID Connect authentication realm (#40674) (#41178) This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. This is a backport of #40674
2019-04-15 05:41:16 -04:00
'org.slf4j.ext.EventData',
// Optional dependency of oauth2-oidc-sdk that we don't need since we do not support AES-SIV for JWE
'org.cryptomator.siv.SivMode'
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
)
ignoreViolations (
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
// Guava uses internal java api: sun.misc.Unsafe
'com.google.common.cache.Striped64',
'com.google.common.cache.Striped64$1',
'com.google.common.cache.Striped64$Cell',
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator',
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator$1',
'com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper',
'com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper$1',
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
)
}
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
Run Third party audit with forbidden APIs CLI (part3/3) (#33052) The new implementation is functional equivalent with the old, ant based one. It parses task standard error to get the missing classes and violations in the same way. I considered re-using ForbiddenApisCliTask but Gradle makes it hard to build inheritance with tasks that have task actions , since the order of the task actions can't be controlled. This inheritance isn't dully desired either as the third party audit task is much more opinionated and we don't want to expose some of the configuration. We could probably extract a common base class without any task actions, but probably more trouble than it's worth. Closes #31715
2018-08-28 03:03:30 -04:00
if (project.runtimeJavaVersion > JavaVersion.VERSION_1_8) {
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
thirdPartyAudit.ignoreMissingClasses(
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
'javax.xml.bind.JAXBContext',
'javax.xml.bind.JAXBElement',
'javax.xml.bind.JAXBException',
'javax.xml.bind.Unmarshaller',
Add an OpenID Connect authentication realm (#40674) (#41178) This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. This is a backport of #40674
2019-04-15 05:41:16 -04:00
'javax.xml.bind.UnmarshallerHandler',
'javax.activation.ActivationDataFlavor',
'javax.activation.DataContentHandler',
'javax.activation.DataHandler',
'javax.activation.DataSource',
'javax.activation.FileDataSource',
'javax.activation.FileTypeMap'
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
)
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
}
[Backport] Replace usages RandomizedTestingTask with built-in Gradle Test (#40978) (#40993) * Replace usages RandomizedTestingTask with built-in Gradle Test (#40978) This commit replaces the existing RandomizedTestingTask and supporting code with Gradle's built-in JUnit support via the Test task type. Additionally, the previous workaround to disable all tasks named "test" and create new unit testing tasks named "unitTest" has been removed such that the "test" task now runs unit tests as per the normal Gradle Java plugin conventions. (cherry picked from commit 323f312bbc829a63056a79ebe45adced5099f6e6) * Fix forking JVM runner * Don't bump shadow plugin version
2019-04-09 14:52:50 -04:00
test {
Split up xpack plugins into their own modules (elastic/x-pack-elasticsearch#3643) Thanks to some great work by a bunch of amazing people, the chuck norris xpack split is a go! Original commit: elastic/x-pack-elasticsearch@dad98e28f4043f805907af2ad441908f64ca6c70
2018-01-20 00:30:17 -05:00
/*
* We have to disable setting the number of available processors as tests in the same JVM randomize processors and will step on each
* other if we allow them to set the number of available processors as it's set-once in Netty.
*/
systemProperty 'es.set.netty.runtime.available.processors', 'false'
}
Test: Add internalClusterTest to xpack modules (elastic/x-pack-elasticsearch#3730) This commit reenables running ITs in xpack by adding an internalClusterTest to xpack modules that contain ESIntegTestCase tests. The new task allows us to run these independently of rest integ tests, which are disabled for xpack modules because installing the bundled plugins directly is not quite the same as installing via the meta plugin. Some tests (ML) are moved to their own qa module to accommodate the need for a real cluster. A couple tests (monitoring and upgrade) have been marked as AwaitsFix. Commits that have been folded into this commit: * Move ML IT tests to qa/ml-native-tests * Add internalClusterTest task and disable rest integ tests for xpack modules. Also tweak ML tests and get upgrade tests working * Adding the keystore and security back to the ml native tests * Fixing native integ test * Fix last ML test, add awaits fix to monitoring and upgrade tests * cleanup PR * fix checkstyle Original commit: elastic/x-pack-elasticsearch@3c0ed6fd3be2eaf57b561dce52c362c9d32c07a9
2018-01-25 04:38:34 -05:00
// xpack modules are installed in real clusters as the meta plugin, so
// installing them as individual plugins for integ tests doesn't make sense,
// so we disable integ tests
integTest.enabled = false
Add test for HTTP and Transport TLS on basic license (#40932) This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: #40714
2019-04-07 23:23:12 -04:00
// add all sub-projects of the qa sub-project
gradle.projectsEvaluated {
project.subprojects
.find { it.path == project.path + ":qa" }
.subprojects
.findAll { it.path.startsWith(project.path + ":qa") }
.each { check.dependsOn it.check }
}