honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add apm_user reserved role (#38206) 

* Adding apm_user

* Fixing SecurityDocumentationIT testGetRoles test

* Adding access to .ml-anomalies-*

* Fixing APM test, we don't have access to the ML state index
This commit is contained in:
Brandon Kobel 2019-02-04 21:45:28 -08:00 committed by GitHub
parent fe36861ada
commit 64ff75f04e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java
View File

@ -654,8 +654,8 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
List<Role> roles = response.getRoles();
assertNotNull(response);
// 24 system roles plus the three we created
assertThat(roles.size(), equalTo(27));
// 25 system roles plus the three we created
assertThat(roles.size(), equalTo(28));
}
{

7
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java
View File

@ -132,6 +132,13 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
new String[] { "monitor", MonitoringBulkAction.NAME}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA))
.put(UsernamesField.APM_ROLE, new RoleDescriptor(UsernamesField.APM_ROLE,
new String[] { "monitor", MonitoringBulkAction.NAME}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA))
.put("apm_user", new RoleDescriptor("apm_user",
null, new RoleDescriptor.IndicesPrivileges[] {
RoleDescriptor.IndicesPrivileges.builder().indices("apm-*")
.privileges("read", "view_index_metadata").build(),
RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*")
.privileges("view_index_metadata", "read").build(),
}, null, MetadataUtils.DEFAULT_RESERVED_METADATA))
.put("machine_learning_user", new RoleDescriptor("machine_learning_user", new String[] { "monitor_ml" },
new RoleDescriptor.IndicesPrivileges[] {
RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*", ".ml-notifications*")

17
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java
View File

@ -849,6 +849,23 @@ public class ReservedRolesStoreTests extends ESTestCase {
assertNoAccessAllowed(APMSystemRole, RestrictedIndicesNames.NAMES_SET);
}
public void testAPMUserRole() {
final TransportRequest request = mock(TransportRequest.class);
final RoleDescriptor roleDescriptor = new ReservedRolesStore().roleDescriptor("apm_user");
assertNotNull(roleDescriptor);
assertThat(roleDescriptor.getMetadata(), hasEntry("_reserved", true));
Role role = Role.builder(roleDescriptor, null).build();
assertThat(role.runAs().check(randomAlphaOfLengthBetween(1, 12)), is(false));
assertNoAccessAllowed(role, "foo");
assertOnlyReadAllowed(role, "apm-" + randomIntBetween(0, 5));
assertOnlyReadAllowed(role, AnomalyDetectorsIndexFields.RESULTS_INDEX_PREFIX + AnomalyDetectorsIndexFields.RESULTS_INDEX_DEFAULT);
}
public void testMachineLearningAdminRole() {
final TransportRequest request = mock(TransportRequest.class);