Commit Graph

4143 Commits

Author SHA1 Message Date
javanna fee5a30f7f Update es core version to 1.4.0.Beta-SNAPSHOT
Original commit: elastic/x-pack-elasticsearch@acd0ab0292
2014-09-15 15:46:24 +02:00
Alexander Reelsen d604c63527 Netty: Move n2n filter in pipeline to first place
The current IP filter kicks in after the SSL handler, which only
makes sense, if you check things like the SSL certificate. For
now it makes most sense to really put this at the first place.

Original commit: elastic/x-pack-elasticsearch@bbaed67a3c
2014-09-12 08:32:38 +02:00
Alexander Reelsen 176517ba7e Testing: Changing ApacheDsRule to not use the same workdir for LDAP server
Original commit: elastic/x-pack-elasticsearch@532d02b014
2014-09-11 16:30:26 +02:00
uboness 1588c761ea Cleanup
- Formalized the notion of a client vs. node mode. Introduced an `AbstractShieldModule` that takes care of that
- For now, standarized on the `Shield` name across the board (e.g. change `SecurityModule` to `ShieldModule`)
- Introduces static methods to `ShieldPlugin` to resolve shield specific config files (on the way fixed the file resolving of the ldap group mapper)
- The n2n ip filtering is now resolved at the module level. If not enabled, null is injected and the netty handler is then not injected to the pipeline
- updated code base with the latest changes in es-core around how relevant http headers are registered and copied over to the transport request
- Added new known action in es-core  `indices:admin/get`

Original commit: elastic/x-pack-elasticsearch@ca8d85dc81
2014-09-11 15:21:57 +03:00
Alexander Reelsen 787a415c27 FileRolesStore: Make sure default path is loaded correctly on startup
The wrong path was used as default path. Also added logging information
for all files, so one can at least check the paths.

Original commit: elastic/x-pack-elasticsearch@893493fd17
2014-09-10 12:07:16 +02:00
Alexander Reelsen f15d5c4aa3 Testing: Create rule for starting/stopping ApacheDS
This ensures, that resources are cleaned up appropriately.

Original commit: elastic/x-pack-elasticsearch@d881562a3e
2014-09-09 21:28:40 +02:00
Alexander Reelsen 954ea51ef3 Test: Ensure that security plugin is not loaded via classpath
Original commit: elastic/x-pack-elasticsearch@765a3d5115
2014-09-09 16:26:23 +02:00
uboness 263ebfbbf2 Have AuthenticationService resolve the auth token from rest request
- Also made sure that we fallback on system token only if the system has permission to the action.
- While at it, change the binding of the different services to run as a singletons

Closes elastic/elasticsearch#64

Original commit: elastic/x-pack-elasticsearch@3705b7365a
2014-09-09 14:31:17 +03:00
uboness 5cc210bc9a Bug Fix: LdapModule now reports whether it's enabled/disabled correctly
- Also fixed a bug where if ldap/esuers module is disabled, injection failed (now injecting the appropriate `null` values to `Realms`
 - Also updated `SecurityFilter` with latest changes in es core (action filters API changed)

Original commit: elastic/x-pack-elasticsearch@71de64e6ad
2014-09-07 01:07:24 +02:00
uboness f4b4075cfa Upgraded to Lucene 4.10 and fixed the build
The automaton support changed quite a bit in 4.10 which required determinizing all the automatons used in the Privilege

Original commit: elastic/x-pack-elasticsearch@96a82f0f5d
2014-09-06 15:41:22 +02:00
uboness 5cc7d55568 cleaned up UsernamePasswordToken
Removed the caching of the token on the request context. Caching is now handled by the InternalAuthenticationService

Original commit: elastic/x-pack-elasticsearch@d60bc7af67
2014-09-05 15:24:43 +02:00
Alexander Reelsen 2aa52a3113 Fix: Use context instead of headers for storing the auth token
Original commit: elastic/x-pack-elasticsearch@497202f7a1
2014-09-05 12:46:59 +02:00
Alexander Reelsen c96db14742 Fixing compilation errors due to latest core changes
Original commit: elastic/x-pack-elasticsearch@dff29dc46d
2014-09-05 10:25:21 +02:00
uboness 6ebe1b997f Make sure the "Authorization" header is copied from the rest to request the transport message
Original commit: elastic/x-pack-elasticsearch@a29c66821e
2014-09-04 13:52:06 +02:00
uboness 6f82a56ed3 Restructured and cleaned up guice modules
- ShieldModule loads the SecuredTransportModule which is in turn responsible for loading the required transport related sub-modules
- Removed n2n module and incorporated n2n into the transport module
- Updated the docs to reflect the new settings for n2n ip filtering

Original commit: elastic/x-pack-elasticsearch@dd82306a04
2014-09-03 13:32:44 +02:00
Bill Hwang 3ae67f3999 [BUILD] Added license check
1) Enforce license header check on source files
2) Add missing license header to existing sources

Original commit: elastic/x-pack-elasticsearch@da73e4f2b6
2014-09-02 15:54:05 -07:00
Bill Hwang 6b0ec94eab [CI] Add JaCoCo plug in dependencies
Add jacoco plug in depdencies to pom.xml, inside a profile.
This enables code coverage analysis

Original commit: elastic/x-pack-elasticsearch@eedf882368
2014-09-02 12:18:07 -07:00
javanna 8a7764fb50 [TEST] Updated known actions names test
Closes elastic/elasticsearch#51

Original commit: elastic/x-pack-elasticsearch@9e051f9fb6
2014-09-01 14:33:55 +02:00
Alexander Reelsen 4fa7abd7d6 Fix: Make compilation work with java 8
Also fixes a test, which was relying on order

Original commit: elastic/x-pack-elasticsearch@56b8cd0381
2014-09-01 11:23:02 +02:00
uboness ef48bf7c6e Change http status of AuthorizationException to 403
Closes elastic/elasticsearch#55

Original commit: elastic/x-pack-elasticsearch@23006f238b
2014-09-01 06:37:15 +02:00
uboness fd568037bb Added create_index as a separate index privilege
Closes elastic/elasticsearch#53

Original commit: elastic/x-pack-elasticsearch@ec7f6ce5fa
2014-08-31 23:32:36 +02:00
uboness 956aeb53f4 Modified the initial authentication logic
When a http request arrives, we first verify that it carries an authentication token (if it doesn't we throw an authentication exception). Beyond that, any action request that arrives, if it doesn't have an authentication token we assume system user identity. The rationale behind it is that  if a request comes in via the transport, then the sending peer authenticated with a client auth cert (the cert acts as the guarantee here that the actor can be assumed as System)... otherwise, the request can come from the local node and triggered by the system (e.g. gateway recovery)

The System user only has permissions to internal apis (it doesn't have full access/permission to all the apis). when a System identity is assumed, the authorization service will grant/deny the request based on whether the request is an internal api or not.

Aso fixed the known actions (to be insync with 1.x branch)

Closes elastic/elasticsearch#45

Original commit: elastic/x-pack-elasticsearch@be27cb0e1b
2014-08-29 15:35:01 -07:00
Alexander Reelsen eb29414077 incorporating review comments as parseFile methods already return immutable maps
Original commit: elastic/x-pack-elasticsearch@5baaad0971
2014-08-29 10:23:58 +02:00
Alexander Reelsen c6b7be5596 Cleanup: Incorporating findbugs/pmd findings
Original commit: elastic/x-pack-elasticsearch@5567fae416
2014-08-29 10:15:03 +02:00
Alexander Reelsen 25d2480e78 Ip filtering: Check correct path for default file
Also added logging, so that on start up a message is logged, if all
connections are rejected or the config file is not found.

Closes elastic/elasticsearch#48

Original commit: elastic/x-pack-elasticsearch@51f16d75ba
2014-08-29 09:11:28 +02:00
uboness c17c140cd2 Small fixes
- throw an error on initialization if the audit trail is configured with an unknown output
- removed unnecessary null checks

Original commit: elastic/x-pack-elasticsearch@8d26723553
2014-08-28 16:05:04 -07:00
Alexander Reelsen f73645054b Ip Filter: Allow to disable via node configuration
Added `shield.n2n.enabled` property to disable this feature, so
it does not get added to the netty pipeline.

Original commit: elastic/x-pack-elasticsearch@d73d27619c
2014-08-28 16:34:27 +02:00
Alexander Reelsen c9379b3875 CliTool: Do not leave invalid lines in roles file
Removing all roles from a user result in an invalid line left in the
roles file. This commit simply removes the user from the roles file
in that case.

Original commit: elastic/x-pack-elasticsearch@c1f4a961fd
2014-08-28 15:10:24 +02:00
Alexander Reelsen 52ba1ceff3 CliTool: Fixed adding of roles for existing users
The roles file had been checked instead of the users file when checking
if the user already exists. This lead to wrong "user not found" error
messages.

Original commit: elastic/x-pack-elasticsearch@6fc5646ce7
2014-08-28 14:50:08 +02:00
javanna 929e12e9cb [TEST] Removed discovery configuration from transport clients settings
Also removed unused copyFile method

Original commit: elastic/x-pack-elasticsearch@2d96e05ded
2014-08-28 13:57:06 +02:00
Alexander Reelsen d0e377ff76 Testing: Create ShieldIntegrationTest that other test inherit from
This integration test contains all of the configuration needed to run with shield
and will be the base for further improvements.

Closes elastic/elasticsearch#36
Relates elastic/elasticsearch#31

Original commit: elastic/x-pack-elasticsearch@fe77f4d32b
2014-08-28 09:30:51 +02:00
uboness fcd3a89a3d We've decided that for now (phase1) index template APIs will be under cluster management privilege
Original commit: elastic/x-pack-elasticsearch@390d55e859
2014-08-27 12:28:51 -07:00
Alexander Reelsen b887fad51a Config file parsing: Improved parsing for edge cases
Created some tests to improve parsing of files, most importantly fixed an endless loop
in YAML parsing and made the non-yaml parsers a bit more error resistant.

Closes elastic/elasticsearch#40

Original commit: elastic/x-pack-elasticsearch@8873138d0c
2014-08-26 10:49:48 +02:00
c-a-m 9cd397727f LDAP: Implements an LDAP realm
The LDAP realm is a bind-per-user strategy and the group lookup strategy is configurable.
If a role mapping file is not defined, groups names are taken as role names.
Special configuration for active directory simplifies the configuration.

Integration Tests are using an embedded apache DS LDAP Server.

Original commit: elastic/x-pack-elasticsearch@ce20e1b3be
2014-08-25 15:36:31 -06:00
Brian Murphy f57ca58605 Alerting : Update the readme with right syntax for the commands
Original commit: elastic/x-pack-elasticsearch@bd78e7a2e9
2014-08-21 17:47:45 +01:00
Brian Murphy 8c623534c2 Alerting : Cleanup and fixes.
These changes fix the alert throttling during the time period, move alert history it's own
index.

Original commit: elastic/x-pack-elasticsearch@5130637824
2014-08-21 16:33:11 +01:00
c-a-m cf40c76e15 User Caching Issue Fix
Fixes Caching issue with passwords hashing with unique salts.

Original commit: elastic/x-pack-elasticsearch@e0ee1440fa
2014-08-20 12:26:46 -07:00
uboness f040d895b3 Added the notion of IndicesResolver
A strategy for extracting the related indices from a request. The default strategy relies on the request to either be `IndicesRequest` or `CompositeIndicesRequest`. But depending on the request type, there might be other strategies as well. For example, `GetIndexTemplatesRequest` only holds the template name and therefore requires a different strategy where the template is looked up in the cluster metadata and the indices are resolved from there.

This also cleans up the Permission class and makes sure that the indices are resolved once per request (and not once per configured group permission)

Original commit: elastic/x-pack-elasticsearch@95192ccdff
2014-08-20 10:42:51 -07:00
uboness 1154f13345 Allow configuring cluster & indices permissions on specific actions
- It is now possible to assign index & cluster permission on an action level (not just the fixed privileges we defined).

 - also added a test to check that all the actions elasticsearch has are indeed known to shield. So whenever a new action is introduced in elasticsearch, and shield is not aware of it, the build will fail. This will help us ensure that all actions in elasticsearch are 1) well formatted/categorized, 2) secured and "permissible"

Closes elastic/elasticsearch#19

Original commit: elastic/x-pack-elasticsearch@170c3b9185
2014-08-20 09:27:52 -07:00
Alexander Reelsen 0d5c83d0f0 Testing: Disable integration tests until infrastructure is created
Relates elastic/elasticsearch#36

Original commit: elastic/x-pack-elasticsearch@cc90d83111
2014-08-20 16:56:18 +02:00
Alexander Reelsen 22862cd416 Fix loading of secured transports
Load transports in plugin. No need to specify any transport modules anymore.
Removed the transport modules.

Original commit: elastic/x-pack-elasticsearch@45f3245361
2014-08-20 15:47:38 +02:00
uboness 1728c2a381 Fixed comments on Transport service filter commit
- Fixed a bug in the logic of applying the indices group permission check
- For the rest, mainly cosmetics refactoring (renaming & redundant code removal)

Original commit: elastic/x-pack-elasticsearch@748575dc2e
2014-08-19 07:45:54 -07:00
Alexander Reelsen 6a7c537ad6 Docs: Initial documentation
Created an initial set of documentation which can also be built
using `build_docs.pl` without errors.

Original commit: elastic/x-pack-elasticsearch@1a3ccf4eb9
2014-08-19 15:40:20 +02:00
Brian Murphy 47e1e77b58 Alerting : Start of multiprocess coordination work
On alert claim time, query index to make sure alert is still valid and enabled and is the same alert.

Original commit: elastic/x-pack-elasticsearch@72b816b7d1
2014-08-19 13:31:01 +01:00
uboness 9c55be1530 Added transport filtering
Requests are now auth'ed on the transport level as well (in addition to the transport action level). This is required as some internal requests are not executed as actions, thus not going through the auth process in the transport action. Since we have n2n authentication, we also assume here that requests that are not associated with an authentication token are internal system calls. We then, auth the request as a system user.

Also Added a system realm (to handle system requests)

Original commit: elastic/x-pack-elasticsearch@2c917318f0
2014-08-18 14:01:11 -07:00
Brian Murphy 0eea73dd72 Alerting: Scripted triggers and support for aggregations in searches.
This commit adds support for triggers that are scripts:

Query :
````
POST /_search/template/testFilteredAgg
{
  "query" : {
    "filtered" : {
      "query" : {
        "match_all" : {}
     },
     "filter": {
       "range" : {
         "@timestamp" : {
             "gte" : "{{from}}",
             "lt" : "{{to}}"
         }
       }
     }
    }
  },
    "aggs" : {
      "response" : {
        "terms" : {
          "field" : "response",
          "size" : 100
        }
      }
}, "size" : 0  }
````

Trigger Script:
````
POST /_scripts/groovy/testScript
{
  "script" : "ok_count = 0.0;error_count = 0.0;for(bucket in aggregations.response.buckets) {if (bucket.key < 400){ok_count += bucket.doc_count;} else {error_count += bucket.doc_count;}}; return error_count/(ok_count+1) > 0.1;"
}
````

Alert:
````
POST /_alerting/_create/myScriptedAlert
{
    "query" : "testFilteredAgg",
    "schedule" : "05 * * * * ?",
    "trigger" : {
         "script" : {
           "script" : "testScript",
           "script_lang" : "groovy",
           "script_type" : "INDEXED"
         }
     },
    "timeperiod" : "300s",
     "action" : {
         "index" : {
           "index" : "weberrorhistory",
           "type" : "weberrorresult"
         }
     },
    "indices" : [ "logstash*" ],
    "enabled" : true,
    "simple" : false
}
````

If you want to use aggs with your alert you must create a search that contains the timefilter with the params ````{{from}}```` and ````{{to}}```` and set the ````simple```` flag to ````true````.

Original commit: elastic/x-pack-elasticsearch@0430a1bf40
2014-08-18 16:59:49 +01:00
Alexander Reelsen 452367b674 Return correct HTTP headers on security exceptions
* Changed Authentication/AuthorizationException to always return RestStatus.UNAUTHORIZED
* Added the WWW-Authenticate header, which results in user/pass input in browsers
* Added tests and own assertions class

Closes elastic/elasticsearch#18

Original commit: elastic/x-pack-elasticsearch@c6ce084692
2014-08-18 15:15:28 +02:00
Brian Murphy 4216491824 Alerting : Improve error handling in the RestInterface
This commit improves error handling in the RestHandler. Errors are now
returned to the client.

Original commit: elastic/x-pack-elasticsearch@433e8a57bc
2014-08-18 12:28:48 +01:00
Brian Murphy 14d0bcd589 Alerting add TODO
Original commit: elastic/x-pack-elasticsearch@23cf5fce8b
2014-08-18 12:22:13 +01:00
Brian Murphy 418b9f1a31 Alerting : Add scripted triggers and alert disabling.
This commit adds support for disabling alerts.
This commit adds preliminary support for scripted triggers.

Original commit: elastic/x-pack-elasticsearch@e14a56dbeb
2014-08-18 12:13:39 +01:00