mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-13 08:25:26 +00:00
This commit introduces PKI realm delegation. This feature supports the PKI authentication feature in Kibana. In essence, this creates a new API endpoint which Kibana must call to authenticate clients that use certificates in their TLS connection to Kibana. The API call passes to Elasticsearch the client's certificate chain. The response contains an access token to be further used to authenticate as the client. The client's certificates are validated by the PKI realms that have been explicitly configured to permit certificates from the proxy (Kibana). The user calling the delegation API must have the delegate_pki privilege. Closes #34396
133 lines
5.1 KiB
Groovy
133 lines
5.1 KiB
Groovy
/*
|
|
* Licensed to Elasticsearch under one or more contributor
|
|
* license agreements. See the NOTICE file distributed with
|
|
* this work for additional information regarding copyright
|
|
* ownership. Elasticsearch licenses this file to you under
|
|
* the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
apply plugin: 'elasticsearch.testclusters'
|
|
apply plugin: 'elasticsearch.build'
|
|
apply plugin: 'elasticsearch.rest-test'
|
|
apply plugin: 'nebula.maven-base-publish'
|
|
apply plugin: 'nebula.maven-scm'
|
|
apply plugin: 'com.github.johnrengelman.shadow'
|
|
|
|
group = 'org.elasticsearch.client'
|
|
archivesBaseName = 'elasticsearch-rest-high-level-client'
|
|
|
|
publishing {
|
|
publications {
|
|
nebula {
|
|
artifactId = archivesBaseName
|
|
}
|
|
}
|
|
}
|
|
|
|
configurations {
|
|
restSpec
|
|
}
|
|
|
|
idea {
|
|
module {
|
|
if (scopes.TEST != null) {
|
|
scopes.TEST.plus.add(project.configurations.restSpec)
|
|
}
|
|
}
|
|
}
|
|
|
|
dependencies {
|
|
/*
|
|
* Everything in the "shadow" configuration is *not* copied into the
|
|
* shadowJar.
|
|
*/
|
|
compile project(':server')
|
|
compile project(':client:rest')
|
|
compile project(':modules:mapper-extras')
|
|
compile project(':modules:parent-join')
|
|
compile project(':modules:aggs-matrix-stats')
|
|
compile project(':modules:rank-eval')
|
|
compile project(':modules:lang-mustache')
|
|
|
|
testCompile project(':client:test')
|
|
testCompile project(':test:framework')
|
|
testCompile "com.carrotsearch.randomizedtesting:randomizedtesting-runner:${versions.randomizedrunner}"
|
|
testCompile "junit:junit:${versions.junit}"
|
|
//this is needed to make RestHighLevelClientTests#testApiNamingConventions work from IDEs
|
|
testCompile project(":rest-api-spec")
|
|
// Needed for serialization tests:
|
|
// (In order to serialize a server side class to a client side class or the other way around)
|
|
testCompile project(':x-pack:plugin:core')
|
|
|
|
restSpec project(':rest-api-spec')
|
|
}
|
|
|
|
//we need to copy the yaml spec so we can check naming (see RestHighlevelClientTests#testApiNamingConventions)
|
|
processTestResources {
|
|
dependsOn jar // so that configurations resolve
|
|
from({ zipTree(configurations.restSpec.singleFile) }) {
|
|
include 'rest-api-spec/api/**'
|
|
}
|
|
from(project(':client:rest-high-level').file('src/test/resources'))
|
|
}
|
|
|
|
dependencyLicenses {
|
|
// Don't check licenses for dependency that are part of the elasticsearch project
|
|
// But any other dependency should have its license/notice/sha1
|
|
dependencies = project.configurations.runtime.fileCollection {
|
|
it.group.startsWith('org.elasticsearch') == false
|
|
}
|
|
}
|
|
|
|
forbiddenApisMain {
|
|
// core does not depend on the httpclient for compile so we add the signatures here. We don't add them for test as they are already
|
|
// specified
|
|
addSignatureFiles 'http-signatures'
|
|
signaturesFiles += files('src/main/resources/forbidden/rest-high-level-signatures.txt')
|
|
}
|
|
File nodeCert = file("./testnode.crt")
|
|
File nodeTrustStore = file("./testnode.jks")
|
|
File pkiTrustCert = file("./src/test/resources/org/elasticsearch/client/security/delegate_pki/testRootCA.crt")
|
|
|
|
integTest.runner {
|
|
systemProperty 'tests.rest.cluster.username', System.getProperty('tests.rest.cluster.username', 'test_user')
|
|
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-password')
|
|
}
|
|
|
|
testClusters.integTest {
|
|
testDistribution = 'DEFAULT'
|
|
systemProperty 'es.scripting.update.ctx_in_params', 'false'
|
|
setting 'reindex.remote.whitelist', '[ "[::1]:*", "127.0.0.1:*" ]'
|
|
setting 'xpack.license.self_generated.type', 'trial'
|
|
setting 'xpack.security.enabled', 'true'
|
|
setting 'xpack.security.authc.token.enabled', 'true'
|
|
setting 'xpack.security.authc.api_key.enabled', 'true'
|
|
// Truststore settings are not used since TLS is not enabled. Included for testing the get certificates API
|
|
setting 'xpack.security.http.ssl.certificate_authorities', 'testnode.crt'
|
|
setting 'xpack.security.transport.ssl.truststore.path', 'testnode.jks'
|
|
setting 'xpack.security.authc.realms.file.default_file.order', '0'
|
|
setting 'xpack.security.authc.realms.native.default_native.order', '1'
|
|
setting 'xpack.security.authc.realms.pki.pki1.order', '2'
|
|
setting 'xpack.security.authc.realms.pki.pki1.certificate_authorities', '[ "testRootCA.crt" ]'
|
|
setting 'xpack.security.authc.realms.pki.pki1.delegation.enabled', 'true'
|
|
|
|
setting 'indices.lifecycle.poll_interval', '1000ms'
|
|
keystore 'xpack.security.transport.ssl.truststore.secure_password', 'testnode'
|
|
user username: System.getProperty('tests.rest.cluster.username', 'test_user'),
|
|
password: System.getProperty('tests.rest.cluster.password', 'test-password')
|
|
|
|
extraConfigFile nodeCert.name, nodeCert
|
|
extraConfigFile nodeTrustStore.name, nodeTrustStore
|
|
extraConfigFile pkiTrustCert.name, pkiTrustCert
|
|
}
|