mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-25 01:19:02 +00:00
All internal searches (triggered by APIs) across the .security index must be performed while "under the security origin". Otherwise, the search is performed in the context of the caller which most likely does not have privileges to search .security (hopefully). This commit fixes this in the case of two methods in the TokenService and corrects an overly done such context switch in the ApiKeyService. In addition, this makes all tests from the client/rest-high-level module execute as an all mighty administrator, but not a literal superuser. Closes #47151
139 lines
5.4 KiB
Groovy
139 lines
5.4 KiB
Groovy
/*
|
|
* Licensed to Elasticsearch under one or more contributor
|
|
* license agreements. See the NOTICE file distributed with
|
|
* this work for additional information regarding copyright
|
|
* ownership. Elasticsearch licenses this file to you under
|
|
* the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
apply plugin: 'elasticsearch.testclusters'
|
|
apply plugin: 'elasticsearch.build'
|
|
apply plugin: 'elasticsearch.rest-test'
|
|
apply plugin: 'nebula.maven-base-publish'
|
|
apply plugin: 'nebula.maven-scm'
|
|
apply plugin: 'com.github.johnrengelman.shadow'
|
|
|
|
group = 'org.elasticsearch.client'
|
|
archivesBaseName = 'elasticsearch-rest-high-level-client'
|
|
|
|
publishing {
|
|
publications {
|
|
nebula {
|
|
artifactId = archivesBaseName
|
|
}
|
|
}
|
|
}
|
|
|
|
configurations {
|
|
restSpec
|
|
}
|
|
|
|
idea {
|
|
module {
|
|
if (scopes.TEST != null) {
|
|
scopes.TEST.plus.add(project.configurations.restSpec)
|
|
}
|
|
}
|
|
}
|
|
|
|
dependencies {
|
|
/*
|
|
* Everything in the "shadow" configuration is *not* copied into the
|
|
* shadowJar.
|
|
*/
|
|
compile project(':server')
|
|
compile project(':client:rest')
|
|
compile project(':modules:mapper-extras')
|
|
compile project(':modules:parent-join')
|
|
compile project(':modules:aggs-matrix-stats')
|
|
compile project(':modules:rank-eval')
|
|
compile project(':modules:lang-mustache')
|
|
|
|
testCompile project(':client:test')
|
|
testCompile project(':test:framework')
|
|
testCompile "com.carrotsearch.randomizedtesting:randomizedtesting-runner:${versions.randomizedrunner}"
|
|
testCompile "junit:junit:${versions.junit}"
|
|
//this is needed to make RestHighLevelClientTests#testApiNamingConventions work from IDEs
|
|
testCompile project(":rest-api-spec")
|
|
// Needed for serialization tests:
|
|
// (In order to serialize a server side class to a client side class or the other way around)
|
|
testCompile(project(':x-pack:plugin:core')) {
|
|
exclude group: 'org.elasticsearch', module: 'elasticsearch-rest-high-level-client'
|
|
}
|
|
|
|
restSpec project(':rest-api-spec')
|
|
}
|
|
|
|
//we need to copy the yaml spec so we can check naming (see RestHighlevelClientTests#testApiNamingConventions)
|
|
processTestResources {
|
|
dependsOn jar // so that configurations resolve
|
|
from({ zipTree(configurations.restSpec.singleFile) }) {
|
|
include 'rest-api-spec/api/**'
|
|
}
|
|
from(project(':client:rest-high-level').file('src/test/resources'))
|
|
}
|
|
|
|
dependencyLicenses {
|
|
// Don't check licenses for dependency that are part of the elasticsearch project
|
|
// But any other dependency should have its license/notice/sha1
|
|
dependencies = project.configurations.runtime.fileCollection {
|
|
it.group.startsWith('org.elasticsearch') == false
|
|
}
|
|
}
|
|
|
|
forbiddenApisMain {
|
|
// core does not depend on the httpclient for compile so we add the signatures here. We don't add them for test as they are already
|
|
// specified
|
|
addSignatureFiles 'http-signatures'
|
|
signaturesFiles += files('src/main/resources/forbidden/rest-high-level-signatures.txt')
|
|
}
|
|
|
|
File nodeCert = file("./testnode.crt")
|
|
File nodeTrustStore = file("./testnode.jks")
|
|
File pkiTrustCert = file("./src/test/resources/org/elasticsearch/client/security/delegate_pki/testRootCA.crt")
|
|
|
|
integTest.runner {
|
|
systemProperty 'tests.rest.cluster.username', System.getProperty('tests.rest.cluster.username', 'test_user')
|
|
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-password')
|
|
}
|
|
|
|
testClusters.integTest {
|
|
testDistribution = 'DEFAULT'
|
|
systemProperty 'es.scripting.update.ctx_in_params', 'false'
|
|
setting 'reindex.remote.whitelist', '[ "[::1]:*", "127.0.0.1:*" ]'
|
|
setting 'xpack.license.self_generated.type', 'trial'
|
|
setting 'xpack.security.enabled', 'true'
|
|
setting 'xpack.security.authc.token.enabled', 'true'
|
|
setting 'xpack.security.authc.api_key.enabled', 'true'
|
|
// Truststore settings are not used since TLS is not enabled. Included for testing the get certificates API
|
|
setting 'xpack.security.http.ssl.certificate_authorities', 'testnode.crt'
|
|
setting 'xpack.security.transport.ssl.truststore.path', 'testnode.jks'
|
|
setting 'xpack.security.authc.realms.file.default_file.order', '0'
|
|
setting 'xpack.security.authc.realms.native.default_native.order', '1'
|
|
setting 'xpack.security.authc.realms.pki.pki1.order', '2'
|
|
setting 'xpack.security.authc.realms.pki.pki1.certificate_authorities', '[ "testRootCA.crt" ]'
|
|
setting 'xpack.security.authc.realms.pki.pki1.delegation.enabled', 'true'
|
|
|
|
setting 'indices.lifecycle.poll_interval', '1000ms'
|
|
keystore 'xpack.security.transport.ssl.truststore.secure_password', 'testnode'
|
|
extraConfigFile 'roles.yml', file('roles.yml')
|
|
user username: System.getProperty('tests.rest.cluster.username', 'test_user'),
|
|
password: System.getProperty('tests.rest.cluster.password', 'test-password'),
|
|
role: System.getProperty('tests.rest.cluster.role', 'admin')
|
|
user username: 'admin_user', password: 'admin-password'
|
|
|
|
extraConfigFile nodeCert.name, nodeCert
|
|
extraConfigFile nodeTrustStore.name, nodeTrustStore
|
|
extraConfigFile pkiTrustCert.name, pkiTrustCert
|
|
}
|