Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport 2.x] Fix Security Tests After Changes to Permissions Requirements #1309

Merged
merged 1 commit into from
Sep 11, 2024
Merged

[Backport 2.x] Fix Security Tests After Changes to Permissions Requirements #1309

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions src/test/java/org/opensearch/ad/rest/SecureADRestIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ public class SecureADRestIT extends AnomalyDetectorRestTestCase {
RestClient lionClient;
private String indexAllAccessRole = "index_all_access";
private String indexSearchAccessRole = "index_all_search";
String oceanUser = "ocean";
RestClient oceanClient;

/**
* Create an unguessable password. Simple password are weak due to https://tinyurl.com/383em9zk
Expand Down Expand Up @@ -156,7 +158,13 @@ public void setupSecureTests() throws IOException {
.setSocketTimeout(60000)
.build();

createRoleMapping("anomaly_read_access", new ArrayList<>(Arrays.asList(bobUser)));
String oceanPassword = generatePassword(oceanUser);
createUser(oceanUser, elkPassword, new ArrayList<>(Arrays.asList("odfe")));
oceanClient = new SecureRestClientBuilder(getClusterHosts().toArray(new HttpHost[0]), isHttps(), oceanUser, oceanPassword)
.setSocketTimeout(60000)
.build();

createRoleMapping("anomaly_read_access", new ArrayList<>(Arrays.asList(bobUser, oceanUser)));
createRoleMapping("anomaly_full_access", new ArrayList<>(Arrays.asList(aliceUser, catUser, dogUser, elkUser, fishUser, goatUser)));
createRoleMapping(indexAllAccessRole, new ArrayList<>(Arrays.asList(aliceUser, bobUser, catUser, dogUser, fishUser, lionUser)));
createRoleMapping(indexSearchAccessRole, new ArrayList<>(Arrays.asList(goatUser)));
Expand All @@ -172,6 +180,7 @@ public void deleteUserSetup() throws IOException {
fishClient.close();
goatClient.close();
lionClient.close();
oceanClient.close();
deleteUser(aliceUser);
deleteUser(bobUser);
deleteUser(catUser);
Expand All @@ -180,6 +189,7 @@ public void deleteUserSetup() throws IOException {
deleteUser(fishUser);
deleteUser(goatUser);
deleteUser(lionUser);
deleteUser(oceanUser);
}

public void testCreateAnomalyDetectorWithWriteAccess() throws IOException {
Expand Down Expand Up @@ -414,8 +424,8 @@ public void testCreateAnomalyDetectorWithNoReadPermissionOfIndex() throws IOExce
AnomalyDetector anomalyDetector = createRandomAnomalyDetector(false, false, aliceClient);
// User elk has AD full access, but has no read permission of index
String indexName = anomalyDetector.getIndices().get(0);
Exception exception = expectThrows(IOException.class, () -> { createRandomAnomalyDetector(false, false, indexName, elkClient); });
Assert.assertTrue(exception.getMessage().contains("no permissions for [indices:data/read/search]"));
Exception exception = expectThrows(IOException.class, () -> { createRandomAnomalyDetector(false, false, indexName, oceanClient); });
Assert.assertTrue("actual: " + exception.getMessage(), exception.getMessage().contains("Unauthorized"));
}

public void testCreateAnomalyDetectorWithCustomResultIndex() throws IOException {
Expand Down Expand Up @@ -494,12 +504,8 @@ public void testPreviewAnomalyDetectorWithNoReadPermissionOfIndex() throws IOExc
);
enableFilterBy();
// User elk has no read permission of index
Exception exception = expectThrows(Exception.class, () -> { previewAnomalyDetector(aliceDetector.getId(), elkClient, input); });
Assert
.assertTrue(
"actual msg: " + exception.getMessage(),
exception.getMessage().contains("no permissions for [indices:data/read/search]")
);
Exception exception = expectThrows(Exception.class, () -> { previewAnomalyDetector(aliceDetector.getId(), oceanClient, input); });
Assert.assertTrue("actual msg: " + exception.getMessage(), exception.getMessage().contains("Unauthorized"));
}

public void testValidateAnomalyDetectorWithWriteAccess() throws IOException {
Expand Down Expand Up @@ -528,8 +534,8 @@ public void testValidateAnomalyDetectorWithNoReadPermissionOfIndex() throws IOEx
AnomalyDetector detector = TestHelpers.randomAnomalyDetector(null, Instant.now());
enableFilterBy();
// User elk has no read permission of index, can't validate detector
Exception exception = expectThrows(Exception.class, () -> { validateAnomalyDetector(detector, elkClient); });
Assert.assertTrue(exception.getMessage().contains("no permissions for [indices:data/read/search]"));
Exception exception = expectThrows(Exception.class, () -> { validateAnomalyDetector(detector, oceanClient); });
Assert.assertTrue("actual: " + exception.getMessage(), exception.getMessage().contains("Unauthorized"));
}

public void testValidateAnomalyDetectorWithNoBackendRole() throws IOException {
Expand Down
Loading