Skip to content

Commit 1d00a86

Browse files
nibixnibix
committed
Renamed "next_gen" value for "privileges_evaluation_type" to "v4"
Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>
1 parent 3cbf0fd commit 1d00a86

7 files changed

Lines changed: 28 additions & 28 deletions

File tree

‎config/config.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,10 @@ _meta:
6060

6161
config:
6262
dynamic:
63-
# Set privileges_evaluation_type to "next_gen" to enable the new privileges evaluation engine.
63+
# Set privileges_evaluation_type to "v4" to enable the new privileges evaluation engine.
6464
# This should give you a more seamless experience, especially for users with restricted privileges
6565
# working in OpenSearch Dashboards.
66-
# privileges_evaluation_type: next_gen
66+
# privileges_evaluation_type: "v4"
6767
#kibana:
6868
# Kibana multitenancy
6969
#multitenancy_enabled: true

‎src/integrationTest/java/org/opensearch/security/privileges/int_tests/ClusterConfig.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public enum ClusterConfig {
4242
true,
4343
false
4444
),
45-
NEXT_GEN_PRIVILEGES_EVALUATION("next_gen", c -> c.privilegesEvaluationType("next_gen"), false, true, true);
45+
V4_PRIVILEGES_EVALUATION("v4", c -> c.privilegesEvaluationType("v4"), false, true, true);
4646

4747
final String name;
4848
final Function<LocalCluster.Builder, LocalCluster.Builder> clusterConfiguration;

‎src/integrationTest/java/org/opensearch/security/privileges/int_tests/CrossClusterAuthorizationIntTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ interface RemoteIndices {
173173
.clusterManager(ClusterManager.SINGLENODE)
174174
.clusterName("remote_1")
175175
.authc(AUTHC_HTTPBASIC_INTERNAL)
176-
.privilegesEvaluationType("next_gen")
176+
.privilegesEvaluationType("v4")
177177
.roles(LIMITED_USER_ROLE_A_R_REMOTE, LIMITED_USER_ROLE_R_REMOTE, LIMITED_USER_ROLE_R1_REMOTE, LIMITED_ROLE_NONE, UNLIMITED_ROLE)
178178
.indices(RemoteIndices.index_r1, RemoteIndices.index_r2, RemoteIndices.index_r3)
179179
.build();

‎src/integrationTest/java/org/opensearch/security/privileges/int_tests/IndexAuthorizationReadOnlyIntTests.java‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ public class IndexAuthorizationReadOnlyIntTests {
161161
/**
162162
* This key identifies assertion reference data for index search/read permissions of individual users for the new privilege evaluation
163163
*/
164-
static final TestSecurityConfig.User.MetadataKey<IndexMatcher> READ_NEXT_GEN = new TestSecurityConfig.User.MetadataKey<>(
164+
static final TestSecurityConfig.User.MetadataKey<IndexMatcher> READ_V4 = new TestSecurityConfig.User.MetadataKey<>(
165165
"read_nextgen",
166166
IndexMatcher.class
167167
);
@@ -193,7 +193,7 @@ public class IndexAuthorizationReadOnlyIntTests {
193193
.on("index_a*")
194194
)//
195195
.reference(READ, limitedTo(index_a1, index_a2, index_a3, index_ax))//
196-
.reference(READ_NEXT_GEN, limitedTo(index_a1, index_a2, index_a3, index_ax))//
196+
.reference(READ_V4, limitedTo(index_a1, index_a2, index_a3, index_ax))//
197197
.reference(GET_ALIAS, limitedToNone());
198198

199199
/**
@@ -208,7 +208,7 @@ public class IndexAuthorizationReadOnlyIntTests {
208208
.on("index_b*")
209209
)//
210210
.reference(READ, limitedTo(index_b1, index_b2, index_b3))//
211-
.reference(READ_NEXT_GEN, limitedTo(index_b1, index_b2, index_b3))//
211+
.reference(READ_V4, limitedTo(index_b1, index_b2, index_b3))//
212212
.reference(GET_ALIAS, limitedToNone());
213213

214214
/**
@@ -223,7 +223,7 @@ public class IndexAuthorizationReadOnlyIntTests {
223223
.on("index_b1")
224224
)//
225225
.reference(READ, limitedTo(index_b1))//
226-
.reference(READ_NEXT_GEN, limitedTo(index_b1))//
226+
.reference(READ_V4, limitedTo(index_b1))//
227227
.reference(GET_ALIAS, limitedToNone());
228228

229229
/**
@@ -238,7 +238,7 @@ public class IndexAuthorizationReadOnlyIntTests {
238238
.on("index_c*")
239239
)//
240240
.reference(READ, limitedTo(index_c1, alias_c1))//
241-
.reference(READ_NEXT_GEN, limitedTo(index_c1))//
241+
.reference(READ_V4, limitedTo(index_c1))//
242242
.reference(GET_ALIAS, limitedToNone());
243243

244244
/**
@@ -254,7 +254,7 @@ public class IndexAuthorizationReadOnlyIntTests {
254254
.on("alias_ab1*")
255255
)//
256256
.reference(READ, limitedTo(index_a1, index_a2, index_a3, index_b1, alias_ab1))//
257-
.reference(READ_NEXT_GEN, limitedTo(index_a1, index_a2, index_a3, index_b1, alias_ab1))//
257+
.reference(READ_V4, limitedTo(index_a1, index_a2, index_a3, index_b1, alias_ab1))//
258258
.reference(GET_ALIAS, limitedTo(index_a1, index_a2, index_a3, index_b1, alias_ab1));
259259

260260
/**
@@ -270,7 +270,7 @@ public class IndexAuthorizationReadOnlyIntTests {
270270
.on("alias_c1")
271271
)//
272272
.reference(READ, limitedTo(index_c1, alias_c1))//
273-
.reference(READ_NEXT_GEN, limitedTo(index_c1, alias_c1))//
273+
.reference(READ_V4, limitedTo(index_c1, alias_c1))//
274274
.reference(GET_ALIAS, limitedTo(index_c1, alias_c1));
275275
/**
276276
* Same as LIMITED_USER_A with the addition of read privileges for index_hidden* and .index_hidden*
@@ -284,7 +284,7 @@ public class IndexAuthorizationReadOnlyIntTests {
284284
.on("index_a*", "index_hidden*", ".index_hidden*")
285285
)//
286286
.reference(READ, limitedTo(index_a1, index_a2, index_a3, index_ax, index_hidden, index_hidden_dot))//
287-
.reference(READ_NEXT_GEN, limitedTo(index_a1, index_a2, index_a3, index_ax, index_hidden, index_hidden_dot))//
287+
.reference(READ_V4, limitedTo(index_a1, index_a2, index_a3, index_ax, index_hidden, index_hidden_dot))//
288288
.reference(GET_ALIAS, limitedToNone());
289289

290290
/**
@@ -310,7 +310,7 @@ public class IndexAuthorizationReadOnlyIntTests {
310310
.on(".system_index_plugin")
311311
)//
312312
.reference(READ, limitedTo(index_c1, alias_c1, system_index_plugin, alias_with_system_index))//
313-
.reference(READ_NEXT_GEN, limitedTo(index_c1, alias_c1, system_index_plugin))//
313+
.reference(READ_V4, limitedTo(index_c1, alias_c1, system_index_plugin))//
314314
.reference(GET_ALIAS, limitedTo(index_c1, alias_c1, system_index_plugin, alias_with_system_index));
315315
/**
316316
* This user has no privileges for indices that are used in this test. But they have privileges for other indices.
@@ -327,7 +327,7 @@ public class IndexAuthorizationReadOnlyIntTests {
327327
.on("index_does_not_exist_*")
328328
)//
329329
.reference(READ, limitedToNone())//
330-
.reference(READ_NEXT_GEN, limitedToNone())//
330+
.reference(READ_V4, limitedToNone())//
331331
.reference(GET_ALIAS, limitedToNone());
332332

333333
/**
@@ -340,7 +340,7 @@ public class IndexAuthorizationReadOnlyIntTests {
340340
.clusterPermissions("cluster_composite_ops_ro", "cluster_monitor")
341341
)//
342342
.reference(READ, limitedToNone())//
343-
.reference(READ_NEXT_GEN, limitedToNone())//
343+
.reference(READ_V4, limitedToNone())//
344344
.reference(GET_ALIAS, limitedToNone());
345345
/**
346346
* A user with "*" privileges on "*"; as it is a regular user, they are still subject to system index
@@ -356,7 +356,7 @@ public class IndexAuthorizationReadOnlyIntTests {
356356

357357
)//
358358
.reference(READ, limitedTo(ALL_INDICES_AND_ALIASES_EXCEPT_SYSTEM_INDICES).and(index_ax))//
359-
.reference(READ_NEXT_GEN, limitedTo(ALL_INDICES_AND_ALIASES_EXCEPT_SYSTEM_INDICES).and(index_ax))//
359+
.reference(READ_V4, limitedTo(ALL_INDICES_AND_ALIASES_EXCEPT_SYSTEM_INDICES).and(index_ax))//
360360
.reference(GET_ALIAS, limitedTo(ALL_INDICES_AND_ALIASES_EXCEPT_SYSTEM_INDICES).and(index_ax));
361361

362362
/**
@@ -367,7 +367,7 @@ public class IndexAuthorizationReadOnlyIntTests {
367367
.description("super unlimited (admin cert)")//
368368
.adminCertUser()//
369369
.reference(READ, unlimitedIncludingOpenSearchSecurityIndex())//
370-
.reference(READ_NEXT_GEN, unlimitedIncludingOpenSearchSecurityIndex())//
370+
.reference(READ_V4, unlimitedIncludingOpenSearchSecurityIndex())//
371371
.reference(GET_ALIAS, unlimitedIncludingOpenSearchSecurityIndex());
372372

373373
static final List<TestSecurityConfig.User> USERS = ImmutableList.of(
@@ -794,7 +794,7 @@ public void search_staticIndices_systemIndex_alias() throws Exception {
794794
containsExactly(system_index_plugin).at("hits.hits[*]._index").reducedBy(user.reference(READ)).whenEmpty(isForbidden())
795795
);
796796
} else {
797-
if (user.reference(READ_NEXT_GEN).covers(alias_with_system_index)) {
797+
if (user.reference(READ_V4).covers(alias_with_system_index)) {
798798
assertThat(httpResponse, isOk());
799799
assertThat(httpResponse, containsExactly(system_index_plugin).at("hits.hits[*]._index"));
800800
} else {
@@ -1184,7 +1184,7 @@ public void search_termsAggregation_index() throws Exception {
11841184
}
11851185
}""");
11861186

1187-
if (clusterConfig == ClusterConfig.NEXT_GEN_PRIVILEGES_EVALUATION) {
1187+
if (clusterConfig == ClusterConfig.V4_PRIVILEGES_EVALUATION) {
11881188
if (user == LIMITED_USER_NONE) {
11891189
assertThat(httpResponse, isForbidden("/error/root_cause/0/reason", "no permissions for [indices:data/read/search]"));
11901190
} else if (user == LIMITED_USER_OTHER_PRIVILEGES) {
@@ -1454,7 +1454,7 @@ public void mget_alias() throws Exception {
14541454
containsExactly(index_c1).at("docs[?(@.found == true)]._index").reducedBy(user.reference(READ)).whenEmpty(isOk())
14551455
);
14561456
} else {
1457-
if (user.reference(READ_NEXT_GEN).covers(alias_c1)) {
1457+
if (user.reference(READ_V4).covers(alias_c1)) {
14581458
assertThat(httpResponse, containsExactly(index_c1).at("docs[?(@.found == true)]._index"));
14591459
} else {
14601460
assertThat(httpResponse, containsExactly().at("docs[?(@.found == true)]._index"));
@@ -1482,7 +1482,7 @@ public void get_alias() throws Exception {
14821482
if (clusterConfig.legacyPrivilegeEvaluation) {
14831483
assertThat(httpResponse, containsExactly(index_c1).at("_index").reducedBy(user.reference(READ)).whenEmpty(isForbidden()));
14841484
} else {
1485-
if (user.reference(READ_NEXT_GEN).covers(alias_c1)) {
1485+
if (user.reference(READ_V4).covers(alias_c1)) {
14861486
assertThat(httpResponse, containsExactly(index_c1).at("_index"));
14871487
} else {
14881488
assertThat(httpResponse, isForbidden("/error/root_cause/0/reason", "no permissions for [indices:data/read/get]"));
@@ -1991,7 +1991,7 @@ public void resolve_wildcard() throws Exception {
19911991
containsExactly(index_a1, index_a2, index_a3, index_b1, index_b2, index_b3, index_c1, alias_ab1, alias_c1).at(
19921992
"$.*[*].name"
19931993
)
1994-
.reducedBy(user.reference(clusterConfig.legacyPrivilegeEvaluation ? READ : READ_NEXT_GEN))
1994+
.reducedBy(user.reference(clusterConfig.legacyPrivilegeEvaluation ? READ : READ_V4))
19951995
.whenEmpty(clusterConfig.allowsEmptyResultSets ? isOk() : isForbidden())
19961996
);
19971997
} else {
@@ -2022,7 +2022,7 @@ public void resolve_wildcard_includeHidden() throws Exception {
20222022
assertThat(
20232023
httpResponse,
20242024
containsExactly(ALL_INDICES_AND_ALIASES).at("$.*[*].name")
2025-
.reducedBy(user.reference(clusterConfig.legacyPrivilegeEvaluation ? READ : READ_NEXT_GEN))
2025+
.reducedBy(user.reference(clusterConfig.legacyPrivilegeEvaluation ? READ : READ_V4))
20262026
.whenEmpty(clusterConfig.allowsEmptyResultSets ? isOk() : isForbidden())
20272027
);
20282028
} else {

‎src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ void updateConfiguration(
9393
enum PrivilegesEvaluatorType {
9494
NOT_INITIALIZED((c, d) -> new NotInitialized(c)),
9595
LEGACY(PrivilegesEvaluatorImpl::new),
96-
NEXT_GEN(org.opensearch.security.privileges.actionlevel.nextgen.PrivilegesEvaluatorImpl::new);
96+
V4(org.opensearch.security.privileges.actionlevel.nextgen.PrivilegesEvaluatorImpl::new);
9797

9898
static PrivilegesEvaluatorType getFrom(SecurityDynamicConfiguration<ConfigV7> configConfig) {
9999
final PrivilegesEvaluatorType defaultValue = LEGACY;
@@ -106,8 +106,8 @@ static PrivilegesEvaluatorType getFrom(SecurityDynamicConfiguration<ConfigV7> co
106106
if (config == null || config.dynamic == null) {
107107
return defaultValue;
108108
}
109-
if (NEXT_GEN.name().equalsIgnoreCase(config.dynamic.privilegesEvaluationType)) {
110-
return NEXT_GEN;
109+
if (V4.name().equalsIgnoreCase(config.dynamic.privilegesEvaluationType)) {
110+
return V4;
111111
} else {
112112
return LEGACY;
113113
}

‎src/main/java/org/opensearch/security/privileges/actionlevel/nextgen/PrivilegesEvaluatorImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -453,7 +453,7 @@ public boolean notFailOnForbiddenEnabled() {
453453

454454
@Override
455455
public PrivilegesEvaluatorType type() {
456-
return PrivilegesEvaluatorType.NEXT_GEN;
456+
return PrivilegesEvaluatorType.V4;
457457
}
458458

459459
void logPrivilegeEvaluationResult(PrivilegesEvaluationContext context, PrivilegesEvaluatorResponse result, String privilegeType) {

‎src/main/java/org/opensearch/security/securityconf/impl/v7/ConfigV7.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ public static class Dynamic {
9292

9393
/**
9494
* This is a successor to the do_not_fail_on_forbidden property; it is only evaluated if
95-
* privilegesEvaluationType is set to "next_gen"; we cannot reuse the old property as it we cannot change
95+
* privilegesEvaluationType is set to "v4"; we cannot reuse the old property as it we cannot change
9696
* the default value of it based on privileges_evaluation_type.
9797
* This should be only very rarely set to "false"; if it is false, users must make sure that they
9898
* are not hitting any unauthorized indices in their patterns, including system indices, as otherwise these requests

0 commit comments

Comments
 (0)