Skip to content

Native roles store uses mget to retrieve roles #33531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 21 commits into from
Oct 30, 2018
Merged

Native roles store uses mget to retrieve roles #33531

Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
629b4a2
Native roles store uses mget to retrieve roles
jaymode Sep 7, 2018
2be96aa
Merge branch 'master' into roles_use_mget
jaymode Sep 11, 2018
a4016e4
fix checkstyle
jaymode Sep 11, 2018
df8e6b9
Merge branch 'master' into roles_use_mget
jaymode Sep 12, 2018
ac0eda9
ensure role exists before trying to transform
jaymode Sep 12, 2018
c5d2a63
Merge branch 'master' into roles_use_mget
jaymode Oct 15, 2018
7c9d0af
fix error handling
jaymode Oct 15, 2018
7266147
Merge branch 'master' into roles_use_mget
jaymode Oct 16, 2018
3aaf5af
fix retrieve all
jaymode Oct 16, 2018
ada770a
Merge branch 'master' into roles_use_mget
jaymode Oct 16, 2018
453323d
Merge branch 'master' into roles_use_mget
jaymode Oct 22, 2018
3da780b
Merge branch 'master' into roles_use_mget
jaymode Oct 22, 2018
f958999
Merge branch 'master' into roles_use_mget
jaymode Oct 24, 2018
7b707cd
any failure means failure in native store
jaymode Oct 24, 2018
27dabe6
Merge branch 'master' into roles_use_mget
jaymode Oct 24, 2018
fbadafd
Merge branch 'master' into roles_use_mget
jaymode Oct 24, 2018
aae1861
Merge branch 'master' into roles_use_mget
jaymode Oct 25, 2018
1b4af47
Merge branch 'master' into roles_use_mget
jaymode Oct 26, 2018
bab7819
add missing return statement
jaymode Oct 26, 2018
80f645c
Merge branch 'master' into roles_use_mget
jaymode Oct 29, 2018
c8db29e
fix wrong keepalive value
jaymode Oct 29, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 48 additions & 25 deletions ...security/src/main/java/org/elasticsearch/xpack/security/authz/store/NativeRolesStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@
import org.elasticsearch.action.delete.DeleteRequest;
import org.elasticsearch.action.delete.DeleteResponse;
import org.elasticsearch.action.get.GetResponse;
import org.elasticsearch.action.get.MultiGetItemResponse;
import org.elasticsearch.action.get.MultiGetRequest;
import org.elasticsearch.action.get.MultiGetResponse;
import org.elasticsearch.action.index.IndexRequest;
import org.elasticsearch.action.index.IndexResponse;
import org.elasticsearch.action.search.MultiSearchResponse;
Expand Down Expand Up @@ -49,7 +52,6 @@
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
Expand Down Expand Up @@ -113,33 +115,54 @@ public void getRoleDescriptors(Set<String> names, final ActionListener<RoleRetri
if (securityIndex.indexExists() == false) {
// TODO remove this short circuiting and fix tests that fail without this!
listener.onResponse(RoleRetrievalResult.success(Collections.emptySet()));
} else if (names != null && names.size() == 1) {
getRoleDescriptor(Objects.requireNonNull(names.iterator().next()), listener);
} else {
} else if (names == null || names.isEmpty()) {
securityIndex.checkIndexVersionThenExecute(listener::onFailure, () -> {
QueryBuilder query;
if (names == null || names.isEmpty()) {
query = QueryBuilders.termQuery(RoleDescriptor.Fields.TYPE.getPreferredName(), ROLE_TYPE);
} else {
final String[] roleNames = names.stream().map(NativeRolesStore::getIdForUser).toArray(String[]::new);
query = QueryBuilders.boolQuery().filter(QueryBuilders.idsQuery(ROLE_DOC_TYPE).addIds(roleNames));
}
QueryBuilder query = QueryBuilders.termQuery(RoleDescriptor.Fields.TYPE.getPreferredName(), ROLE_TYPE);
final Supplier<ThreadContext.StoredContext> supplier = client.threadPool().getThreadContext().newRestorableContext(false);
try (ThreadContext.StoredContext ignore = stashWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN)) {
SearchRequest request = client.prepareSearch(SecurityIndexManager.SECURITY_INDEX_NAME)
.setScroll(DEFAULT_KEEPALIVE_SETTING.get(settings))
.setQuery(query)
.setSize(1000)
.setFetchSource(true)
.request();
.setScroll(DEFAULT_KEEPALIVE_SETTING.get(settings))
.setQuery(query)
.setSize(1000)
.setFetchSource(true)
.request();
request.indicesOptions().ignoreUnavailable();
final ActionListener<Collection<RoleDescriptor>> descriptorsListener = ActionListener.wrap(
roleDescriptors -> listener.onResponse(RoleRetrievalResult.success(new HashSet<>(roleDescriptors))),
e -> listener.onResponse(RoleRetrievalResult.failure(e)));
ScrollHelper.fetchAllByEntity(client, request, new ContextPreservingActionListener<>(supplier, descriptorsListener),
(hit) -> transformRole(hit.getId(), hit.getSourceRef(), logger, licenseState));
ScrollHelper.fetchAllByEntity(client, request, new ContextPreservingActionListener<>(supplier,
ActionListener.wrap(roles -> listener.onResponse(RoleRetrievalResult.success(new HashSet<>(roles))),
e -> listener.onResponse(RoleRetrievalResult.failure(e)))),
(hit) -> transformRole(hit.getId(), hit.getSourceRef(), logger, licenseState));
}
});
} else if (names.size() == 1) {
getRoleDescriptor(Objects.requireNonNull(names.iterator().next()), listener);
} else {
securityIndex.checkIndexVersionThenExecute(listener::onFailure, () -> {
final String[] roleIds = names.stream().map(NativeRolesStore::getIdForRole).toArray(String[]::new);
MultiGetRequest multiGetRequest = client.prepareMultiGet().add(SECURITY_INDEX_NAME, ROLE_DOC_TYPE, roleIds).request();
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN, multiGetRequest,
ActionListener.<MultiGetResponse>wrap(mGetResponse -> {
final MultiGetItemResponse[] responses = mGetResponse.getResponses();
Set<RoleDescriptor> descriptors = new HashSet<>();
for (int i = 0; i < responses.length; i++) {
MultiGetItemResponse item = responses[i];
if (item.isFailed()) {
final Exception failure = item.getFailure().getFailure();
for (int j = i + 1; j < responses.length; j++) {
item = responses[j];
if (item.isFailed()) {
failure.addSuppressed(failure);
}
}
listener.onResponse(RoleRetrievalResult.failure(failure));
return;
} else if (item.getResponse().isExists()) {
descriptors.add(transformRole(item.getResponse()));
}
}
listener.onResponse(RoleRetrievalResult.success(descriptors));
},
e -> listener.onResponse(RoleRetrievalResult.failure(e))), client::multiGet);
});
}
}

Expand All @@ -152,7 +175,7 @@ public void deleteRole(final DeleteRoleRequest deleteRoleRequest, final ActionLi
} else {
securityIndex.checkIndexVersionThenExecute(listener::onFailure, () -> {
DeleteRequest request = client.prepareDelete(SecurityIndexManager.SECURITY_INDEX_NAME,
ROLE_DOC_TYPE, getIdForUser(deleteRoleRequest.name())).request();
ROLE_DOC_TYPE, getIdForRole(deleteRoleRequest.name())).request();
request.setRefreshPolicy(deleteRoleRequest.getRefreshPolicy());
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN, request,
new ActionListener<DeleteResponse>() {
Expand Down Expand Up @@ -192,7 +215,7 @@ void innerPutRole(final PutRoleRequest request, final RoleDescriptor role, final
listener.onFailure(e);
return;
}
final IndexRequest indexRequest = client.prepareIndex(SECURITY_INDEX_NAME, ROLE_DOC_TYPE, getIdForUser(role.getName()))
final IndexRequest indexRequest = client.prepareIndex(SECURITY_INDEX_NAME, ROLE_DOC_TYPE, getIdForRole(role.getName()))
.setSource(xContentBuilder)
.setRefreshPolicy(request.getRefreshPolicy())
.request();
Expand Down Expand Up @@ -308,7 +331,7 @@ private void executeGetRoleRequest(String role, ActionListener<GetResponse> list
securityIndex.checkIndexVersionThenExecute(listener::onFailure, () ->
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN,
client.prepareGet(SECURITY_INDEX_NAME,
ROLE_DOC_TYPE, getIdForUser(role)).request(),
ROLE_DOC_TYPE, getIdForRole(role)).request(),
listener,
client::get));
}
Expand Down Expand Up @@ -388,7 +411,7 @@ public static void addSettings(List<Setting<?>> settings) {
/**
* Gets the document's id field for the given role name.
*/
private static String getIdForUser(final String roleName) {
private static String getIdForRole(final String roleName) {
return ROLE_TYPE + "-" + roleName;
}
}