Skip to content

Commit f1376de

Browse files
jakelandisjakelandis
authored
[8.15] Fix RoleDescriptor test that fails randomly (elastic#116852) (elastic#117032)
* Fix RoleDescriptor test that fails randomly (elastic#116852) This commit fixes a test fails based on the random seed. The change updates the name of the test to match the updated name of the method it is testing. It also re-implements the test to rely less on randomness and explicitly tests the possible inputs. fixes elastic#116376 (cherry picked from commit 0795703) # Conflicts: # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptorTests.java * remove rouge import
1 parent 2ac10a0 commit f1376de

File tree

1 file changed

+172
-16
lines changed

1 file changed

+172
-16
lines changed

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptorTests.java

Lines changed: 172 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,12 @@
3131
import org.elasticsearch.xpack.core.XPackClientPlugin;
3232
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.ApplicationResourcePrivileges;
3333
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
34+
import org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissionGroup;
3435
import org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissions;
3536
import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
3637
import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivileges;
38+
import org.elasticsearch.xpack.core.security.authz.restriction.Workflow;
39+
import org.elasticsearch.xpack.core.security.authz.restriction.WorkflowResolver;
3740
import org.hamcrest.Matchers;
3841

3942
import java.io.IOException;
@@ -46,7 +49,6 @@
4649

4750
import static org.elasticsearch.xcontent.XContentFactory.jsonBuilder;
4851
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptor.WORKFLOWS_RESTRICTION_VERSION;
49-
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomIndicesPrivileges;
5052
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomIndicesPrivilegesBuilder;
5153
import static org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper.randomRemoteClusterPermissions;
5254
import static org.hamcrest.Matchers.arrayContaining;
@@ -1312,37 +1314,191 @@ public void testIsEmpty() {
13121314
}
13131315
}
13141316

1315-
public void testHasPrivilegesOtherThanIndex() {
1317+
public void testHasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster() {
1318+
// any index and some cluster privileges are allowed
13161319
assertThat(
13171320
new RoleDescriptor(
13181321
"name",
1322+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]), // all of these are allowed
1323+
new RoleDescriptor.IndicesPrivileges[] {
1324+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1325+
null,
1326+
null,
1327+
null,
1328+
null,
1329+
null,
1330+
null,
1331+
null,
1332+
null,
1333+
null
1334+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1335+
is(false)
1336+
);
1337+
// any index and some cluster privileges are allowed
1338+
assertThat(
1339+
new RoleDescriptor(
1340+
"name",
1341+
new String[] { "manage_security" }, // unlikely we will ever support allowing manage security across clusters
1342+
new RoleDescriptor.IndicesPrivileges[] {
1343+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1344+
null,
1345+
null,
1346+
null,
1347+
null,
1348+
null,
1349+
null,
1350+
null,
1351+
null,
1352+
null
1353+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1354+
is(true)
1355+
);
1356+
1357+
// application privileges are not allowed
1358+
assertThat(
1359+
new RoleDescriptor(
1360+
"name",
1361+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1362+
new RoleDescriptor.IndicesPrivileges[] {
1363+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1364+
new ApplicationResourcePrivileges[] {
1365+
ApplicationResourcePrivileges.builder().application("app").privileges("foo").resources("res").build() },
1366+
null,
1367+
null,
1368+
null,
1369+
null,
1370+
null,
1371+
null,
1372+
null,
1373+
null
1374+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1375+
is(true)
1376+
);
1377+
1378+
// configurable cluster privileges are not allowed
1379+
assertThat(
1380+
new RoleDescriptor(
1381+
"name",
1382+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1383+
new RoleDescriptor.IndicesPrivileges[] {
1384+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1385+
null,
1386+
new ConfigurableClusterPrivilege[] {
1387+
new ConfigurableClusterPrivileges.ManageApplicationPrivileges(Collections.singleton("foo")) },
1388+
null,
1389+
null,
1390+
null,
1391+
null,
1392+
null,
1393+
null,
1394+
null
1395+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1396+
is(true)
1397+
);
1398+
1399+
// run as is not allowed
1400+
assertThat(
1401+
new RoleDescriptor(
1402+
"name",
1403+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1404+
new RoleDescriptor.IndicesPrivileges[] {
1405+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1406+
null,
1407+
null,
1408+
new String[] { "foo" },
1409+
null,
1410+
null,
1411+
null,
1412+
null,
1413+
null,
1414+
null
1415+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1416+
is(true)
1417+
);
1418+
1419+
// workflows restriction is not allowed
1420+
assertThat(
1421+
new RoleDescriptor(
1422+
"name",
1423+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1424+
new RoleDescriptor.IndicesPrivileges[] {
1425+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
13191426
null,
1320-
randomBoolean() ? null : randomIndicesPrivileges(1, 5),
13211427
null,
13221428
null,
13231429
null,
13241430
null,
13251431
null,
13261432
null,
1433+
new RoleDescriptor.Restriction(WorkflowResolver.allWorkflows().stream().map(Workflow::name).toArray(String[]::new)),
1434+
null
1435+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1436+
is(true)
1437+
);
1438+
// remote indices privileges are not allowed
1439+
assertThat(
1440+
new RoleDescriptor(
1441+
"name",
1442+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1443+
new RoleDescriptor.IndicesPrivileges[] {
1444+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1445+
null,
1446+
null,
1447+
null,
1448+
null,
1449+
null,
1450+
new RoleDescriptor.RemoteIndicesPrivileges[] {
1451+
RoleDescriptor.RemoteIndicesPrivileges.builder("rmt").indices("idx").privileges("foo").build() },
13271452
null,
13281453
null,
13291454
null
13301455
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1456+
is(true)
1457+
);
1458+
// remote cluster privileges are not allowed
1459+
assertThat(
1460+
new RoleDescriptor(
1461+
"name",
1462+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1463+
new RoleDescriptor.IndicesPrivileges[] {
1464+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1465+
null,
1466+
null,
1467+
null,
1468+
null,
1469+
null,
1470+
null,
1471+
new RemoteClusterPermissions().addGroup(
1472+
new RemoteClusterPermissionGroup(
1473+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1474+
new String[] { "rmt" }
1475+
)
1476+
),
1477+
null,
1478+
null
1479+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
1480+
is(true)
1481+
);
1482+
1483+
// metadata, transient metadata and description are allowed
1484+
assertThat(
1485+
new RoleDescriptor(
1486+
"name",
1487+
RemoteClusterPermissions.getSupportedRemoteClusterPermissions().toArray(new String[0]),
1488+
new RoleDescriptor.IndicesPrivileges[] {
1489+
RoleDescriptor.IndicesPrivileges.builder().indices("idx").privileges("foo").build() },
1490+
null,
1491+
null,
1492+
null,
1493+
Collections.singletonMap("foo", "bar"),
1494+
Collections.singletonMap("foo", "bar"),
1495+
null,
1496+
null,
1497+
null,
1498+
"description"
1499+
).hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(),
13311500
is(false)
13321501
);
1333-
final RoleDescriptor roleDescriptor = RoleDescriptorTestHelper.builder()
1334-
.allowReservedMetadata(true)
1335-
.allowRemoteIndices(true)
1336-
.allowRestriction(true)
1337-
.allowDescription(true)
1338-
.allowRemoteClusters(true)
1339-
.build();
1340-
final boolean expected = roleDescriptor.hasClusterPrivileges()
1341-
|| roleDescriptor.hasConfigurableClusterPrivileges()
1342-
|| roleDescriptor.hasApplicationPrivileges()
1343-
|| roleDescriptor.hasRunAs()
1344-
|| roleDescriptor.hasRemoteIndicesPrivileges();
1345-
assertThat(roleDescriptor.hasUnsupportedPrivilegesInsideAPIKeyConnectedRemoteCluster(), equalTo(expected));
13461502
}
13471503

13481504
private static void resetFieldPermssionsCache() {

0 commit comments

Comments
 (0)