|
92 | 92 | import org.elasticsearch.xpack.core.ml.action.ExplainDataFrameAnalyticsAction;
|
93 | 93 | import org.elasticsearch.xpack.core.ml.action.FinalizeJobExecutionAction;
|
94 | 94 | import org.elasticsearch.xpack.core.rollup.action.GetRollupIndexCapsAction;
|
| 95 | +import org.elasticsearch.xpack.core.security.authz.accesscontrol.IndicesAccessControl; |
95 | 96 | import org.elasticsearch.xpack.core.textstructure.action.FindStructureAction;
|
96 | 97 | import org.elasticsearch.xpack.core.ml.action.FlushJobAction;
|
97 | 98 | import org.elasticsearch.xpack.core.ml.action.ForecastJobAction;
|
@@ -1217,25 +1218,25 @@ public void testSuperuserRole() {
|
1217 | 1218 |
|
1218 | 1219 | FieldPermissionsCache fieldPermissionsCache = new FieldPermissionsCache(Settings.EMPTY);
|
1219 | 1220 | SortedMap<String, IndexAbstraction> lookup = metadata.getIndicesLookup();
|
1220 |
| - Map<String, IndexAccessControl> authzMap = |
1221 |
| - superuserRole.indices().authorize(SearchAction.NAME, Sets.newHashSet("a1", "ba"), lookup, fieldPermissionsCache); |
1222 |
| - assertThat(authzMap.get("a1").isGranted(), is(true)); |
1223 |
| - assertThat(authzMap.get("b").isGranted(), is(true)); |
1224 |
| - authzMap = |
1225 |
| - superuserRole.indices().authorize(DeleteIndexAction.NAME, Sets.newHashSet("a1", "ba"), lookup, fieldPermissionsCache); |
1226 |
| - assertThat(authzMap.get("a1").isGranted(), is(true)); |
1227 |
| - assertThat(authzMap.get("b").isGranted(), is(true)); |
1228 |
| - authzMap = superuserRole.indices().authorize(IndexAction.NAME, Sets.newHashSet("a2", "ba"), lookup, fieldPermissionsCache); |
1229 |
| - assertThat(authzMap.get("a2").isGranted(), is(true)); |
1230 |
| - assertThat(authzMap.get("b").isGranted(), is(true)); |
1231 |
| - authzMap = superuserRole.indices() |
1232 |
| - .authorize(UpdateSettingsAction.NAME, Sets.newHashSet("aaaaaa", "ba"), lookup, fieldPermissionsCache); |
1233 |
| - assertThat(authzMap.get("aaaaaa").isGranted(), is(true)); |
1234 |
| - assertThat(authzMap.get("b").isGranted(), is(true)); |
1235 |
| - authzMap = superuserRole.indices().authorize(randomFrom(IndexAction.NAME, DeleteIndexAction.NAME, SearchAction.NAME), |
| 1221 | + IndicesAccessControl indicesAccessControl = |
| 1222 | + superuserRole.authorize(SearchAction.NAME, Sets.newHashSet("a1", "ba"), lookup, fieldPermissionsCache); |
| 1223 | + assertThat(indicesAccessControl.getIndexPermissions("a1").isGranted(), is(true)); |
| 1224 | + assertThat(indicesAccessControl.getIndexPermissions("b").isGranted(), is(true)); |
| 1225 | + indicesAccessControl = |
| 1226 | + superuserRole.authorize(DeleteIndexAction.NAME, Sets.newHashSet("a1", "ba"), lookup, fieldPermissionsCache); |
| 1227 | + assertThat(indicesAccessControl.getIndexPermissions("a1").isGranted(), is(true)); |
| 1228 | + assertThat(indicesAccessControl.getIndexPermissions("b").isGranted(), is(true)); |
| 1229 | + indicesAccessControl = superuserRole.authorize(IndexAction.NAME, Sets.newHashSet("a2", "ba"), lookup, fieldPermissionsCache); |
| 1230 | + assertThat(indicesAccessControl.getIndexPermissions("a2").isGranted(), is(true)); |
| 1231 | + assertThat(indicesAccessControl.getIndexPermissions("b").isGranted(), is(true)); |
| 1232 | + indicesAccessControl = |
| 1233 | + superuserRole.authorize(UpdateSettingsAction.NAME, Sets.newHashSet("aaaaaa", "ba"), lookup, fieldPermissionsCache); |
| 1234 | + assertThat(indicesAccessControl.getIndexPermissions("aaaaaa").isGranted(), is(true)); |
| 1235 | + assertThat(indicesAccessControl.getIndexPermissions("b").isGranted(), is(true)); |
| 1236 | + indicesAccessControl = superuserRole.authorize(randomFrom(IndexAction.NAME, DeleteIndexAction.NAME, SearchAction.NAME), |
1236 | 1237 | Sets.newHashSet(RestrictedIndicesNames.SECURITY_MAIN_ALIAS), lookup, fieldPermissionsCache);
|
1237 |
| - assertThat(authzMap.get(RestrictedIndicesNames.SECURITY_MAIN_ALIAS).isGranted(), is(true)); |
1238 |
| - assertThat(authzMap.get(internalSecurityIndex).isGranted(), is(true)); |
| 1238 | + assertThat(indicesAccessControl.getIndexPermissions(RestrictedIndicesNames.SECURITY_MAIN_ALIAS).isGranted(), is(true)); |
| 1239 | + assertThat(indicesAccessControl.getIndexPermissions(internalSecurityIndex).isGranted(), is(true)); |
1239 | 1240 | assertTrue(superuserRole.indices().check(SearchAction.NAME));
|
1240 | 1241 | assertFalse(superuserRole.indices().check("unknown"));
|
1241 | 1242 |
|
|
0 commit comments