Allow Plugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install #15778

cwperks · 2024-09-05T20:56:12Z

Description

In #14630, a new extension point was created called IdentityAwarePlugin that has a single method called assignSubject. The subject that is given to IdentityAwarePlugin is intended to be a replacement for try (ThreadContext.StoredContext ctx = threadContext.stashContext() { ... }) and ensures that the security plugin can enforce authz checks on transport actions in this privileged block. The replacement is utilizing the assigned plugin subject and instead wrapping a block with pluginSubject.runAs(() -> { ... }) which injects an identity associated with the plugin so that the Security plugin (i.e. the IdentityPlugin) can authorize the transport actions instead of allowing the plugin to operate unrestricted.

This PR allows a plugin to define a plugin-permissions.yml file on the same level as plugin-security.policy file that can have 2 keys: 1) cluster.actions and 2) indices.actions

Example

cluster.actions:
  - cluster:monitor/health
index.actions:
  security-auditlog*:
    - indices:data/write/index*

This PR modifies the plugin-cli to prompt a cluster admin with the requested permissions. See an example below where I modified the security plugin to be an IdentityAwarePlugin and request permission to write to the security-auditlog-* index pattern. The security plugin always needs to be able to write to this index pattern regardless of the authenticated user's permissions.

➜  opensearch-3.0.0-SNAPSHOT git:(identity-aware-plugin-request-perms) ./bin/opensearch-plugin install file:/Users/cwperx/Projects/opensearch/security/build/distributions/opensearch-security-3.0.0.0-SNAPSHOT.zip
-> Installing file:/Users/cwperx/Projects/opensearch/security/build/distributions/opensearch-security-3.0.0.0-SNAPSHOT.zip
-> Downloading file:/Users/cwperx/Projects/opensearch/security/build/distributions/opensearch-security-3.0.0.0-SNAPSHOT.zip
[=================================================] 100%
Sep 05, 2024 4:45:01 PM org.apache.lucene.internal.vectorization.VectorizationProvider lookup
WARNING: Java vector incubator module is not readable. For optimal vector performance, pass '--add-modules jdk.incubator.vector' to enable Vector API.
16:45:01.758 [main] INFO  org.opensearch.security.ssl.transport.SSLConfig - SSL dual mode is disabled
16:45:01.759 [main] WARN  org.opensearch.security.OpenSearchSecurityPlugin - OpenSearch Security plugin installed but disabled. This can expose your configuration (including passwords) to the public.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /proc/sys/net/core/somaxconn#plus read
* java.lang.RuntimePermission accessClassInPackage.com.sun.jndi.*
* java.lang.RuntimePermission accessClassInPackage.sun.misc
* java.lang.RuntimePermission accessClassInPackage.sun.nio.ch
* java.lang.RuntimePermission accessClassInPackage.sun.security.x509
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission accessUserInformation
* java.lang.RuntimePermission createClassLoader
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission setContextClassLoader
* java.lang.RuntimePermission shutdownHooks
* java.lang.reflect.ReflectPermission suppressAccessChecks
* java.net.NetPermission getNetworkInformation
* java.net.NetPermission getProxySelector
* java.net.SocketPermission * connect,accept,resolve
* java.security.SecurityPermission getProperty.org.bouncycastle.ec.max_f2m_field_size
* java.security.SecurityPermission getProperty.org.bouncycastle.pkcs12.default
* java.security.SecurityPermission getProperty.org.bouncycastle.rsa.max_mr_tests
* java.security.SecurityPermission getProperty.org.bouncycastle.rsa.max_size
* java.security.SecurityPermission getProperty.ssl.KeyManagerFactory.algorithm
* java.security.SecurityPermission insertProvider.BC
* java.security.SecurityPermission org.apache.xml.security.register
* java.security.SecurityPermission putProviderProperty.BC
* java.security.SecurityPermission removeProviderProperty.BC
* java.security.SecurityPermission setProperty.ocsp.enable
* java.util.PropertyPermission * read,write
* javax.security.auth.AuthPermission doAs
* javax.security.auth.AuthPermission modifyPrivateCredentials
* javax.security.auth.kerberos.ServicePermission * accept
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Plugin requests permission to perform the following transport actions. Any index
pattern that appears below is a default value and may change depending on plugin settings.

Cluster Actions
---------------

* cluster:monitor/health

Index Actions
-------------

Index Pattern: security-auditlog-*

* indices:data/write/index

Continue with installation? [y/N]

In order to extract the requested actions in plugin-cli I had to create a new method in the PluginsService to try instantiating a plugin with empty settings.

Related Issues

#15958

Check List

Functionality includes testing.
API changes companion pull request created, if applicable.
Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks · 2024-09-05T20:58:07Z

@sohami I opened this Draft PR to show how a mechanism can work for plugins to request to perform an enumerable set of transport actions within a pluginSubject.runAs(() -> { ... }) block (replacement for try (ThreadContext.StoredContext ctx = threadContext.stashContext()) { ... }).

opensearch-project/opensearch-plugins#238 (comment)'

@prudhvigodithi You may be interested in this PR as well.

github-actions · 2024-09-05T21:23:49Z

❌ Gradle check result for a841f06: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-19T14:58:19Z

❌ Gradle check result for a2fb0fd: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-19T17:00:47Z

❌ Gradle check result for 758b671: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-19T18:34:12Z

❌ Gradle check result for 4cdd593: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-19T19:50:30Z

❌ Gradle check result for 394c47a: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2024-09-19T20:50:23Z

✅ Gradle check result for 394c47a: SUCCESS

github-actions · 2024-09-20T14:05:38Z

❌ Gradle check result for fde386d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

cwperks · 2024-09-20T14:06:14Z

server/src/main/java/org/opensearch/plugins/PluginSecurity.java

+     */
+    @SuppressWarnings("removal")
+    public static Settings parseRequestedActions(Path file) throws IOException {
+        return Settings.builder().loadFromPath(file).build();


I chose to use the Settings object in here since Settings already supports reading in Yaml files.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-20T14:54:45Z

❌ Gradle check result for c12df2d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2024-09-20T16:10:49Z

✅ Gradle check result for abbb6f0: SUCCESS

cwperks added 2 commits September 4, 2024 23:43

WIP on requesting perms and displaying on install

43e8974

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Actually compile a fake plugin in InstallPluginCommandTests

a841f06

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks changed the title ~~Allow IdentityAwarePlugins to request to perform cluster actions and index actions with their assigned PluginSubject~~ Allow IdentityAwarePlugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install Sep 5, 2024

cwperks mentioned this pull request Sep 6, 2024

Implement new extension points in IdentityPlugin and add ContextProvidingPluginSubject opensearch-project/security#4665

Open

5 tasks

cwperks added 2 commits September 16, 2024 14:39

Merge branch 'main' into identity-aware-plugin-request-perms

edfbe36

Add test for prompt when installing IdentityAwarePlugin

5821632

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks marked this pull request as ready for review September 16, 2024 19:35

cwperks requested review from anasalkouz, andrross, ashking94, Bukhtawar, CEHENKLE, dblock, dbwiddis, gbbafna, jainankitk, kotwanikunal, linuxpi, mch2, msfroh, nknize, owaiskazi19, reta, Rishikesh1159, sachinpkale, saratvemulapalli, shwetathareja and sohami as code owners September 16, 2024 19:35

Add null check

a2fb0fd

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Check stream version

758b671

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Check version when serializing

4cdd593

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Handle case where requestedActions is null

394c47a

Signed-off-by: Craig Perkins <cwperx@amazon.com>

This was referenced Sep 20, 2024

[AUTOCUT] Gradle Check Flaky Test Report for MinimumClusterManagerNodesIT #14289

Open

[AUTOCUT] Gradle Check Flaky Test Report for RemoteStoreStatsIT #14310

Open

[AUTOCUT] Gradle Check Flaky Test Report for SpecificClusterManagerNodesIT #15944

Open

cwperks marked this pull request as ready for review September 20, 2024 12:09

cwperks requested a review from peternied as a code owner September 20, 2024 12:09

Merge branch 'main' into identity-aware-plugin-request-perms

fde386d

cwperks commented Sep 20, 2024

View reviewed changes

cwperks added 4 commits September 20, 2024 10:09

Ensure requestedActions is non-null

157740b

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Simplify tests

bf44a29

Signed-off-by: Craig Perkins <cwperx@amazon.com>

modify correct build.gradle

8b16051

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Remove unused code

c12df2d

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Remove unused import

abbb6f0

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks mentioned this pull request Sep 20, 2024

Remove Identity FeatureFlag #16024

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow Plugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install #15778

Allow Plugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install #15778

cwperks commented Sep 5, 2024 •

edited

Loading

cwperks commented Sep 5, 2024 •

edited

Loading

github-actions bot commented Sep 5, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 20, 2024

cwperks Sep 20, 2024

github-actions bot commented Sep 20, 2024

github-actions bot commented Sep 20, 2024

Allow Plugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install #15778

Are you sure you want to change the base?

Allow Plugins to request to perform cluster actions and index actions with their assigned PluginSubject and prompt on install #15778

Conversation

cwperks commented Sep 5, 2024 • edited Loading

Description

Related Issues

Check List

cwperks commented Sep 5, 2024 • edited Loading

github-actions bot commented Sep 5, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 19, 2024

github-actions bot commented Sep 20, 2024

cwperks Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot commented Sep 20, 2024

github-actions bot commented Sep 20, 2024

cwperks commented Sep 5, 2024 •

edited

Loading

cwperks commented Sep 5, 2024 •

edited

Loading