From 3cbc910b0fc73648abfec28e87f7a0f6193d8234 Mon Sep 17 00:00:00 2001 From: Ryan Liang Date: Thu, 19 Oct 2023 14:58:43 -0700 Subject: [PATCH] Add doPrivileged change Signed-off-by: Ryan Liang --- .../security/http/OnBehalfOfAuthenticator.java | 14 ++++++++++++-- .../security/http/OnBehalfOfAuthenticatorTest.java | 2 +- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/src/main/java/org/opensearch/security/http/OnBehalfOfAuthenticator.java b/src/main/java/org/opensearch/security/http/OnBehalfOfAuthenticator.java index d2973614c8..a3d3dec710 100644 --- a/src/main/java/org/opensearch/security/http/OnBehalfOfAuthenticator.java +++ b/src/main/java/org/opensearch/security/http/OnBehalfOfAuthenticator.java @@ -67,8 +67,18 @@ public OnBehalfOfAuthenticator(Settings settings, String clusterName) { String oboEnabledSetting = settings.get("enabled", "true"); oboEnabled = Boolean.parseBoolean(oboEnabledSetting); encryptionKey = settings.get("encryption_key"); - JwtParserBuilder builder = initParserBuilder(settings.get("signing_key")); - jwtParser = builder.build(); + + final SecurityManager sm = System.getSecurityManager(); + if (sm != null) { + sm.checkPermission(new SpecialPermission()); + } + jwtParser = AccessController.doPrivileged(new PrivilegedAction() { + @Override + public JwtParser run() { + JwtParserBuilder builder = initParserBuilder(settings.get("signing_key")); + return builder.build(); + } + }); this.clusterName = clusterName; this.encryptionUtil = new EncryptionDecryptionUtil(encryptionKey); diff --git a/src/test/java/org/opensearch/security/http/OnBehalfOfAuthenticatorTest.java b/src/test/java/org/opensearch/security/http/OnBehalfOfAuthenticatorTest.java index b32792190f..478e59ac13 100644 --- a/src/test/java/org/opensearch/security/http/OnBehalfOfAuthenticatorTest.java +++ b/src/test/java/org/opensearch/security/http/OnBehalfOfAuthenticatorTest.java @@ -349,7 +349,7 @@ public void testSecurityManagerCheck() { System.setSecurityManager(null); } - verify(mockSecurityManager, times(2)).checkPermission(any(SpecialPermission.class)); + verify(mockSecurityManager, times(3)).checkPermission(any(SpecialPermission.class)); } @Test