forked from opensearch-project/security
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Prabhas Kurapati <prabhask@berkeley.edu>
- Loading branch information
Showing
10 changed files
with
436 additions
and
53 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
57 changes: 57 additions & 0 deletions
57
src/integrationTest/java/org/opensearch/security/api/FlushCacheApiIntegrationTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.api; | ||
|
|
||
| import org.junit.Test; | ||
|
|
||
| import static org.hamcrest.CoreMatchers.is; | ||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
|
|
||
| public class FlushCacheApiIntegrationTest extends AbstractApiIntegrationTest { | ||
| private final static String TEST_USER = "testuser"; | ||
|
|
||
| private String cachePath() { | ||
| return super.apiPath("cache"); | ||
| } | ||
|
|
||
| private String cachePath(String user) { | ||
| return super.apiPath("cache", "user", user); | ||
| } | ||
|
|
||
| @Test | ||
| public void testFlushCache() throws Exception { | ||
| withUser(NEW_USER, client -> { | ||
| forbidden(() -> client.get(cachePath())); | ||
| forbidden(() -> client.postJson(cachePath(), EMPTY_BODY)); | ||
| forbidden(() -> client.putJson(cachePath(), EMPTY_BODY)); | ||
| forbidden(() -> client.delete(cachePath())); | ||
| forbidden(() -> client.delete(cachePath(TEST_USER))); | ||
| }); | ||
| withUser(ADMIN_USER_NAME, localCluster.getAdminCertificate(), client -> { | ||
| notImplemented(() -> client.get(cachePath())); | ||
| notImplemented(() -> client.postJson(cachePath(), EMPTY_BODY)); | ||
| notImplemented(() -> client.putJson(cachePath(), EMPTY_BODY)); | ||
| final var deleteAllCacheResponse = ok(() -> client.delete(cachePath())); | ||
| assertThat( | ||
| deleteAllCacheResponse.getBody(), | ||
| deleteAllCacheResponse.getTextFromJsonBody("/message"), | ||
| is("Cache flushed successfully.") | ||
| ); | ||
| final var deleteUserCacheResponse = ok(() -> client.delete(cachePath(TEST_USER))); | ||
| assertThat( | ||
| deleteUserCacheResponse.getBody(), | ||
| deleteAllCacheResponse.getTextFromJsonBody("/message"), | ||
| is("Cache invalidated for user: " + TEST_USER) | ||
| ); | ||
| }); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
188 changes: 188 additions & 0 deletions
188
src/integrationTest/java/org/opensearch/security/http/LdapAuthenticationCacheTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,188 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| */ | ||
| package org.opensearch.security.http; | ||
|
|
||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope; | ||
| import org.junit.ClassRule; | ||
| import org.junit.Rule; | ||
| import org.junit.Test; | ||
| import org.junit.rules.RuleChain; | ||
| import org.junit.runner.RunWith; | ||
|
|
||
| import org.opensearch.security.support.ConfigConstants; | ||
| import org.opensearch.test.framework.AuthorizationBackend; | ||
| import org.opensearch.test.framework.AuthzDomain; | ||
| import org.opensearch.test.framework.LdapAuthenticationConfigBuilder; | ||
| import org.opensearch.test.framework.LdapAuthorizationConfigBuilder; | ||
| import org.opensearch.test.framework.TestSecurityConfig; | ||
| import org.opensearch.test.framework.TestSecurityConfig.AuthcDomain; | ||
| import org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AuthenticationBackend; | ||
| import org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.HttpAuthenticator; | ||
| import org.opensearch.test.framework.TestSecurityConfig.RoleMapping; | ||
| import org.opensearch.test.framework.certificate.TestCertificates; | ||
| import org.opensearch.test.framework.cluster.ClusterManager; | ||
| import org.opensearch.test.framework.cluster.LocalCluster; | ||
| import org.opensearch.test.framework.cluster.TestRestClient; | ||
| import org.opensearch.test.framework.ldap.EmbeddedLDAPServer; | ||
| import org.opensearch.test.framework.log.LogsRule; | ||
|
|
||
| import static org.hamcrest.CoreMatchers.not; | ||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
| import static org.hamcrest.Matchers.contains; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.CN_GROUP_ADMIN; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.DN_GROUPS_TEST_ORG; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.DN_OPEN_SEARCH_PEOPLE_TEST_ORG; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.DN_PEOPLE_TEST_ORG; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.LDIF_DATA; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.LDIF_DATA_UPDATED_BACKEND_ROLES; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.PASSWORD_KIRK; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.PASSWORD_OPEN_SEARCH; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.PASSWORD_SPOCK; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.USERNAME_ATTRIBUTE; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.USER_KIRK; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.USER_SEARCH; | ||
| import static org.opensearch.security.http.DirectoryInformationTrees.USER_SPOCK; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ADMIN_ENABLED; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ROLES_ENABLED; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.BASIC_AUTH_DOMAIN_ORDER; | ||
| import static org.opensearch.test.framework.TestSecurityConfig.Role.ALL_ACCESS; | ||
|
|
||
| /** | ||
| * Test uses plain (non TLS) connection between OpenSearch and LDAP server. | ||
| */ | ||
| @RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class) | ||
| @ThreadLeakScope(ThreadLeakScope.Scope.NONE) | ||
| public class LdapAuthenticationCacheTest { | ||
|
|
||
| private static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin").roles(ALL_ACCESS); | ||
|
|
||
| private static final TestCertificates TEST_CERTIFICATES = new TestCertificates(); | ||
|
|
||
| public static final EmbeddedLDAPServer embeddedLDAPServer = new EmbeddedLDAPServer( | ||
| TEST_CERTIFICATES.getRootCertificateData(), | ||
| TEST_CERTIFICATES.getLdapCertificateData(), | ||
| LDIF_DATA | ||
| ); | ||
|
|
||
| public static LocalCluster cluster = new LocalCluster.Builder().testCertificates(TEST_CERTIFICATES) | ||
| .clusterManager(ClusterManager.SINGLENODE) | ||
| .anonymousAuth(false) | ||
| .nodeSettings( | ||
| Map.of( | ||
| ConfigConstants.SECURITY_AUTHCZ_REST_IMPERSONATION_USERS + "." + ADMIN_USER.getName(), | ||
| List.of(USER_KIRK), | ||
| SECURITY_RESTAPI_ROLES_ENABLED, | ||
| List.of("user_" + ADMIN_USER.getName() + "__" + ALL_ACCESS.getName()), | ||
| SECURITY_RESTAPI_ADMIN_ENABLED, | ||
| true | ||
| ) | ||
| ) | ||
| .authc( | ||
| new AuthcDomain("ldap", BASIC_AUTH_DOMAIN_ORDER + 1, true).httpAuthenticator(new HttpAuthenticator("basic").challenge(false)) | ||
| .backend( | ||
| new AuthenticationBackend("ldap").config( | ||
| () -> LdapAuthenticationConfigBuilder.config() | ||
| // this port is available when embeddedLDAPServer is already started, therefore Supplier interface is used to | ||
| // postpone | ||
| // execution of the code in this block. | ||
| .enableSsl(false) | ||
| .enableStartTls(false) | ||
| .hosts(List.of("localhost:" + embeddedLDAPServer.getLdapNonTlsPort())) | ||
| .bindDn(DN_OPEN_SEARCH_PEOPLE_TEST_ORG) | ||
| .password(PASSWORD_OPEN_SEARCH) | ||
| .userBase(DN_PEOPLE_TEST_ORG) | ||
| .userSearch(USER_SEARCH) | ||
| .usernameAttribute(USERNAME_ATTRIBUTE) | ||
| .build() | ||
| ) | ||
| ) | ||
| ) | ||
| .authc(AUTHC_HTTPBASIC_INTERNAL) | ||
| .users(ADMIN_USER) | ||
| .rolesMapping(new RoleMapping(ALL_ACCESS.getName()).backendRoles(CN_GROUP_ADMIN)) | ||
| .authz( | ||
| new AuthzDomain("ldap_roles").httpEnabled(true) | ||
| .authorizationBackend( | ||
| new AuthorizationBackend("ldap").config( | ||
| () -> new LdapAuthorizationConfigBuilder().hosts(List.of("localhost:" + embeddedLDAPServer.getLdapNonTlsPort())) | ||
| .enableSsl(false) | ||
| .bindDn(DN_OPEN_SEARCH_PEOPLE_TEST_ORG) | ||
| .password(PASSWORD_OPEN_SEARCH) | ||
| .userBase(DN_PEOPLE_TEST_ORG) | ||
| .userSearch(USER_SEARCH) | ||
| .usernameAttribute(USERNAME_ATTRIBUTE) | ||
| .roleBase(DN_GROUPS_TEST_ORG) | ||
| .roleSearch("(uniqueMember={0})") | ||
| .userRoleAttribute(null) | ||
| .userRoleName("disabled") | ||
| .roleName("cn") | ||
| .resolveNestedRoles(true) | ||
| .build() | ||
| ) | ||
| ) | ||
| ) | ||
| .build(); | ||
|
|
||
| @ClassRule | ||
| public static RuleChain ruleChain = RuleChain.outerRule(embeddedLDAPServer).around(cluster); | ||
|
|
||
| @Rule | ||
| public LogsRule logsRule = new LogsRule("com.amazon.dlic.auth.ldap.backend.LDAPAuthenticationBackend"); | ||
|
|
||
| @Test | ||
| public void shouldAuthenticateUserWithLdap_positive() { | ||
| try (TestRestClient client = cluster.getRestClient(USER_SPOCK, PASSWORD_SPOCK)) { | ||
| TestRestClient.HttpResponse response = client.getAuthInfo(); | ||
|
|
||
| response.assertStatusCode(200); | ||
|
|
||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), contains("crew")); | ||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), not(contains("enterprise"))); | ||
| } | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(USER_KIRK, PASSWORD_KIRK)) { | ||
| TestRestClient.HttpResponse response = client.getAuthInfo(); | ||
|
|
||
| response.assertStatusCode(200); | ||
|
|
||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), contains("admin")); | ||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), not(contains("enterprise"))); | ||
| } | ||
|
|
||
| embeddedLDAPServer.loadLdifData(LDIF_DATA_UPDATED_BACKEND_ROLES); | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(ADMIN_USER)) { | ||
| TestRestClient.HttpResponse response = client.delete("_plugins/_security/api/cache/user/spock"); | ||
|
|
||
| response.assertStatusCode(200); | ||
| } | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(USER_SPOCK, PASSWORD_SPOCK)) { | ||
| TestRestClient.HttpResponse response = client.getAuthInfo(); | ||
|
|
||
| response.assertStatusCode(200); | ||
|
|
||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), contains("enterprise", "crew")); | ||
| } | ||
|
|
||
| try (TestRestClient client = cluster.getRestClient(USER_KIRK, PASSWORD_KIRK)) { | ||
| TestRestClient.HttpResponse response = client.getAuthInfo(); | ||
|
|
||
| response.assertStatusCode(200); | ||
|
|
||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), contains("admin")); | ||
| assertThat(response.getTextArrayFromJsonBody("/backend_roles"), not(contains("enterprise"))); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.