[Feature/Identity] Allow for Encryption/Decryption of Principals into PITs #4730

stephen-crawford · 2022-10-10T21:00:29Z

Changes in the ExtensionTokenProcessor class to allow for encryption & decryption of principal & extension identifiers.

Tests not yet added but will add unit tests. Right now there are some lingering issues with the code that I would appreciate feedback or thoughts on:

As you can see at Line 146, the ExtractPrincipal method attempts to return the Principal object that is extracted from the encrypted message. Right now, I am not sure that we are actually storing the Principals themselves in any way so to be able to return an entire Principal instance we would need to be able to store and then retrieve the instance via NAME lookup.

I am also not entirely convinced by my implementation of the encoding combining at Line 106. I know you can combine byte[]s in this manner but I have not had a chance to confirm this preserves the encoding integrity as expected.

Resolves

Issue [Feature/Extensions] Follow-up: Implement Encryption/Decryption for principal identifier token #4485

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
- New functionality has javadoc added
Commits are signed per the DCO using --signoff
Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-10T21:10:52Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4321/
CommitID: ceb395e

github-actions · 2022-10-11T13:41:55Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4359/
CommitID: 19ada6f

cwperks · 2022-10-11T13:55:47Z

@scrawfor99 Can you prepend the title of this PR with [Feature/Identity]? It makes it easier to find PRs against this feature branch and core maintainers can see from the description that its for the feature branch.

server/src/main/java/org/opensearch/identity/ExtensionTokenProcessor.java

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford · 2022-10-11T14:16:08Z

@scrawfor99 Can you prepend the title of this PR with [Feature/Identity]? It makes it easier to find PRs against this feature branch and core maintainers can see from the description that its for the feature branch.

Should be all set

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-11T14:21:09Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4366/
CommitID: f10d2b7

github-actions · 2022-10-11T14:25:20Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4370/
CommitID: dbe0923

github-actions · 2022-10-11T14:27:22Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4371/
CommitID: 76e5af5

cwperks

Thank you for the PR @scrawfor99! If you want to submit a PR to solicit initial feedback you can use Github's Draft PR feature to distinguish the PR as a WIP (work in progress).

Can you add tests for the functionality added in this PR?

server/src/main/java/org/opensearch/identity/ExtensionTokenProcessor.java

server/src/main/java/org/opensearch/identity/Principals.java

server/src/main/java/org/opensearch/identity/ExtensionTokenProcessor.java

stephen-crawford · 2022-10-11T14:58:42Z

Thank you for the PR @scrawfor99! If you want to submit a PR to solicit initial feedback you can use Github's Draft PR feature to distinguish the PR as a WIP (work in progress).

Oops I did not realize but will mark things as such in the future--still new to using GitHub with more than 1/2 other people haha.

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-11T16:08:57Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4392/
CommitID: 06ff2e4

github-actions · 2022-10-11T16:17:06Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4395/
CommitID: 46717dd

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-24T20:48:23Z

Gradle Check (Jenkins) Run Completed with:

RESULT: null ❌
URL: null
CommitID: c0144c1

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-24T21:15:25Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5452/
CommitID: 846d75c

github-actions · 2022-10-24T21:16:00Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5453/
CommitID: b0cddf7

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-24T21:28:21Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5458/
CommitID: 50939eb

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-24T21:37:07Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5463/
CommitID: ddd3045

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-24T21:53:40Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5466/
CommitID: f21cc99

github-actions · 2022-10-24T22:01:56Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5471/
CommitID: e55ac0d

stephen-crawford · 2022-10-25T13:12:19Z

@peternied What is the protocol for handling this? Everything seems fine on my end but now the check is failing because of memory errors from other code. Unless I am misunderstanding the console output.

peternied · 2022-10-25T13:27:10Z

Everything seems fine on my end but now the check is failing because of memory errors from other code.

Sounds like there is as bug in OpenSearch, can you capture the error output and create a bug like the following?

[BUG] flaky test index/80_geo_point/Single point test #4852

stephen-crawford · 2022-10-25T13:51:56Z

Everything seems fine on my end but now the check is failing because of memory errors from other code.

Sounds like there is as bug in OpenSearch, can you capture the error output and create a bug like the following?
* [[BUG] flaky test `index/80_geo_point/Single point test` #4852](https://github.com/opensearch-project/OpenSearch/issues/4852)

Done so awaiting response #4907

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-26T17:59:28Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5693/
CommitID: 583aee5
Please examine the workflow log, locate, and copy-paste the failure below.
Flakey test?
Iterate to green.

github-actions · 2022-10-26T17:59:30Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5693/
CommitID: b5a982c
Please examine the workflow log, locate, and copy-paste the failure below.
Flakey test?
Iterate to green.

github-actions · 2022-10-26T18:09:05Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5694/
CommitID: bef50b0
Please examine the workflow log, locate, and copy-paste the failure below.
Flakey test?
Iterate to green.

Signed-off-by: Stephen Crawford <[email protected]>

github-actions · 2022-10-26T19:20:06Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5703/
CommitID: e9be606
Please examine the workflow log, locate, and copy-paste the failure below.
Flakey test?
Iterate to green.

github-actions · 2022-10-26T19:36:17Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/5705/
CommitID: eeb453b
Please examine the workflow log, locate, and copy-paste the failure below.
Flakey test?
Iterate to green.

peternied · 2022-10-26T19:48:42Z

@scrawfor99 I merged this because the failed tests are unrelated to your changes. Next merge from main should resolve them (also what a pain!) Thanks for your contribution and stick-with-it-ness on this one!

… PITs (#4730) Allow for Encryption/Decryption of Principals into PITs Signed-off-by: Stephen Crawford <[email protected]> Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford and others added 4 commits October 7, 2022 17:01

Backend for extension IDs & secrets, then hashing

bd1c375

Signed-off-by: Stephen Crawford <[email protected]>

Hashing-based PIT Verification and Implementation

0651817

Signed-off-by: Stephen Crawford <[email protected]>

Allow for encryption/decryption of Principals into PIT

511e568

Signed-off-by: Stephen Crawford <[email protected]>

Merge branch 'opensearch-project:feature/identity' into feature/identity

ceb395e

stephen-crawford requested review from a team and reta as code owners October 10, 2022 21:00

stephen-crawford added the feedback needed Issue or PR needs feedback label Oct 10, 2022

Version bump

19ada6f

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford requested review from cwperks, peternied and DarshitChanpura October 11, 2022 13:15

cwperks reviewed Oct 11, 2022

View reviewed changes

server/src/main/java/org/opensearch/identity/ExtensionTokenProcessor.java Outdated Show resolved Hide resolved

stephen-crawford added 2 commits October 11, 2022 10:10

Validation checks for existence and length

f10d2b7

Signed-off-by: Stephen Crawford <[email protected]>

Byte array encoding fix

dbe0923

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford changed the title ~~Allow for Encryption/Decryption of Principals into PITs~~ [Feature/Identity] Allow for Encryption/Decryption of Principals into PITs Oct 11, 2022

typo fix

76e5af5

Signed-off-by: Stephen Crawford <[email protected]>

cwperks requested changes Oct 11, 2022

View reviewed changes

stephen-crawford added 2 commits October 11, 2022 12:01

Naming conventions

06ff2e4

Signed-off-by: Stephen Crawford <[email protected]>

Correct non-reset push

46717dd

Signed-off-by: Stephen Crawford <[email protected]>

Test principal name encryption/decryp

5ae24ac

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford added 3 commits October 24, 2022 16:54

remove commenting mistake

846d75c

Signed-off-by: Stephen Crawford <[email protected]>

revert

b0cddf7

Signed-off-by: Stephen Crawford <[email protected]>

Remove javadoc '@'s

50939eb

Signed-off-by: Stephen Crawford <[email protected]>

Remove javadoc '@'s

ddd3045

Signed-off-by: Stephen Crawford <[email protected]>

Remove prints

f21cc99

Signed-off-by: Stephen Crawford <[email protected]>

Spotless java

e55ac0d

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford and others added 3 commits October 26, 2022 13:36

Revert changelog

b5a982c

Signed-off-by: Stephen Crawford <[email protected]>

Merge branch 'opensearch-project:feature/identity' into feature/identity

583aee5

Readd changelog

bef50b0

Signed-off-by: Stephen Crawford <[email protected]>

Corrected PIT test; moved stream output to separate task

e9be606

Signed-off-by: Stephen Crawford <[email protected]>

stephen-crawford mentioned this pull request Oct 26, 2022

[FEATURE/IDENTITY] Incorporate byte stream processing for encryption/decryption #4943

Closed

Spotless

eeb453b

Signed-off-by: Stephen Crawford <[email protected]>

peternied merged commit d9b5059 into opensearch-project:feature/identity Oct 26, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Feature/Identity] Allow for Encryption/Decryption of Principals into PITs #4730

[Feature/Identity] Allow for Encryption/Decryption of Principals into PITs #4730

stephen-crawford commented Oct 10, 2022 •

edited

Loading

github-actions bot commented Oct 10, 2022

github-actions bot commented Oct 11, 2022

cwperks commented Oct 11, 2022

stephen-crawford commented Oct 11, 2022

github-actions bot commented Oct 11, 2022

github-actions bot commented Oct 11, 2022

github-actions bot commented Oct 11, 2022

cwperks left a comment

stephen-crawford commented Oct 11, 2022 •

edited

Loading

github-actions bot commented Oct 11, 2022

github-actions bot commented Oct 11, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

github-actions bot commented Oct 24, 2022

stephen-crawford commented Oct 25, 2022

peternied commented Oct 25, 2022

stephen-crawford commented Oct 25, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

peternied commented Oct 26, 2022

[Feature/Identity] Allow for Encryption/Decryption of Principals into PITs #4730

[Feature/Identity] Allow for Encryption/Decryption of Principals into PITs #4730

Conversation

stephen-crawford commented Oct 10, 2022 • edited Loading

Check List

github-actions bot commented Oct 10, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

cwperks commented Oct 11, 2022

stephen-crawford commented Oct 11, 2022

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

cwperks left a comment

Choose a reason for hiding this comment

stephen-crawford commented Oct 11, 2022 • edited Loading

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 11, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 24, 2022

Gradle Check (Jenkins) Run Completed with:

stephen-crawford commented Oct 25, 2022

peternied commented Oct 25, 2022

stephen-crawford commented Oct 25, 2022

github-actions bot commented Oct 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 26, 2022

Gradle Check (Jenkins) Run Completed with:

peternied commented Oct 26, 2022

stephen-crawford commented Oct 10, 2022 •

edited

Loading

stephen-crawford commented Oct 11, 2022 •

edited

Loading