Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add search model group permission to ml_read_access role #2855

Merged
merged 3 commits into from
Jun 14, 2023
Merged

add search model group permission to ml_read_access role #2855

merged 3 commits into from
Jun 14, 2023

Conversation

rbhavna
Copy link
Contributor

@rbhavna rbhavna commented Jun 13, 2023 •
edited
Loading

Description

[Describe what this change achieves]

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
    Enhancement

  • Why these changes are required?
    ML-commons has a new index "model group" added in 2.8 release. This PR adds the search model group permission to the "ml_read_access" role.

  • What is the old behavior before changes and new behavior after changes?
    We want a user with "ml_read_access" role to be able to search the model group index. Before this change, user is not given that permission which is contrary to the expected behaviour.
    This change allows any user with "ml_read_access" role to search the model group index.

Issues Resolved

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

peternied
peternied reviewed Jun 13, 2023
View reviewed changes
config/roles.yml Outdated
@@ -262,6 +262,7 @@ ml_read_access:
- 'cluster:admin/opensearch/ml/models/search'
- 'cluster:admin/opensearch/ml/tasks/get'
- 'cluster:admin/opensearch/ml/tasks/search'
- 'cluster:admin/opensearch/ml/model_groups/search'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add this action in alphabetic order please?

@codecov
Copy link

codecov bot commented Jun 13, 2023 •
edited
Loading

Codecov Report

Merging #2855 (1ed0941) into main (2e263b8) will decrease coverage by 0.03%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2855      +/-   ##
============================================
- Coverage     61.62%   61.59%   -0.03%     
+ Complexity     3415     3413       -2     
============================================
  Files           266      266              
  Lines         18917    18917              
  Branches       3303     3303              
============================================
- Hits          11657    11652       -5     
- Misses         5665     5669       +4     
- Partials       1595     1596       +1

see 3 files with indirect coverage changes

@peternied
Copy link
Member

@rbhavna Thanks - is there a specific version you'd like this change to be back ported into?

@rbhavna
Copy link
Contributor Author

rbhavna commented Jun 13, 2023

@rbhavna Thanks - is there a specific version you'd like this change to be back ported into?

Yes, to 2.x and 2.8

@peternied peternied added the backport 2.x backport to 2.x branch label Jun 13, 2023
@peternied
Copy link
Member

2.8 has already released, but we will make sure this is merged for the 2.9 release.

@rbhavna
Copy link
Contributor Author

rbhavna commented Jun 13, 2023

@peternied @RyanL1997 Thanks

@RyanL1997 RyanL1997 merged commit 0bc7158 into opensearch-project:main Jun 14, 2023
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jun 14, 2023
@rbhavna @github-actions
add search model group permission to ml_read_access role (#2855)
87fca2a 
* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>
(cherry picked from commit 0bc7158)
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Jun 14, 2023
Merged
peternied pushed a commit that referenced this pull request Jun 14, 2023
@opensearch-trigger-bot @rbhavna
add search model group permission to ml_read_access role (#2855) (#2858)
0d6ac30 
* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>
(cherry picked from commit 0bc7158)

Co-authored-by: Bhavana Ramaram <[email protected]>
samuelcostae pushed a commit to samuelcostae/security that referenced this pull request Jun 19, 2023
@rbhavna @samuelcostae
add search model group permission to ml_read_access role (opensearch-…
62b4bac 
…project#2855)

* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>
samuelcostae pushed a commit to samuelcostae/security that referenced this pull request Jun 19, 2023
@rbhavna @samuelcostae
add search model group permission to ml_read_access role (opensearch-…
b7ddc18 
…project#2855)

* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>
Signed-off-by: Sam <[email protected]>
RyanL1997 pushed a commit to RyanL1997/security that referenced this pull request Jun 29, 2023
@rbhavna @RyanL1997
add search model group permission to ml_read_access role (opensearch-…
b6bfb11 
…project#2855)

* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>
RyanL1997 added a commit that referenced this pull request Jun 29, 2023
@RyanL1997 @rbhavna
@stephen-crawford @willyborankin @peternied @cwperks @derek-ho @pawel-gudel-eliatra
Feature branch sync 06/29/2023 (#2918)
748a711 
* add search model group permission to ml_read_access role (#2855)

* add search model group permission to ml_read_access role

Signed-off-by: Bhavana Ramaram <[email protected]>

* IntegrationTest spotless (#2863)

Signed-off-by: Stephen Crawford <[email protected]>

* Format everything (#2866)

* Use boucycastle PEM reader instead of reg expression (#2864)

Use BouncyCastle PEMReader instead of
regular expression to read and parse private key pem files.

Signed-off-by: Andrey Pleskach <[email protected]>

* Adding field level security test cases for FlatFields (#2876)

Signed-off-by: Peter Nied <[email protected]>

* Update snappy to 1.1.10.1 and guava to 32.0.1-jre (#2886)

* Update snappy to 1.1.10.1 and guava to 32.0.1-jre

Signed-off-by: Craig Perkins <[email protected]>

* Upgrade kafka to 3.5.0

Signed-off-by: Craig Perkins <[email protected]>

* Force snappy

Signed-off-by: Craig Perkins <[email protected]>

* Add runtime dependency on org.scala-lang.modules:scala-java8-compat_3:1.0.2 to fix issue with KafkaSinkTest

Signed-off-by: Craig Perkins <[email protected]>

---------

Signed-off-by: Craig Perkins <[email protected]>

* Role permissions order tool and workflow (#2733)

* Check Permissions Order tool and workflow

Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required.

Signed-off-by: Peter Nied <[email protected]>

* Apply fixes to roles.yml files

Signed-off-by: Peter Nied <[email protected]>

* Fixing busted test, adding findArrayInJson for response bodies

Signed-off-by: Peter Nied <[email protected]>

---------

Signed-off-by: Peter Nied <[email protected]>
Signed-off-by: Peter Nied <[email protected]>

* Misc changes (#2902)

Moved isStatic and isReserved methods to the
SecurityDynamicConfiguration class

Signed-off-by: Andrey Pleskach <[email protected]>

* Update triaging guidelines (#2899)

* Update triaging guidelines

Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>

* fix cluster perm classification for msearch template (#2892)

* fix cluster perm classification for msearch template

Signed-off-by: Derek Ho <[email protected]>

* move test to unit test file

Signed-off-by: Derek Ho <[email protected]>

* fully revert integration test file

Signed-off-by: Derek Ho <[email protected]>

* Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java

Signed-off-by: Stephen Crawford <[email protected]>

* spotless

Signed-off-by: Derek Ho <[email protected]>

---------

Signed-off-by: Derek Ho <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Co-authored-by: Stephen Crawford <[email protected]>

* [Doc] Add architecture document (#2869)

* Add initial architecture document

Signed-off-by: Peter Nied <[email protected]>

* [Enhancement] Parallel test jobs for CI (#2861)

* Split multiple tests into separate gradle tasks.
  * Tasks are configured in "splitTestConfig" map in build.gradle file.
    Map allows to use all patterns from TestFilter like:
    includeTestsMatching, excludeTestsMatching, includeTest etc.
  * Tasks are automatically generated from "splitTestConfig" map.
  * Two new Gradle tasks: listTasksAsJSON and listTasksAsParam to
    output task names to console. First one outputs them as a JSON
    and second - in gradlew "-x <TASK>" format to use in CLI.
  * Patterns included in tasks are automatically excluded from main
    "test" task but at the same time generated tasks are dependencies
    for "test". Running "gradlew test" will run whole suite at once.
* CI pipeline has been configured to accomodate all changes.
  * New 'master' task to generate list of jobs to run in parallel.
  * Updated matrix strategy to include task name to start.

Signed-off-by: Pawel Gudel <[email protected]>

* Bump BouncyCastle from jdk15on to jdk15to18 (#2901)

jdk15to18 contains fix for
 - CVE-2023-33201 - Medium
   Severity Vulnerability

Signed-off-by: Andrey Pleskach <[email protected]>

* Spotless Apply

Signed-off-by: Ryan Liang <[email protected]>

---------

Signed-off-by: Bhavana Ramaram <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Andrey Pleskach <[email protected]>
Signed-off-by: Peter Nied <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Peter Nied <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Signed-off-by: Derek Ho <[email protected]>
Signed-off-by: Pawel Gudel <[email protected]>
Signed-off-by: Ryan Liang <[email protected]>
Co-authored-by: Bhavana Ramaram <[email protected]>
Co-authored-by: Stephen Crawford <[email protected]>
Co-authored-by: Andrey Pleskach <[email protected]>
Co-authored-by: Peter Nied <[email protected]>
Co-authored-by: Craig Perkins <[email protected]>
Co-authored-by: Derek Ho <[email protected]>
Co-authored-by: pawel-gudel-eliatra <[email protected]>
peternied added a commit to peternied/security that referenced this pull request Aug 25, 2023
@peternied
Squashed commit of the following:
6486580 
commit 1e24bbb
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 12:06:53 2023 -0700

    Fixed the exception in keyutils

    Signed-off-by: Ryan Liang <[email protected]>

commit 4b406c5
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 11:41:14 2023 -0700

    Change the null check right after the jwtparserbuilder

    Signed-off-by: Ryan Liang <[email protected]>

commit a805843
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 11:11:13 2023 -0700

    Change to use copyof in getSecurityRoles in AuthCredentials class

    Signed-off-by: Ryan Liang <[email protected]>

commit 308f269
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 11:02:04 2023 -0700

    Add the null or empty check for signingkey in keyUtils

    Signed-off-by: Ryan Liang <[email protected]>

commit 40eed32
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 09:55:19 2023 -0700

    Fix V6 and V7 and lint

    Signed-off-by: Ryan Liang <[email protected]>

commit 3c76151
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 25 09:29:17 2023 -0700

    Fix comment - Craig

    Signed-off-by: Ryan Liang <[email protected]>

commit 7f2fc19
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 24 23:01:24 2023 -0700

    Fix some comments 08/24

    Signed-off-by: Ryan Liang <[email protected]>

commit 4841b25
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 24 10:50:24 2023 -0700

    Add the constant for defaut service in create obo endpoint

    Signed-off-by: Ryan Liang <[email protected]>

commit 477b505
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 20:18:05 2023 -0700

    Remove the unrelated line in AccountApiTest l77

    Signed-off-by: Ryan Liang <[email protected]>

commit f42d2f5
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 19:40:33 2023 -0700

    Re-edit the error msg for createoboendpoint

    Signed-off-by: Ryan Liang <[email protected]>

commit a272ccb
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 19:34:56 2023 -0700

    Rename the obo endpoint

    Signed-off-by: Ryan Liang <[email protected]>

commit c021473
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 19:30:45 2023 -0700

    Correct the getClusterName()

    Signed-off-by: Ryan Liang <[email protected]>

commit 8b5158d
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 19:11:07 2023 -0700

    Use ClusterInfoHolder to pass clusterName

    Signed-off-by: Ryan Liang <[email protected]>

commit 336aa57
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 18:18:42 2023 -0700

    Change the error msg in jwtvendorTests too

    Signed-off-by: Ryan Liang <[email protected]>

commit 682379d
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 17:21:11 2023 -0700

    Switch to assertThat in obo authenticator test

    Signed-off-by: Ryan Liang <[email protected]>

commit cb3406a
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:59:30 2023 -0700

    Add comment in DynamicConfigModelV7

    Signed-off-by: Ryan Liang <[email protected]>

commit 15c8530
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:47:13 2023 -0700

    Change to assertThrows for obo authenticator tests

    Signed-off-by: Ryan Liang <[email protected]>

commit e56bf01
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:39:24 2023 -0700

    Rename to OnBehalfOfSettings in ConfigV6

    Signed-off-by: Ryan Liang <[email protected]>

commit 62cfb4f
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:29:31 2023 -0700

    Add comment for authentication failure in obo authenticator

    Signed-off-by: Ryan Liang <[email protected]>

commit d0ebe91
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:22:08 2023 -0700

    Specify the error msg of missing signing key in jwtvendor

    Signed-off-by: Ryan Liang <[email protected]>

commit ca95380
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 16:12:46 2023 -0700

    Refactor the jwtvendor expiry and set up upper limit

    Signed-off-by: Ryan Liang <[email protected]>

commit 884f7a1
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 13:51:11 2023 -0700

    Flip the boolean logic of roleSecurityMode

    Signed-off-by: Ryan Liang <[email protected]>

commit e1021c2
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 13:36:05 2023 -0700

    Refactor the bwc mode into roleSecurityMode

    Signed-off-by: Ryan Liang <[email protected]>

commit c1a825b
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 12:03:17 2023 -0700

    Refactor in jwtVendor 1

    Signed-off-by: Ryan Liang <[email protected]>

commit 8eac5cd
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 23 09:53:24 2023 -0700

    Change the comment in backend registry

    Signed-off-by: Ryan Liang <[email protected]>

commit b0ac41a
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 17:58:15 2023 -0700

    Revert the unrelated change in SecurityRestFilter

    Signed-off-by: Ryan Liang <[email protected]>

commit b64460d
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 17:53:32 2023 -0700

    Remove stale function

    Signed-off-by: Ryan Liang <[email protected]>

commit 54bca2a
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 17:36:05 2023 -0700

    Refactor the obo endpoint

    Signed-off-by: Ryan Liang <[email protected]>

commit e429d7b
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 17:16:47 2023 -0700

    Refactor the KeyUtils OBOAuthenticator and JwtAuthenticator with jwtParserBuilder

    Signed-off-by: Ryan Liang <[email protected]>

commit 72dcec1
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 16:22:42 2023 -0700

    Some minor refactoring in obo authenticator

    Signed-off-by: Ryan Liang <[email protected]>

commit 6f0e79b
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 15:46:19 2023 -0700

    Remove the malformed token warning for backendroles extraction

    Signed-off-by: Ryan Liang <[email protected]>

commit 1ba378e
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 15:42:38 2023 -0700

    Refactor the EncryptionDecryptionUtil

    Signed-off-by: Ryan Liang <[email protected]>

commit b315559
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 12:02:06 2023 -0700

    Fix the exception type in JwtVendorTests

    Signed-off-by: Ryan Liang <[email protected]>

commit 6f49801
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 11:35:10 2023 -0700

    Remove the if condition in oboconfig for integ testing

    Signed-off-by: Ryan Liang <[email protected]>

commit 034aa34
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 11:22:45 2023 -0700

    Set up creatJwkException in exceptionUtils and apply that in JwtVendor constructor

    Signed-off-by: Ryan Liang <[email protected]>

commit 0f0478d
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 10:14:55 2023 -0700

    Rename the KeyUtils

    Signed-off-by: Ryan Liang <[email protected]>

commit a4e7aff
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 09:46:27 2023 -0700

    Refactor the backendroles claim into br

    Signed-off-by: Ryan Liang <[email protected]>

commit 2ff746e
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 09:31:50 2023 -0700

    Fix lint

    Signed-off-by: Ryan Liang <[email protected]>

commit 9ce36dc
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 01:11:24 2023 -0700

    Refactor the OBO Authenticator part2

    Signed-off-by: Ryan Liang <[email protected]>

commit e52c5ce
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 00:55:33 2023 -0700

    Refactor the backendrole extraction in oboauthenticator

    Signed-off-by: Ryan Liang <[email protected]>

commit 9c9e060
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 00:41:51 2023 -0700

    Refactor the role extraction in oboauthenticator

    Signed-off-by: Ryan Liang <[email protected]>

commit 387027b
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 00:18:31 2023 -0700

    Refactor the logic in JwtVendor

    Signed-off-by: Ryan Liang <[email protected]>

commit 267255c
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 22 00:01:15 2023 -0700

    Add integration test case for obo permission

    Signed-off-by: Ryan Liang <[email protected]>

commit 93bc8c6
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 19:18:49 2023 -0700

    Remove unused constants variable in OBO authenticator

    Signed-off-by: Ryan Liang <[email protected]>

commit 878a107
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 19:10:27 2023 -0700

    Refactor the encryptiondecryptionutilstests

    Signed-off-by: Ryan Liang <[email protected]>

commit 1c1bae6
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 14:53:45 2023 -0700

    Remove the null check in oboconfig

    Signed-off-by: Ryan Liang <[email protected]>

commit 7e3824e
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 14:44:07 2023 -0700

    Remove the wording of seconds in obo endpoint and make the expiry into configconstants

    Signed-off-by: Ryan Liang <[email protected]>

commit a126512
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 12:48:33 2023 -0700

    Use constant util in Obo integration test

    Signed-off-by: Ryan Liang <[email protected]>

commit e5a32c6
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 12:13:50 2023 -0700

    Rename the obo endpoint path to generateobotoekn

    Signed-off-by: Ryan Liang <[email protected]>

commit e09a902
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 21 09:15:53 2023 -0700

    Remove the unused instance in configV6

    Signed-off-by: Ryan Liang <[email protected]>

commit af8aaa7
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 18 13:05:04 2023 -0700

    Fix the lint

    Signed-off-by: Ryan Liang <[email protected]>

commit 9103b23
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 18 13:01:56 2023 -0700

    Add permission obo/create for accessing create obo endpoint

    Signed-off-by: Ryan Liang <[email protected]>

commit 2349213
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 15:54:38 2023 -0700

    Change the name into keyUtils with the s

    Signed-off-by: Ryan Liang <[email protected]>

commit dae0ac7
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 15:48:12 2023 -0700

    Switch to try/catch + assertEquals for JwtVendorTest

    Signed-off-by: Ryan Liang <[email protected]>

commit d918d7a
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 15:39:46 2023 -0700

    Change the JwtVendorTest with manually built-up assertThrow

    Signed-off-by: Ryan Liang <[email protected]>

commit f47026b
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 14:35:13 2023 -0700

    Fix the typo in exceptionUtils

    Signed-off-by: Ryan Liang <[email protected]>

commit 43b8d5d
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 14:33:22 2023 -0700

    Remove stacktrace debug statement in OBOAutehnticator

    Signed-off-by: Ryan Liang <[email protected]>

commit a2c6db1
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 13:04:30 2023 -0700

    Change some of the methods name into camle case instead of snake case

    Signed-off-by: Ryan Liang <[email protected]>

commit ee79b49
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 11:55:11 2023 -0700

    Add unit tests for EncryptionDecryptionUtil

    Signed-off-by: Ryan Liang <[email protected]>

commit 3ebff2b
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 17 09:43:43 2023 -0700

    Work around for not set static cluster service

    Signed-off-by: Ryan Liang <[email protected]>

commit a4efad6
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 13:31:57 2023 -0700

    Modify the getDynamicOnBehalfOfSettings() to return settings.Empty if there is no changes

    Signed-off-by: Ryan Liang <[email protected]>

commit e23d757
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 12:26:39 2023 -0700

    Encapsulate the logic for endpoints access checking into a method

    Signed-off-by: Ryan Liang <[email protected]>

commit be26148
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 12:09:25 2023 -0700

    Remove useless comments

    Signed-off-by: Ryan Liang <[email protected]>

commit bef85da
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 11:57:39 2023 -0700

    Remove the enforcing of token type for OBO auth

    Signed-off-by: Ryan Liang <[email protected]>

commit 1f79431
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 11:45:45 2023 -0700

    Change the field name reason in obo endpoint to description

    Signed-off-by: Ryan Liang <[email protected]>

commit 1f12e5e
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 16 11:15:56 2023 -0700

    Change the backendrole check's claim name into br

    Signed-off-by: Ryan Liang <[email protected]>

commit b2c7d75
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 15 23:30:25 2023 -0700

    Address some comment 2

    Signed-off-by: Ryan Liang <[email protected]>

commit d79973c
Author: Ryan Liang <[email protected]>
Date:   Tue Aug 15 23:24:16 2023 -0700

    Address some comment 1

    Signed-off-by: Ryan Liang <[email protected]>

commit 8a96cab
Author: Sam <[email protected]>
Date:   Fri Aug 18 14:43:07 2023 +0100

    Feature/extensions bwc setting (opensearch-project#3180)

    ### Description
    This Draft PR includes the new setting bwcPluginMode (backward
    compatible plugin mode for extensions )

    ### Issues Resolved
    opensearch-project#2616

    Is this a backport? If so, please add backport PR # and/or commits #

    ### Testing
    [Please provide details of testing done: unit testing, integration
    testing and manual testing]

    ### Check List
    - [ ] New functionality includes testing
    - [ ] New functionality has been documented
    - [x] Commits are signed per the DCO using --signoff

    By submitting this pull request, I confirm that my contribution is made
    under the terms of the Apache 2.0 license.
    For more information on following Developer Certificate of Origin and
    signing off your commits, please check
    [here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).

    ---------

    Signed-off-by: Sam <[email protected]>

commit 91f4478
Merge: e42e4d3 88b6d23
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 14 23:30:37 2023 -0700

    Merge branch 'main' into feature/extensions

commit e42e4d3
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 14 10:12:58 2023 -0700

    [Feature/Extension] Remove hostmapping from create OBO endpoint. (opensearch-project#3161)

    Signed-off-by: Ryan Liang <[email protected]>

commit ade34b4
Merge: 6d8e0e2 05f12d8
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 11 11:37:21 2023 -0700

    Merge branch 'main' into feature/extensions

commit 6d8e0e2
Merge: 493b53f 3139c18
Author: Ryan Liang <[email protected]>
Date:   Thu Aug 10 21:11:43 2023 -0700

    Merge branch 'main' into feature/extensions

commit 493b53f
Merge: 30cf5b1 46989b5
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 9 12:00:14 2023 -0700

    Merge branch 'main' into feature/extensions

commit 30cf5b1
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 9 10:10:24 2023 -0700

    [Feature/Extension] Add cluster id check for OBO Authenticator (opensearch-project#3117)

    ---------

    Signed-off-by: Ryan Liang <[email protected]>

commit 058f8ec
Merge: d643fb2 6cc90e6
Author: Ryan Liang <[email protected]>
Date:   Mon Aug 7 12:33:57 2023 -0700

    Merge branch 'main' into feature/extensions

commit d643fb2
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 4 22:57:18 2023 -0700

    [Feature/Extension] Restrict OBO token's usage for certain endpoints (opensearch-project#3008)

    Signed-off-by: Ryan Liang <[email protected]>

commit 2319059
Merge: d634d60 527495d
Author: Ryan Liang <[email protected]>
Date:   Fri Aug 4 08:50:34 2023 -0700

    Merge branch 'main' into feature/extensions

commit d634d60
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 2 13:09:03 2023 -0700

    [Feature/Extension] Add configuration of disable OBO (opensearch-project#3047)

    Signed-off-by: Ryan Liang <[email protected]>

commit df3dba3
Merge: 1268dee 5384272
Author: Ryan Liang <[email protected]>
Date:   Wed Aug 2 09:42:04 2023 -0700

    Merge branch 'main' into feature/extensions

commit 1268dee
Merge: a9451dd 8063e1b
Author: Ryan Liang <[email protected]>
Date:   Tue Jul 25 11:23:05 2023 -0700

    Merge branch 'main' into feature/extensions

commit a9451dd
Merge: 671c772 59e2657
Author: Ryan Liang <[email protected]>
Date:   Mon Jul 24 13:30:37 2023 -0700

    Merge branch 'main' into feature/extensions

commit 671c772
Merge: 67515bc f1be2d7
Author: Ryan Liang <[email protected]>
Date:   Tue Jul 18 09:04:25 2023 -0700

    Merge branch 'main' into feature/extensions

commit 67515bc
Merge: 88f32e9 0e6608d
Author: Ryan Liang <[email protected]>
Date:   Thu Jul 13 11:18:07 2023 -0700

    Merge branch 'main' into feature/extensions

commit 88f32e9
Author: Ryan Liang <[email protected]>
Date:   Fri Jul 7 11:42:21 2023 -0700

    [Feature/Extension] Add oboauthcbackend registry and set up e2e endpoint testing flow (opensearch-project#2857)

    * Add OBO Authbackend

    Signed-off-by: Peter Nied <[email protected]>
    Signed-off-by: Ryan Liang <[email protected]>
    Co-authored-by: Peter Nied <[email protected]>

commit 8c3c639
Merge: 21891d7 4eef662
Author: Ryan Liang <[email protected]>
Date:   Mon Jul 3 10:34:27 2023 -0700

    Merge branch 'main' into feature/extensions

commit 21891d7
Merge: 8ad24ad 7546c05
Author: Ryan Liang <[email protected]>
Date:   Thu Jun 29 13:28:12 2023 -0700

    Merge branch 'feature-branch-sync-629' into feature/extensions

commit 8ad24ad
Author: Ryan Liang <[email protected]>
Date:   Thu Jun 29 13:23:04 2023 -0700

    Revert "Feature branch sync 06/29/2023 (opensearch-project#2918)" (opensearch-project#2920)

    This reverts commit 748a711.

commit 748a711
Author: Ryan Liang <[email protected]>
Date:   Thu Jun 29 12:37:08 2023 -0700

    Feature branch sync 06/29/2023 (opensearch-project#2918)

    * add search model group permission to ml_read_access role (opensearch-project#2855)

    * add search model group permission to ml_read_access role

    Signed-off-by: Bhavana Ramaram <[email protected]>

    * IntegrationTest spotless (opensearch-project#2863)

    Signed-off-by: Stephen Crawford <[email protected]>

    * Format everything (opensearch-project#2866)

    * Use boucycastle PEM reader instead of reg expression (opensearch-project#2864)

    Use BouncyCastle PEMReader instead of
    regular expression to read and parse private key pem files.

    Signed-off-by: Andrey Pleskach <[email protected]>

    * Adding field level security test cases for FlatFields (opensearch-project#2876)

    Signed-off-by: Peter Nied <[email protected]>

    * Update snappy to 1.1.10.1 and guava to 32.0.1-jre (opensearch-project#2886)

    * Update snappy to 1.1.10.1 and guava to 32.0.1-jre

    Signed-off-by: Craig Perkins <[email protected]>

    * Upgrade kafka to 3.5.0

    Signed-off-by: Craig Perkins <[email protected]>

    * Force snappy

    Signed-off-by: Craig Perkins <[email protected]>

    * Add runtime dependency on org.scala-lang.modules:scala-java8-compat_3:1.0.2 to fix issue with KafkaSinkTest

    Signed-off-by: Craig Perkins <[email protected]>

    ---------

    Signed-off-by: Craig Perkins <[email protected]>

    * Role permissions order tool and workflow (opensearch-project#2733)

    * Check Permissions Order tool and workflow

    Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required.

    Signed-off-by: Peter Nied <[email protected]>

    * Apply fixes to roles.yml files

    Signed-off-by: Peter Nied <[email protected]>

    * Fixing busted test, adding findArrayInJson for response bodies

    Signed-off-by: Peter Nied <[email protected]>

    ---------

    Signed-off-by: Peter Nied <[email protected]>
    Signed-off-by: Peter Nied <[email protected]>

    * Misc changes (opensearch-project#2902)

    Moved isStatic and isReserved methods to the
    SecurityDynamicConfiguration class

    Signed-off-by: Andrey Pleskach <[email protected]>

    * Update triaging guidelines (opensearch-project#2899)

    * Update triaging guidelines

    Signed-off-by: Stephen Crawford <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>

    * fix cluster perm classification for msearch template (opensearch-project#2892)

    * fix cluster perm classification for msearch template

    Signed-off-by: Derek Ho <[email protected]>

    * move test to unit test file

    Signed-off-by: Derek Ho <[email protected]>

    * fully revert integration test file

    Signed-off-by: Derek Ho <[email protected]>

    * Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java

    Signed-off-by: Stephen Crawford <[email protected]>

    * spotless

    Signed-off-by: Derek Ho <[email protected]>

    ---------

    Signed-off-by: Derek Ho <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>
    Co-authored-by: Stephen Crawford <[email protected]>

    * [Doc] Add architecture document (opensearch-project#2869)

    * Add initial architecture document

    Signed-off-by: Peter Nied <[email protected]>

    * [Enhancement] Parallel test jobs for CI (opensearch-project#2861)

    * Split multiple tests into separate gradle tasks.
      * Tasks are configured in "splitTestConfig" map in build.gradle file.
        Map allows to use all patterns from TestFilter like:
        includeTestsMatching, excludeTestsMatching, includeTest etc.
      * Tasks are automatically generated from "splitTestConfig" map.
      * Two new Gradle tasks: listTasksAsJSON and listTasksAsParam to
        output task names to console. First one outputs them as a JSON
        and second - in gradlew "-x <TASK>" format to use in CLI.
      * Patterns included in tasks are automatically excluded from main
        "test" task but at the same time generated tasks are dependencies
        for "test". Running "gradlew test" will run whole suite at once.
    * CI pipeline has been configured to accomodate all changes.
      * New 'master' task to generate list of jobs to run in parallel.
      * Updated matrix strategy to include task name to start.

    Signed-off-by: Pawel Gudel <[email protected]>

    * Bump BouncyCastle from jdk15on to jdk15to18 (opensearch-project#2901)

    jdk15to18 contains fix for
     - CVE-2023-33201 - Medium
       Severity Vulnerability

    Signed-off-by: Andrey Pleskach <[email protected]>

    * Spotless Apply

    Signed-off-by: Ryan Liang <[email protected]>

    ---------

    Signed-off-by: Bhavana Ramaram <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>
    Signed-off-by: Andrey Pleskach <[email protected]>
    Signed-off-by: Peter Nied <[email protected]>
    Signed-off-by: Craig Perkins <[email protected]>
    Signed-off-by: Peter Nied <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>
    Signed-off-by: Derek Ho <[email protected]>
    Signed-off-by: Pawel Gudel <[email protected]>
    Signed-off-by: Ryan Liang <[email protected]>
    Co-authored-by: Bhavana Ramaram <[email protected]>
    Co-authored-by: Stephen Crawford <[email protected]>
    Co-authored-by: Andrey Pleskach <[email protected]>
    Co-authored-by: Peter Nied <[email protected]>
    Co-authored-by: Craig Perkins <[email protected]>
    Co-authored-by: Derek Ho <[email protected]>
    Co-authored-by: pawel-gudel-eliatra <[email protected]>

commit 7546c05
Author: Ryan Liang <[email protected]>
Date:   Thu Jun 29 11:50:58 2023 -0700

    Spotless Apply

    Signed-off-by: Ryan Liang <[email protected]>

commit 81b7818
Author: Andrey Pleskach <[email protected]>
Date:   Thu Jun 29 15:54:21 2023 +0200

    Bump BouncyCastle from jdk15on to jdk15to18 (opensearch-project#2901)

    jdk15to18 contains fix for
     - CVE-2023-33201 - Medium
       Severity Vulnerability

    Signed-off-by: Andrey Pleskach <[email protected]>

commit 95efddd
Author: pawel-gudel-eliatra <[email protected]>
Date:   Wed Jun 28 22:41:46 2023 +0200

    [Enhancement] Parallel test jobs for CI (opensearch-project#2861)

    * Split multiple tests into separate gradle tasks.
      * Tasks are configured in "splitTestConfig" map in build.gradle file.
        Map allows to use all patterns from TestFilter like:
        includeTestsMatching, excludeTestsMatching, includeTest etc.
      * Tasks are automatically generated from "splitTestConfig" map.
      * Two new Gradle tasks: listTasksAsJSON and listTasksAsParam to
        output task names to console. First one outputs them as a JSON
        and second - in gradlew "-x <TASK>" format to use in CLI.
      * Patterns included in tasks are automatically excluded from main
        "test" task but at the same time generated tasks are dependencies
        for "test". Running "gradlew test" will run whole suite at once.
    * CI pipeline has been configured to accomodate all changes.
      * New 'master' task to generate list of jobs to run in parallel.
      * Updated matrix strategy to include task name to start.

    Signed-off-by: Pawel Gudel <[email protected]>

commit 766389b
Author: Peter Nied <[email protected]>
Date:   Wed Jun 28 15:28:11 2023 -0500

    [Doc] Add architecture document (opensearch-project#2869)

    * Add initial architecture document

    Signed-off-by: Peter Nied <[email protected]>

commit c1d2127
Author: Derek Ho <[email protected]>
Date:   Wed Jun 28 15:21:04 2023 -0400

    fix cluster perm classification for msearch template (opensearch-project#2892)

    * fix cluster perm classification for msearch template

    Signed-off-by: Derek Ho <[email protected]>

    * move test to unit test file

    Signed-off-by: Derek Ho <[email protected]>

    * fully revert integration test file

    Signed-off-by: Derek Ho <[email protected]>

    * Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java

    Signed-off-by: Stephen Crawford <[email protected]>

    * spotless

    Signed-off-by: Derek Ho <[email protected]>

    ---------

    Signed-off-by: Derek Ho <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>
    Co-authored-by: Stephen Crawford <[email protected]>

commit 37f277e
Author: Stephen Crawford <[email protected]>
Date:   Mon Jun 26 15:28:13 2023 -0400

    Update triaging guidelines (opensearch-project#2899)

    * Update triaging guidelines

    Signed-off-by: Stephen Crawford <[email protected]>
    Signed-off-by: Stephen Crawford <[email protected]>

commit 926bdda
Author: Andrey Pleskach <[email protected]>
Date:   Mon Jun 26 20:09:39 2023 +0200

    Misc changes (opensearch-project#2902)

    Moved isStatic and isReserved methods to the
    SecurityDynamicConfiguration class

    Signed-off-by: Andrey Pleskach <[email protected]>

commit 9cd0198
Author: Peter Nied <[email protected]>
Date:   Mon Jun 26 10:04:39 2023 -0500

    Role permissions order tool and workflow (opensearch-project#2733)

    * Check Permissions Order tool and workflow

    Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required.

    Signed-off-by: Peter Nied <[email protected]>

    * Apply fixes to roles.yml files

    Signed-off-by: Peter Nied <[email protected]>

    * Fixing busted test, adding findArrayInJson for response bodies

    Signed-off-by: Peter Nied <[email protected]>

    ---------

    Signed-off-by: Peter Nied <[email protected]>
    Signed-off-by: Peter Nied <[email protected]>

commit 4bb144f
Author: Craig Perkins <[email protected]>
Date:   Wed Jun 21 09:31:47 2023 -0400

    Update snappy to 1.1.10.1 and guava to 32.0.1-jre (opensearch-project#2886)

    * Update snappy to 1.1.10.1 and guava to 32.0.1-jre

    Signed-off-by: Craig Perkins <[email protected]>

    * Upgrade kafka to 3.5.0

    Signed-off-by: Craig Perkins <[email protected]>

    * Force snappy

    Signed-off-by: Craig Perkins <[email protected]>

    * Add runtime dependency on org.scala-lang.modules:scala-java8-compat_3:1.0.2 to fix issue with KafkaSinkTest

    Signed-off-by: Craig Perkins <[email protected]>

    ---------

    Signed-off-by: Craig Perkins <[email protected]>

commit c71d9b3
Author: Peter Nied <[email protected]>
Date:   Tue Jun 20 13:36:01 2023 -0500

    Adding field level security test cases for FlatFields (opensearch-project#2876)

    Signed-off-by: Peter Nied <[email protected]>

commit e3b4f8f
Author: Andrey Pleskach <[email protected]>
Date:   Mon Jun 19 16:18:28 2023 +0200

    Use boucycastle PEM reader instead of reg expression (opensearch-project#2864)

    Use BouncyCastle PEMReader instead of
    regular expression to read and parse private key pem files.

    Signed-off-by: Andrey Pleskach <[email protected]>

commit ef6224c
Author: Stephen Crawford <[email protected]>
Date:   Thu Jun 15 23:32:10 2023 -0400

    Format everything (opensearch-project#2866)

commit ef048a2
Author: Stephen Crawford <[email protected]>
Date:   Thu Jun 15 11:57:25 2023 -0400

    IntegrationTest spotless (opensearch-project#2863)

    Signed-off-by: Stephen Crawford <[email protected]>

commit b6bfb11
Author: Bhavana Ramaram <[email protected]>
Date:   Tue Jun 13 17:00:34 2023 -0700

    add search model group permission to ml_read_access role (opensearch-project#2855)

    * add search model group permission to ml_read_access role

    Signed-off-by: Bhavana Ramaram <[email protected]>

commit 26244e9
Merge: 56e77fe 1691ca7
Author: Craig Perkins <[email protected]>
Date:   Tue Jun 13 16:14:33 2023 -0400

    Merge branch 'format-feature-extensions-apply' into feature/extensions

commit 1691ca7
Merge: efcadd4 2e263b8
Author: Craig Perkins <[email protected]>
Date:   Tue Jun 13 16:05:59 2023 -0400

    Merge branch 'main' into format-feature-extensions-apply

commit efcadd4
Merge: 1a09a87 ceb5ad2
Author: Craig Perkins <[email protected]>
Date:   Fri Jun 9 10:16:02 2023 -0400

    Merge branch 'main' into format-feature-extensions-apply

commit 1a09a87
Author: Craig Perkins <[email protected]>
Date:   Fri Jun 9 09:57:42 2023 -0400

    Run spotlessApply

    Signed-off-by: Craig Perkins <[email protected]>

commit 01917ff
Author: Craig Perkins <[email protected]>
Date:   Fri Jun 9 09:55:09 2023 -0400

    Remove other spotless section

    Signed-off-by: Craig Perkins <[email protected]>

commit c83ad28
Author: Craig Perkins <[email protected]>
Date:   Fri Jun 9 09:53:35 2023 -0400

    Add formatting changes in feature/extensions

    Signed-off-by: Craig Perkins <[email protected]>

commit 56e77fe
Merge: fa0fcc3 33aebb9
Author: Ryan Liang <[email protected]>
Date:   Wed May 24 11:31:54 2023 -0700

    Merge branch 'main' into feature/extensions

commit fa0fcc3
Author: Ryan Liang <[email protected]>
Date:   Tue May 16 10:55:57 2023 -0700

    [Feature/Extension] Rename the term 'extension' into 'on_behalf_of' (opensearch-project#2774)

    Signed-off-by: Ryan Liang <[email protected]>

commit f1cee3b
Merge: 95f9c77 15860b6
Author: Ryan Liang <[email protected]>
Date:   Tue May 16 09:33:59 2023 -0700

    Merge branch 'main' into feature/extensions

commit 95f9c77
Author: Ryan Liang <[email protected]>
Date:   Thu May 11 11:50:12 2023 -0700

    [Security/Extension] Extension Authentication Backend (opensearch-project#2672)

    * Extension Authentication-backend

    Signed-off-by: Ryan Liang <[email protected]>

commit 8f02d8d
Merge: 9515181 9d758f9
Author: Ryan Liang <[email protected]>
Date:   Wed May 10 12:12:20 2023 -0700

    Merge branch 'main' into feature/extensions

commit 9515181
Author: Ryan Liang <[email protected]>
Date:   Wed May 10 09:51:26 2023 -0700

    Fix the conflicts

    Signed-off-by: Ryan Liang <[email protected]>

commit 06055c3
Merge: df75a37 f4def32
Author: Ryan Liang <[email protected]>
Date:   Wed May 10 09:34:05 2023 -0700

    merge main into security extension feature branch

commit df75a37
Author: MaciejMierzwa <[email protected]>
Date:   Tue May 2 15:44:04 2023 +0200

    Extensions config for JWT signing/encryption key (opensearch-project#2671)

    * Extensions config for JWT signing/encryption key

    Signed-off-by: Maciej Mierzwa <[email protected]>

commit d4e5f1f
Merge: 4da62c3 6997f97
Author: Ryan Liang <[email protected]>
Date:   Thu Apr 27 07:05:39 2023 -0700

    Merge branch 'main' into feature/extensions

commit 4da62c3
Merge: 73ab1fc 6ace852
Author: Craig Perkins <[email protected]>
Date:   Tue Apr 25 09:38:52 2023 -0400

    Merge branch 'main' into feature/extensions

commit 73ab1fc
Author: Ryan Liang <[email protected]>
Date:   Thu Apr 6 13:38:19 2023 -0700

    [Security/Extension] Role encryption/decryption (opensearch-project#2620)

    * Encryption/Decryption of `roles`

    Signed-off-by: Ryan Liang <[email protected]>

commit 1681823
Author: Ryan Liang <[email protected]>
Date:   Fri Mar 31 06:58:56 2023 -0700

    [Security/Extension] JWT Vendor for extensions (opensearch-project#2567)

    * JWT Vendor for extensions
    Signed-off-by: Ryan Liang <[email protected]>

Signed-off-by: Peter Nied <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RyanL1997 RyanL1997 RyanL1997 approved these changes

@peternied peternied peternied approved these changes

@cliu123 cliu123 Awaiting requested review from cliu123

@cwperks cwperks Awaiting requested review from cwperks cwperks is a code owner

@DarshitChanpura DarshitChanpura Awaiting requested review from DarshitChanpura DarshitChanpura is a code owner

@davidlago davidlago Awaiting requested review from davidlago

@stephen-crawford stephen-crawford Awaiting requested review from stephen-crawford

@reta reta Awaiting requested review from reta reta is a code owner

@willyborankin willyborankin Awaiting requested review from willyborankin willyborankin is a code owner

Assignees
No one assigned
Labels
backport 2.x backport to 2.x branch
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@rbhavna @peternied @RyanL1997