Api token authc/z implementation with Cache #4992
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| */ | ||
|
|
||
| package org.opensearch.security.action.apitokens; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Map; | ||
| import java.util.concurrent.ConcurrentHashMap; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
|
|
||
| import org.opensearch.common.xcontent.LoggingDeprecationHandler; | ||
| import org.opensearch.common.xcontent.XContentType; | ||
| import org.opensearch.core.common.bytes.BytesReference; | ||
| import org.opensearch.core.index.shard.ShardId; | ||
| import org.opensearch.core.xcontent.NamedXContentRegistry; | ||
| import org.opensearch.core.xcontent.XContentParser; | ||
| import org.opensearch.index.engine.Engine; | ||
| import org.opensearch.index.shard.IndexingOperationListener; | ||
|
|
||
| /** | ||
| * This class implements an index operation listener for operations performed on api tokens | ||
| * These indices are defined on bootstrap and configured to listen in OpenSearchSecurityPlugin.java | ||
| */ | ||
| public class ApiTokenIndexListenerCache implements IndexingOperationListener { | ||
|
|
||
| private final static Logger log = LogManager.getLogger(ApiTokenIndexListenerCache.class); | ||
|
|
||
| private static final ApiTokenIndexListenerCache INSTANCE = new ApiTokenIndexListenerCache(); | ||
| private final ConcurrentHashMap<String, String> idToJtiMap = new ConcurrentHashMap<>(); | ||
|
|
||
| private Map<String, Permissions> jtis = new ConcurrentHashMap<>(); | ||
|
|
||
| private boolean initialized; | ||
|
|
||
| private ApiTokenIndexListenerCache() {} | ||
|
|
||
| public static ApiTokenIndexListenerCache getInstance() { | ||
| return ApiTokenIndexListenerCache.INSTANCE; | ||
| } | ||
|
|
||
| /** | ||
| * Initializes the ApiTokenIndexListenerCache. | ||
| * This method is called during the plugin's initialization process. | ||
| * | ||
| */ | ||
| public void initialize() { | ||
|
|
||
| if (initialized) { | ||
| return; | ||
|
Check warning on line 56 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
| } | ||
|
|
||
| initialized = true; | ||
|
Check warning on line 59 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| } | ||
|
Check warning on line 61 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| public boolean isInitialized() { | ||
| return initialized; | ||
|
Check warning on line 64 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
| } | ||
|
|
||
| /** | ||
| * This method is called after an index operation is performed. | ||
| * It adds the JTI of the indexed document to the cache and maps the document ID to the JTI (for deletion handling). | ||
| * @param shardId The shard ID of the index where the operation was performed. | ||
| * @param index The index where the operation was performed. | ||
| * @param result The result of the index operation. | ||
| */ | ||
| @Override | ||
| public void postIndex(ShardId shardId, Engine.Index index, Engine.IndexResult result) { | ||
| BytesReference sourceRef = index.source(); | ||
|
Check warning on line 76 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| try { | ||
| XContentParser parser = XContentType.JSON.xContent() | ||
| .createParser(NamedXContentRegistry.EMPTY, LoggingDeprecationHandler.INSTANCE, sourceRef.streamInput()); | ||
|
Check warning on line 80 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| ApiToken token = ApiToken.fromXContent(parser); | ||
| jtis.put(token.getJti(), new Permissions(token.getClusterPermissions(), token.getIndexPermissions())); | ||
| idToJtiMap.put(index.id(), token.getJti()); | ||
|
Check warning on line 84 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| } catch (IOException e) { | ||
| log.error("Failed to parse indexed document", e); | ||
| } | ||
| } | ||
|
Check warning on line 89 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| /** | ||
| * This method is called after a delete operation is performed. | ||
| * It deletes the corresponding document id in the map and the corresponding jti from the cache. | ||
| * @param shardId The shard ID of the index where the delete operation was performed. | ||
| * @param delete The delete operation that was performed. | ||
| * @param result The result of the delete operation. | ||
| */ | ||
| @Override | ||
| public void postDelete(ShardId shardId, Engine.Delete delete, Engine.DeleteResult result) { | ||
| String docId = delete.id(); | ||
| String jti = idToJtiMap.remove(docId); | ||
|
Check warning on line 101 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
| if (jti != null) { | ||
| jtis.remove(jti); | ||
| log.debug("Removed token with ID {} and JTI {} from cache", docId, jti); | ||
|
Check warning on line 104 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
| } | ||
| } | ||
|
Check warning on line 106 in src/main/java/org/opensearch/security/action/apitokens/ApiTokenIndexListenerCache.java
|
||
|
|
||
| public Map<String, Permissions> getJtis() { | ||
| return jtis; | ||
| } | ||
|
|
||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| */ | ||
|
|
||
| package org.opensearch.security.action.apitokens; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| public class Permissions { | ||
| private List<String> clusterPerm; | ||
| private List<ApiToken.IndexPermission> indexPermission; | ||
|
|
||
| // Constructor | ||
| public Permissions(List<String> clusterPerm, List<ApiToken.IndexPermission> indexPermission) { | ||
| this.clusterPerm = clusterPerm; | ||
| this.indexPermission = indexPermission; | ||
| } | ||
|
|
||
| // Getters and setters | ||
| public List<String> getClusterPerm() { | ||
| return clusterPerm; | ||
| } | ||
|
|
||
| public void setClusterPerm(List<String> clusterPerm) { | ||
| this.clusterPerm = clusterPerm; | ||
| } | ||
|
|
||
| public List<ApiToken.IndexPermission> getIndexPermission() { | ||
| return indexPermission; | ||
| } | ||
|
|
||
| public void setIndexPermission(List<ApiToken.IndexPermission> indexPermission) { | ||
| this.indexPermission = indexPermission; | ||
| } | ||
|
|
||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Curious, why use this approach w/ IndexOperationListener opposed to the same approach as the security index vs in-memory data-structures that back the security index?
i.e. With the security index, if I call the API to create a new user. The node that receives the request will fulfill the request and add the new user to the security index. After updating the security index, it will use an internal transport action (TransportConfigUpdateAction) to instruct all nodes of the cluster to re-read from the security index. On node bootstrap, each node of the cluster reads from the security index and populates their in-memory cache of the security index.