Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Security: fix dynamic mapping updates with aliases (#30787)
This commit fixes an issue with dynamic mapping updates when an index operation is performed against an alias and when the user only has permissions to the alias. Dynamic mapping updates resolve the concrete index early to prevent issues so the information about the alias that the triggering operation was being executed against is lost. When security is enabled and a user only has privileges to the alias, this dynamic mapping update would be rejected as it is executing against the concrete index and not the alias. In order to handle this situation, the security code needs to look at the concrete index and the authorized indices of the user; if the concrete index is not authorized the code will attempt to find an alias that the user has permissions to update the mappings of. Closes #30597
- Loading branch information
Showing
3 changed files
with
165 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
90 changes: 90 additions & 0 deletions
90
...ck/plugin/src/test/resources/rest-api-spec/test/security/authz/30_dynamic_put_mapping.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| --- | ||
| setup: | ||
| - skip: | ||
| features: headers | ||
|
|
||
| - do: | ||
| cluster.health: | ||
| wait_for_status: yellow | ||
|
|
||
| - do: | ||
| xpack.security.put_role: | ||
| name: "alias_write_role" | ||
| body: > | ||
| { | ||
| "indices": [ | ||
| { "names": ["write_alias"], "privileges": ["write"] } | ||
| ] | ||
| } | ||
| - do: | ||
| xpack.security.put_user: | ||
| username: "test_user" | ||
| body: > | ||
| { | ||
| "password" : "x-pack-test-password", | ||
| "roles" : [ "alias_write_role" ], | ||
| "full_name" : "user with privileges to write via alias" | ||
| } | ||
| - do: | ||
| indices.create: | ||
| index: write_index_1 | ||
| body: | ||
| settings: | ||
| index: | ||
| number_of_shards: 1 | ||
| number_of_replicas: 0 | ||
|
|
||
| - do: | ||
| indices.put_alias: | ||
| index: write_index_1 | ||
| name: write_alias | ||
|
|
||
| --- | ||
| teardown: | ||
| - do: | ||
| xpack.security.delete_user: | ||
| username: "test_user" | ||
| ignore: 404 | ||
|
|
||
| - do: | ||
| xpack.security.delete_role: | ||
| name: "alias_write_role" | ||
| ignore: 404 | ||
|
|
||
| - do: | ||
| indices.delete_alias: | ||
| index: "write_index_1" | ||
| name: [ "write_alias" ] | ||
| ignore: 404 | ||
|
|
||
| - do: | ||
| indices.delete: | ||
| index: [ "write_index_1" ] | ||
| ignore: 404 | ||
|
|
||
| --- | ||
| "Test indexing documents into an alias with dynamic mappings": | ||
|
|
||
| - do: | ||
| headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user | ||
| create: | ||
| id: 1 | ||
| index: write_alias | ||
| type: doc | ||
| body: > | ||
| { | ||
| "name" : "doc1" | ||
| } | ||
| - do: | ||
| headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user | ||
| create: | ||
| id: 2 | ||
| index: write_alias | ||
| type: doc | ||
| body: > | ||
| { | ||
| "name2" : "doc2" | ||
| } |