Fix transport serialization of AsyncSearchUser (#54761)

This change ensures that the AsyncSearchUser is correctly (de)serialized when an action executed by this user is sent to a remote node internally (via transport client).
elastic · Apr 7, 2020 · 5b17d31 · 5b17d31
1 parent 89b70c1
commit 5b17d31
Show file tree

Hide file tree

Showing 4 changed files with 19 additions and 1 deletion.
diff --git a/x-pack/plugin/async-search/qa/security/build.gradle b/x-pack/plugin/async-search/qa/security/build.gradle
@@ -10,6 +10,7 @@ dependencies {
 
 testClusters.integTest {
   testDistribution = 'DEFAULT'
+  numberOfNodes = 2
   setting 'xpack.license.self_generated.type', 'trial'
   setting 'xpack.security.enabled', 'true'
   extraConfigFile 'roles.yml', file('roles.yml')

diff --git a/...main/java/org/elasticsearch/xpack/core/security/user/InternalUserSerializationHelper.java b/...main/java/org/elasticsearch/xpack/core/security/user/InternalUserSerializationHelper.java
@@ -21,6 +21,8 @@ public static User readFrom(StreamInput input) throws IOException {
                 return XPackUser.INSTANCE;
             } else if (XPackSecurityUser.is(username)) {
                 return XPackSecurityUser.INSTANCE;
+            } else if (AsyncSearchUser.is(username)) {
+                return AsyncSearchUser.INSTANCE;
             }
             throw new IllegalStateException("user [" + username + "] is not an internal user");
         }
@@ -36,6 +38,9 @@ public static void writeTo(User user, StreamOutput output) throws IOException {
         } else if (XPackSecurityUser.is(user)) {
             output.writeBoolean(true);
             output.writeString(XPackSecurityUser.NAME);
+        } else if (AsyncSearchUser.is(user)) {
+            output.writeBoolean(true);
+            output.writeString(AsyncSearchUser.NAME);
         } else {
             User.writeTo(user, output);
         }

diff --git a/...n/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java b/...n/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java
@@ -58,6 +58,7 @@
 import org.elasticsearch.xpack.core.security.authz.privilege.ClusterPrivilegeResolver;
 import org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege;
 import org.elasticsearch.xpack.core.security.user.AnonymousUser;
+import org.elasticsearch.xpack.core.security.user.AsyncSearchUser;
 import org.elasticsearch.xpack.core.security.user.SystemUser;
 import org.elasticsearch.xpack.core.security.user.User;
 import org.elasticsearch.xpack.core.security.user.XPackSecurityUser;
@@ -416,7 +417,7 @@ private TransportRequest maybeUnwrapRequest(Authentication authentication, Trans
     }
 
     private boolean isInternalUser(User user) {
-        return SystemUser.is(user) || XPackUser.is(user) || XPackSecurityUser.is(user);
+        return SystemUser.is(user) || XPackUser.is(user) || XPackSecurityUser.is(user) || AsyncSearchUser.is(user);
     }
 
     private void authorizeRunAs(final RequestInfo requestInfo, final AuthorizationInfo authzInfo,

diff --git a/.../security/src/test/java/org/elasticsearch/xpack/security/user/UserSerializationTests.java b/.../security/src/test/java/org/elasticsearch/xpack/security/user/UserSerializationTests.java
@@ -7,6 +7,7 @@
 
 import org.elasticsearch.common.io.stream.BytesStreamOutput;
 import org.elasticsearch.test.ESTestCase;
+import org.elasticsearch.xpack.core.security.user.AsyncSearchUser;
 import org.elasticsearch.xpack.core.security.user.ElasticUser;
 import org.elasticsearch.xpack.core.security.user.InternalUserSerializationHelper;
 import org.elasticsearch.xpack.core.security.user.KibanaUser;
@@ -87,6 +88,16 @@ public void testXPackUserReadAndWrite() throws Exception {
         assertThat(readFrom.authenticatedUser(), is(XPackUser.INSTANCE));
     }
 
+    public void testAsyncSearchUserReadAndWrite() throws Exception {
+        BytesStreamOutput output = new BytesStreamOutput();
+
+        InternalUserSerializationHelper.writeTo(AsyncSearchUser.INSTANCE, output);
+        User readFrom = InternalUserSerializationHelper.readFrom(output.bytes().streamInput());
+
+        assertThat(readFrom, is(sameInstance(AsyncSearchUser.INSTANCE)));
+        assertThat(readFrom.authenticatedUser(), is(AsyncSearchUser.INSTANCE));
+    }
+
     public void testFakeInternalUserSerialization() throws Exception {
         BytesStreamOutput output = new BytesStreamOutput();
         output.writeBoolean(true);