Cluster-state based Security role mapper #107410
Conversation
albertzaharovits
changed the title
albertzaharovits
changed the title
albertzaharovits
added
:Security/Authorization
|
Hi @albertzaharovits, I've created a changelog YAML for you. |
|
Pinging @elastic/es-security (Team:Security) |
|
|
||
| @BeforeClass | ||
| public static void beforeTests() { | ||
| anonymousRole = randomBoolean(); |
There was a problem hiding this comment.
Any reason not to just run both every time? Keep the way the tests are parameterized, just run them both ways instead of making it random.
There was a problem hiding this comment.
The xpack.security.authc.anonymous.roles is a static setting, so it's cumbersome to vary from test to test. It's also not super relevant for the scope of the tests.
| import static org.elasticsearch.xpack.security.authc.support.mapper.ExpressionRoleMappingTests.randomRoleMapping; | ||
| import static org.hamcrest.Matchers.is; | ||
|
|
||
| public class RoleMappingMetadataTests extends ESTestCase { |
There was a problem hiding this comment.
Why not AbstractWireSerializingTestCase?
There was a problem hiding this comment.
Good point, pushed: 4135aeb
| verify(userRoleMapper1, times(1)).clearRealmCacheOnChange(eq(realm)); | ||
| verify(userRoleMapper1, times(1)).clearRealmCacheOnChange(eq(realm)); |
There was a problem hiding this comment.
I think you meant:
| verify(userRoleMapper1, times(1)).clearRealmCacheOnChange(eq(realm)); | |
| verify(userRoleMapper1, times(1)).clearRealmCacheOnChange(eq(realm)); | |
| verify(userRoleMapper1, times(1)).clearRealmCacheOnChange(eq(realm)); | |
| verify(userRoleMapper2, times(1)).clearRealmCacheOnChange(eq(realm)); |
?
There was a problem hiding this comment.
Good catch! Thanks!
This implements a new
UserRoleMapperthat sources the role mapping rules from the cluster state.The role mapping rules are stored under a new custom cluster state that is persisted (both disk and snapshots).
The role mapper refreshes realm caches when role mapping changes are published.
The role mapper is disabled by default, and it can only be enabled from code, by other plugins.
When enabled, the cluster state role mappings rules, if any, are additive to the rules from
the index-based native role mapping store and the file-based DN one.