[HLRC] Support for role mapper expression dsl #33745

bizybot · 2018-09-17T06:18:47Z

This commit adds support for role mapping expression dsl.
Functionally it is similar to what we have on the server side
except for the rule evaluation which is not required on the client.

The role mapper expression can either be field expression or
composite expression of one or more expressions. Role mapper
expression parser is used to parse JSON DSL to list of expressions.

This forms the base for role mapping APIs (get, post/put and delete)

This commit adds support for role mapping expression dsl. Functionally it is similar to what we have on the server side except the rule evaluation which is not required on the client. The role mapper expression can either be field expression or composite expression of one or more expressions. Role mapper expression parser is used to parse json dsl to list of expressions. This forms the base for role mapping APIs (get, post/put and delete)

elasticmachine · 2018-09-17T06:18:48Z

Pinging @elastic/es-security

elasticmachine · 2018-09-17T06:18:49Z

Pinging @elastic/es-core-infra

tvernum · 2018-09-17T06:41:42Z

...sticsearch/client/security/support/expressiondsl/expressions/CompositeExpressionBuilder.java

+
+    public T build() {
+        try {
+            return ctor.newInstance(new Object[] { elements.toArray(new RoleMapperExpression[0]) });


I don't think we should be using reflection for this.
There's only 2 classes to handle, we can do it more simply and safely with a Function<RoleMapperExpression[], T>

I have refactored the code to simplify this. Thank you.

tvernum · 2018-09-17T06:43:54Z

...java/org/elasticsearch/client/security/support/expressiondsl/fields/FieldExpressionBase.java

+ * the provided values. A <em>field</em> expression may have more than one provided value, in which
+ * case the expression is true if <em>any</em> of the values are matched.
+ */
+public abstract class FieldExpressionBase implements RoleMapperExpression {


What's the purpose of having different types for the different fields? The JSON isn't any different based on the field type...

The only difference was with Metadata field as the key was dynamic. I have addressed this with refactoring now with a FieldType enum and its usage to distinguish within the builder. Thanks for your feedback.

tvernum · 2018-09-17T06:44:29Z

...a/org/elasticsearch/client/security/support/expressiondsl/fields/FieldExpressionBuilder.java

+    public FieldExpressionBuilder<T> withKey(String key) {
+        assert Strings.hasLength(key) : "metadata key cannot be null or empty";
+        assert MetadataFieldExpression.class.isAssignableFrom(
+                clazz) : "metadat key can only be provided when building MetadataFieldExpression";


typo: s/metadat/metadata/

Thanks, changed this.

tvernum · 2018-09-17T06:48:54Z

...g/elasticsearch/client/security/support/expressiondsl/parser/RoleMapperExpressionParser.java

+        ParseField ANY = new ParseField("any");
+        ParseField ALL = new ParseField("all");
+        ParseField EXCEPT = new ParseField("except");
+        ParseField FIELD = new ParseField("field");


We shouldn't have both these fields and also the NAME fields on the various expression types.

Yes, you are right. I initially did not add support for expression parser. I will address this. Thank you.

Removed individual expression classes, simiplified the usage using builders. Now there is FieldRoleMapperExpression for Field types (USERNAME, GROUPS, METADATA, DN) and CompositeRoleMapperExpression for Composite types (ALL, ANY, EXCEPT)

...csearch/client/security/support/expressiondsl/expressions/CompositeRoleMapperExpression.java

...rg/elasticsearch/client/security/support/expressiondsl/fields/FieldRoleMapperExpression.java

...g/elasticsearch/client/security/support/expressiondsl/parser/RoleMapperExpressionParser.java

bizybot · 2018-09-21T07:43:52Z

Hi @tvernum, I have addressed your review comments, please review when you get some time. Thank you for your review.

tvernum

LGTM, with 1 suggestion/preference.

tvernum · 2018-09-26T03:13:10Z

...rg/elasticsearch/client/security/support/expressiondsl/fields/FieldRoleMapperExpression.java

+    }
+
+    public static FieldRoleMapperExpression ofMetadata(String key, Object... values) {
+        String fieldName = key.startsWith("metadata.") ? key : "metadata." + key;


I would prefer we require one or the other. That is always add the "metadata." prefix or throw an exception if the prefix is missing.
Adding it if it doesn't exist feels convenient, but is just a form of leniency that tends to come back and bite us.

jkakavas

LGTM with two minor comments, sorry for getting to this too late @bizybot

jkakavas · 2018-09-26T12:33:54Z

...rg/elasticsearch/client/security/support/expressiondsl/fields/FieldRoleMapperExpression.java

+ * </pre>
+ */
+public class FieldRoleMapperExpression implements RoleMapperExpression {
+    private final String NAME = "field";


nit: s/NAME/name

Addressed this, Thanks.

jkakavas · 2018-09-26T12:40:27Z

...g/elasticsearch/client/security/support/expressiondsl/parser/RoleMapperExpressionParser.java

+        return parsedFieldName;
+    }
+
+    private List<RoleMapperExpression> parseExpressionArray(ParseField field, XContentParser parser, boolean allowExcept)


parameter allowExcept is not used

Done, Thank you.

bizybot · 2018-09-27T02:51:01Z

@elasticmachine test this, please

This commit adds support for role mapping expression dsl. Functionally it is similar to what we have on the server side except for the rule evaluation which is not required on the client. The role mapper expression can either be field expression or composite expression of one or more expressions. Role mapper expression parser is used to parse JSON DSL to list of expressions. This forms the base for role mapping APIs (get, post/put and delete)

* master: (25 commits) [DOCS] Synchronize location of Breaking Changes (elastic#33588) [DOCS] Synchronizes captialization in top-level titles (elastic#33605) [SQL] Clean up LogicalPlanBuilder#doJoin (elastic#34048) Fix remote cluster seeds fallback (elastic#34090) [ML][HLRC] Replace REST-based ML test cleanup with the ML client (elastic#34109) Handle MatchNoDocsQuery in span query wrappers (elastic#34106) Update MovAvgIT AwaitsFix bug url Bad regex in CORS settings should throw a nicer error (elastic#34035) [HLRC] Support for role mapper expression dsl (elastic#33745) Watcher: Reduce script cache churn by checking for mustache tags (elastic#33978) Fold EngineSearcher into Engine.Searcher (elastic#34082) Mute SpanMultiTermQueryBuilderTests#testToQuery TESTS: Enable DEBUG Logging in Flaky Test (elastic#34091) TEST: Add engine is closed as expected failure msg Adjust bwc version for max_seq_no_of_updates Build DocStats from SegmentInfos in ReadOnlyEngine (elastic#34079) When creating wildcard queries, use MatchNoDocsQuery when the field type doesn't exist. (elastic#34093) [DOCS] Moves graph to docs folder (elastic#33472) Mute MovAvgIT#testHoltWintersNotEnoughData Security: use default scroll keepalive (elastic#33639) ...

This commit adds support for role mapping expression dsl. Functionally it is similar to what we have on the server side except for the rule evaluation which is not required on the client. The role mapper expression can either be field expression or composite expression of one or more expressions. Role mapper expression parser is used to parse JSON DSL to list of expressions. This forms the base for role mapping APIs (get, post/put and delete)

jkakavas · 2018-10-02T12:00:56Z

...csearch/client/security/support/expressiondsl/expressions/CompositeRoleMapperExpression.java

+    }
+
+    public String getName() {
+        return this.getName();


s/return this.getName();/return this.name;/
Noticed this when reviewing #34171 , maybe you can correct this there.

Good catch, I will address in the other review for the create role mapping API. Thank you.

jkakavas · 2018-10-02T12:25:52Z

...rg/elasticsearch/client/security/support/expressiondsl/fields/FieldRoleMapperExpression.java

+            throw new IllegalArgumentException("null or empty field name (" + field + ")");
+        }
+        if (values == null || values.length == 0) {
+            throw new IllegalArgumentException("null or empty values (" + values + ")");


In case of an empty array, this will invoke toString() on the array which will offer no useful information. Maybe change this to

throw new IllegalArgumentException("null or empty values for field (" + field + ")");

Thanks, will address this in another review.

We added support for role mapper expression DSL in elastic#33745, that allows us to build the role mapper expression used in the role mapping (as rules for determining user roles based on what the boolean expression resolves to). This change now adds support for create/update role mapping API to the high-level rest client.

We added support for role mapper expression DSL in #33745, that allows us to build the role mapper expression used in the role mapping (as rules for determining user roles based on what the boolean expression resolves to). This change now adds support for create/update role mapping API to the high-level rest client.

This commit adds support for role mapping expression dsl. Functionally it is similar to what we have on the server side except for the rule evaluation which is not required on the client. The role mapper expression can either be field expression or composite expression of one or more expressions. Role mapper expression parser is used to parse JSON DSL to list of expressions. This forms the base for role mapping APIs (get, post/put and delete)

We added support for role mapper expression DSL in #33745, that allows us to build the role mapper expression used in the role mapping (as rules for determining user roles based on what the boolean expression resolves to). This change now adds support for create/update role mapping API to the high-level rest client.

bizybot added v7.0.0 :Core/Java High Level REST Client :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC v6.5.0 labels Sep 17, 2018

bizybot requested a review from tvernum September 17, 2018 06:18

bizybot requested a review from jkakavas September 17, 2018 06:18

tvernum requested changes Sep 17, 2018

View reviewed changes

Yogesh Gaikwad added 3 commits September 18, 2018 13:18

Refactored code to address review comment

44e8338

Removed individual expression classes, simiplified the usage using builders. Now there is FieldRoleMapperExpression for Field types (USERNAME, GROUPS, METADATA, DN) and CompositeRoleMapperExpression for Composite types (ALL, ANY, EXCEPT)

Forgot to address precommit errors.

eb599bc

Merge branch 'master' into expressiondsl-hl-api

c60f6f0

tvernum requested changes Sep 18, 2018

View reviewed changes

Yogesh Gaikwad added 2 commits September 19, 2018 15:16

Address review comments

797d5eb

Merge branch 'master' into expressiondsl-hl-api

e23103a

tvernum approved these changes Sep 26, 2018

View reviewed changes

Yogesh Gaikwad added 2 commits September 26, 2018 14:55

Merge branch 'master' into expressiondsl-hl-api

11244ee

Address review comment

0858771

jkakavas approved these changes Sep 26, 2018

View reviewed changes

Yogesh Gaikwad added 3 commits September 26, 2018 23:15

Address review comments

cc405b4

Merge branch 'master' into expressiondsl-hl-api

3f0f46a

Merge branch 'master' into expressiondsl-hl-api

c4ccdd7

Merge branch 'master' into expressiondsl-hl-api

bc842be

bizybot merged commit 53d10bb into elastic:master Sep 27, 2018

jkakavas reviewed Oct 2, 2018

View reviewed changes

jaymode mentioned this pull request Oct 2, 2018

Create/Update role mapping API #34171

Merged

colings86 added >enhancement and removed :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC labels Oct 25, 2018

colings86 added v7.0.0-beta1 and removed v7.0.0 labels Feb 7, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[HLRC] Support for role mapper expression dsl #33745

[HLRC] Support for role mapper expression dsl #33745

bizybot commented Sep 17, 2018 •

edited

elasticmachine commented Sep 17, 2018

elasticmachine commented Sep 17, 2018

tvernum Sep 17, 2018

bizybot Sep 18, 2018

tvernum Sep 17, 2018

bizybot Sep 18, 2018

tvernum Sep 17, 2018

bizybot Sep 18, 2018

tvernum Sep 17, 2018

bizybot Sep 17, 2018

bizybot commented Sep 21, 2018

tvernum left a comment

tvernum Sep 26, 2018

jkakavas left a comment

jkakavas Sep 26, 2018

bizybot Sep 26, 2018

jkakavas Sep 26, 2018

bizybot Sep 26, 2018

bizybot commented Sep 27, 2018

jkakavas Oct 2, 2018

bizybot Oct 2, 2018

jkakavas Oct 2, 2018

bizybot Oct 2, 2018

[HLRC] Support for role mapper expression dsl #33745

[HLRC] Support for role mapper expression dsl #33745

Conversation

bizybot commented Sep 17, 2018 • edited

elasticmachine commented Sep 17, 2018

elasticmachine commented Sep 17, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bizybot commented Sep 21, 2018

tvernum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkakavas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bizybot commented Sep 27, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bizybot commented Sep 17, 2018 •

edited