Skip to content

Commit a2154b0

Browse files
tvernumkcm
tvernum
authored and
kcm
committed
Add get-user-privileges API (#33928)
This API is intended as a companion to the _has_privileges API. It returns the list of privileges that are held by the current user. This information is difficult to reason about, and consumers should avoid making direct security decisions based solely on this data. For example, each of the following index privileges (as well as many more) would grant a user access to index a new document into the "metrics-2018-08-30" index, but clients should not try and deduce that information from this API. - "all" on "*" - "all" on "metrics-*" - "write" on "metrics-2018-*" - "write" on "metrics-2018-08-30" Rather, if a client wished to know if a user had "index" access to _any_ index, it would be possible to use this API to determine whether the user has any index privileges, and on which index patterns, and then feed those index patterns into _has_privileges in order to determine whether the "index" privilege had been granted. The result JSON is modelled on the Role API, with a few small changes to reflect how privileges are modelled when multiple roles are merged together (multiple DLS queries, multiple FLS grants, multiple global conditions, etc).
1 parent 539bde3 commit a2154b0

File tree

25 files changed

+1485
-34
lines changed

25 files changed

+1485
-34
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesAction.java

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.user;
7+
8+
import org.elasticsearch.action.Action;
9+
10+
/**
11+
* Action that lists the set of privileges held by a user.
12+
*/
13+
public final class GetUserPrivilegesAction extends Action<GetUserPrivilegesResponse> {
14+
15+
public static final GetUserPrivilegesAction INSTANCE = new GetUserPrivilegesAction();
16+
public static final String NAME = "cluster:admin/xpack/security/user/list_privileges";
17+
18+
private GetUserPrivilegesAction() {
19+
super(NAME);
20+
}
21+
22+
@Override
23+
public GetUserPrivilegesResponse newResponse() {
24+
return new GetUserPrivilegesResponse();
25+
}
26+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesRequest.java

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.user;
7+
8+
import org.elasticsearch.action.ActionRequest;
9+
import org.elasticsearch.action.ActionRequestValidationException;
10+
import org.elasticsearch.common.io.stream.StreamInput;
11+
import org.elasticsearch.common.io.stream.StreamOutput;
12+
13+
import java.io.IOException;
14+
15+
/**
16+
* A request for checking a user's privileges
17+
*/
18+
public final class GetUserPrivilegesRequest extends ActionRequest implements UserRequest {
19+
20+
private String username;
21+
22+
/**
23+
* Package level access for {@link GetUserPrivilegesRequestBuilder}.
24+
*/
25+
GetUserPrivilegesRequest() {
26+
}
27+
28+
public GetUserPrivilegesRequest(StreamInput in) throws IOException {
29+
super(in);
30+
this.username = in.readString();
31+
}
32+
33+
@Override
34+
public ActionRequestValidationException validate() {
35+
return null;
36+
}
37+
38+
/**
39+
* @return the username that this request applies to.
40+
*/
41+
public String username() {
42+
return username;
43+
}
44+
45+
/**
46+
* Set the username that the request applies to. Must not be {@code null}
47+
*/
48+
public void username(String username) {
49+
this.username = username;
50+
}
51+
52+
@Override
53+
public String[] usernames() {
54+
return new String[] { username };
55+
}
56+
57+
/**
58+
* Always throws {@link UnsupportedOperationException} as this object should be deserialized using
59+
* the {@link #GetUserPrivilegesRequest(StreamInput)} constructor instead.
60+
*/
61+
@Override
62+
@Deprecated
63+
public void readFrom(StreamInput in) throws IOException {
64+
throw new UnsupportedOperationException("Use " + getClass() + " as Writeable not Streamable");
65+
}
66+
67+
@Override
68+
public void writeTo(StreamOutput out) throws IOException {
69+
super.writeTo(out);
70+
out.writeString(username);
71+
}
72+
73+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesRequestBuilder.java

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.user;
7+
8+
import org.elasticsearch.action.ActionRequestBuilder;
9+
import org.elasticsearch.client.ElasticsearchClient;
10+
11+
/**
12+
* Request builder for checking a user's privileges
13+
*/
14+
public class GetUserPrivilegesRequestBuilder
15+
extends ActionRequestBuilder<GetUserPrivilegesRequest, GetUserPrivilegesResponse> {
16+
17+
public GetUserPrivilegesRequestBuilder(ElasticsearchClient client) {
18+
super(client, GetUserPrivilegesAction.INSTANCE, new GetUserPrivilegesRequest());
19+
}
20+
21+
/**
22+
* Set the username of the user whose privileges should be retrieved. Must not be {@code null}
23+
*/
24+
public GetUserPrivilegesRequestBuilder username(String username) {
25+
request.username(username);
26+
return this;
27+
}
28+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/user/GetUserPrivilegesResponse.java

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.user;
7+
8+
import org.elasticsearch.action.ActionResponse;
9+
import org.elasticsearch.common.Strings;
10+
import org.elasticsearch.common.bytes.BytesReference;
11+
import org.elasticsearch.common.io.stream.StreamInput;
12+
import org.elasticsearch.common.io.stream.StreamOutput;
13+
import org.elasticsearch.common.io.stream.Writeable;
14+
import org.elasticsearch.common.xcontent.ToXContentObject;
15+
import org.elasticsearch.common.xcontent.XContentBuilder;
16+
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor;
17+
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsDefinition;
18+
import org.elasticsearch.xpack.core.security.authz.privilege.ConditionalClusterPrivilege;
19+
import org.elasticsearch.xpack.core.security.authz.privilege.ConditionalClusterPrivileges;
20+
21+
import java.io.IOException;
22+
import java.util.Collection;
23+
import java.util.Collections;
24+
import java.util.Objects;
25+
import java.util.Set;
26+
import java.util.TreeSet;
27+
import java.util.stream.Collectors;
28+
29+
/**
30+
* Response for a {@link GetUserPrivilegesRequest}
31+
*/
32+
public final class GetUserPrivilegesResponse extends ActionResponse {
33+
34+
private Set<String> cluster;
35+
private Set<ConditionalClusterPrivilege> conditionalCluster;
36+
private Set<Indices> index;
37+
private Set<RoleDescriptor.ApplicationResourcePrivileges> application;
38+
private Set<String> runAs;
39+
40+
public GetUserPrivilegesResponse() {
41+
this(Collections.emptySet(), Collections.emptySet(), Collections.emptySet(), Collections.emptySet(), Collections.emptySet());
42+
}
43+
44+
public GetUserPrivilegesResponse(Set<String> cluster, Set<ConditionalClusterPrivilege> conditionalCluster,
45+
Set<Indices> index,
46+
Set<RoleDescriptor.ApplicationResourcePrivileges> application,
47+
Set<String> runAs) {
48+
this.cluster = Collections.unmodifiableSet(cluster);
49+
this.conditionalCluster = Collections.unmodifiableSet(conditionalCluster);
50+
this.index = Collections.unmodifiableSet(index);
51+
this.application = Collections.unmodifiableSet(application);
52+
this.runAs = Collections.unmodifiableSet(runAs);
53+
}
54+
55+
public Set<String> getClusterPrivileges() {
56+
return cluster;
57+
}
58+
59+
public Set<ConditionalClusterPrivilege> getConditionalClusterPrivileges() {
60+
return conditionalCluster;
61+
}
62+
63+
public Set<Indices> getIndexPrivileges() {
64+
return index;
65+
}
66+
67+
public Set<RoleDescriptor.ApplicationResourcePrivileges> getApplicationPrivileges() {
68+
return application;
69+
}
70+
71+
public Set<String> getRunAs() {
72+
return runAs;
73+
}
74+
75+
public void readFrom(StreamInput in) throws IOException {
76+
super.readFrom(in);
77+
cluster = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
78+
conditionalCluster = Collections.unmodifiableSet(in.readSet(ConditionalClusterPrivileges.READER));
79+
index = Collections.unmodifiableSet(in.readSet(Indices::new));
80+
application = Collections.unmodifiableSet(in.readSet(RoleDescriptor.ApplicationResourcePrivileges::createFrom));
81+
runAs = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
82+
}
83+
84+
@Override
85+
public void writeTo(StreamOutput out) throws IOException {
86+
super.writeTo(out);
87+
out.writeCollection(cluster, StreamOutput::writeString);
88+
out.writeCollection(conditionalCluster, ConditionalClusterPrivileges.WRITER);
89+
out.writeCollection(index, (o, p) -> p.writeTo(o));
90+
out.writeCollection(application, (o, p) -> p.writeTo(o));
91+
out.writeCollection(runAs, StreamOutput::writeString);
92+
}
93+
94+
@Override
95+
public boolean equals(Object other) {
96+
if (this == other) {
97+
return true;
98+
}
99+
if (other == null || getClass() != other.getClass()) {
100+
return false;
101+
}
102+
final GetUserPrivilegesResponse that = (GetUserPrivilegesResponse) other;
103+
return Objects.equals(cluster, that.cluster) &&
104+
Objects.equals(conditionalCluster, that.conditionalCluster) &&
105+
Objects.equals(index, that.index) &&
106+
Objects.equals(application, that.application) &&
107+
Objects.equals(runAs, that.runAs);
108+
}
109+
110+
@Override
111+
public int hashCode() {
112+
return Objects.hash(cluster, conditionalCluster, index, application, runAs);
113+
}
114+
115+
/**
116+
* This is modelled on {@link RoleDescriptor.IndicesPrivileges}, with support for multiple DLS and FLS field sets.
117+
*/
118+
public static class Indices implements ToXContentObject, Writeable {
119+
120+
private final Set<String> indices;
121+
private final Set<String> privileges;
122+
private final Set<FieldPermissionsDefinition.FieldGrantExcludeGroup> fieldSecurity;
123+
private final Set<BytesReference> queries;
124+
125+
public Indices(Collection<String> indices, Collection<String> privileges,
126+
Set<FieldPermissionsDefinition.FieldGrantExcludeGroup> fieldSecurity, Set<BytesReference> queries) {
127+
// The use of TreeSet is to provide a consistent order that can be relied upon in tests
128+
this.indices = Collections.unmodifiableSet(new TreeSet<>(Objects.requireNonNull(indices)));
129+
this.privileges = Collections.unmodifiableSet(new TreeSet<>(Objects.requireNonNull(privileges)));
130+
this.fieldSecurity = Collections.unmodifiableSet(Objects.requireNonNull(fieldSecurity));
131+
this.queries = Collections.unmodifiableSet(Objects.requireNonNull(queries));
132+
}
133+
134+
public Indices(StreamInput in) throws IOException {
135+
indices = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
136+
privileges = Collections.unmodifiableSet(in.readSet(StreamInput::readString));
137+
fieldSecurity = Collections.unmodifiableSet(in.readSet(input -> {
138+
final String[] grant = input.readOptionalStringArray();
139+
final String[] exclude = input.readOptionalStringArray();
140+
return new FieldPermissionsDefinition.FieldGrantExcludeGroup(grant, exclude);
141+
}));
142+
queries = Collections.unmodifiableSet(in.readSet(StreamInput::readBytesReference));
143+
}
144+
145+
public Set<String> getIndices() {
146+
return indices;
147+
}
148+
149+
public Set<String> getPrivileges() {
150+
return privileges;
151+
}
152+
153+
public Set<FieldPermissionsDefinition.FieldGrantExcludeGroup> getFieldSecurity() {
154+
return fieldSecurity;
155+
}
156+
157+
public Set<BytesReference> getQueries() {
158+
return queries;
159+
}
160+
161+
@Override
162+
public String toString() {
163+
StringBuilder sb = new StringBuilder(getClass().getSimpleName())
164+
.append("[")
165+
.append("indices=[").append(Strings.collectionToCommaDelimitedString(indices))
166+
.append("], privileges=[").append(Strings.collectionToCommaDelimitedString(privileges))
167+
.append("]");
168+
if (fieldSecurity.isEmpty() == false) {
169+
sb.append(", fls=[").append(Strings.collectionToCommaDelimitedString(fieldSecurity)).append("]");
170+
}
171+
if (queries.isEmpty() == false) {
172+
sb.append(", dls=[")
173+
.append(queries.stream().map(BytesReference::utf8ToString).collect(Collectors.joining(",")))
174+
.append("]");
175+
}
176+
sb.append("]");
177+
return sb.toString();
178+
}
179+
180+
@Override
181+
public boolean equals(Object o) {
182+
if (this == o) return true;
183+
if (o == null || getClass() != o.getClass()) return false;
184+
185+
Indices that = (Indices) o;
186+
187+
return this.indices.equals(that.indices)
188+
&& this.privileges.equals(that.privileges)
189+
&& this.fieldSecurity.equals(that.fieldSecurity)
190+
&& this.queries.equals(that.queries);
191+
}
192+
193+
@Override
194+
public int hashCode() {
195+
return Objects.hash(indices, privileges, fieldSecurity, queries);
196+
}
197+
198+
@Override
199+
public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
200+
builder.startObject();
201+
builder.field(RoleDescriptor.Fields.NAMES.getPreferredName(), indices);
202+
builder.field(RoleDescriptor.Fields.PRIVILEGES.getPreferredName(), privileges);
203+
if (fieldSecurity.stream().anyMatch(g -> nonEmpty(g.getGrantedFields()) || nonEmpty(g.getExcludedFields()))) {
204+
builder.startArray(RoleDescriptor.Fields.FIELD_PERMISSIONS.getPreferredName());
205+
for (FieldPermissionsDefinition.FieldGrantExcludeGroup group : this.fieldSecurity) {
206+
builder.startObject();
207+
if (nonEmpty(group.getGrantedFields())) {
208+
builder.array(RoleDescriptor.Fields.GRANT_FIELDS.getPreferredName(), group.getGrantedFields());
209+
}
210+
if (nonEmpty(group.getExcludedFields())) {
211+
builder.array(RoleDescriptor.Fields.EXCEPT_FIELDS.getPreferredName(), group.getExcludedFields());
212+
}
213+
builder.endObject();
214+
}
215+
builder.endArray();
216+
}
217+
if (queries.isEmpty() == false) {
218+
builder.startArray(RoleDescriptor.Fields.QUERY.getPreferredName());
219+
for (BytesReference q : queries) {
220+
builder.value(q.utf8ToString());
221+
}
222+
builder.endArray();
223+
}
224+
return builder.endObject();
225+
}
226+
227+
private boolean nonEmpty(String[] grantedFields) {
228+
return grantedFields != null && grantedFields.length != 0;
229+
}
230+
231+
@Override
232+
public void writeTo(StreamOutput out) throws IOException {
233+
out.writeCollection(indices, StreamOutput::writeString);
234+
out.writeCollection(privileges, StreamOutput::writeString);
235+
out.writeCollection(fieldSecurity, (output, fields) -> {
236+
output.writeOptionalStringArray(fields.getGrantedFields());
237+
output.writeOptionalStringArray(fields.getExcludedFields());
238+
});
239+
out.writeCollection(queries, StreamOutput::writeBytesReference);
240+
}
241+
}
242+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptor.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -763,6 +763,10 @@ public Builder privileges(String... privileges) {
763763
return this;
764764
}
765765

766+
public Builder privileges(Collection<String> privileges) {
767+
return privileges(privileges.toArray(new String[privileges.size()]));
768+
}
769+
766770
public Builder grantedFields(String... grantedFields) {
767771
indicesPrivileges.grantedFields = grantedFields;
768772
return this;
@@ -919,7 +923,7 @@ public Builder resources(String... resources) {
919923
return this;
920924
}
921925

922-
public Builder resources(List<String> resources) {
926+
public Builder resources(Collection<String> resources) {
923927
return resources(resources.toArray(new String[resources.size()]));
924928
}
925929

0 commit comments

Comments
 (0)