Remove whitelist settings in favor of allowlist

config/opensearch.yml.example

@@ -17,11 +17,11 @@ plugins.security.nodes_dn:
   - "CN=node.other.com, OU=SSL, O=Test, L=Test, C=DE"
 
 # The nodes_dn_dynamic_config_enabled settings is geared towards cross_cluster usecases where there is a need to
-# manage the whitelisted nodes_dn without having to restart the nodes everytime a new cross_cluster remote is configured
+# manage the allowlisted nodes_dn without having to restart the nodes everytime a new cross_cluster remote is configured
 # Setting nodes_dn_dynamic_config_enabled to true enables **super-admin callable** /_opendistro/_security/api/nodesdn APIs
 # which provide means to update/retrieve nodesdn dynamically.
 #
-# NOTE: The overall whitelisted nodes_dn evaluated comes from both the plugins.security.nodes_dn and the ones stored
+# NOTE: The overall allowlisted nodes_dn evaluated comes from both the plugins.security.nodes_dn and the ones stored
 # in security index.
 # (default: false)
 # NOTE2: This setting only has effect if 'plugins.security.cert.intercluster_request_evaluator_class' is not set.

src/integrationTest/java/org/opensearch/security/ConfigurationFiles.java

@@ -33,8 +33,7 @@ public static Path createConfigurationDirectory() {
                 CType.ROLES.configFileName(),
                 CType.ROLESMAPPING.configFileName(),
                 "security_tenants.yml",
-                CType.TENANTS.configFileName(),
-                CType.WHITELIST.configFileName() };
+                CType.TENANTS.configFileName() };
             for (String fileName : configurationFiles) {
                 copyResourceToFile(fileName, tempDirectory.resolve(fileName));
             }

src/main/java/org/opensearch/security/configuration/ConfigurationLoaderSecurity7.java

@@ -147,8 +147,8 @@ public void noData(String id) {
                 // Since NODESDN is newly introduced data-type applying for existing clusters as well, we make it backward compatible by
                 // returning valid empty
                 // SecurityDynamicConfiguration.
-                // Same idea for new setting WHITELIST/ALLOWLIST
-                if (cType == CType.NODESDN || cType == CType.WHITELIST || cType == CType.ALLOWLIST) {
+                // Same idea for new setting ALLOWLIST
+                if (cType == CType.NODESDN || cType == CType.ALLOWLIST) {
                     try {
                         SecurityDynamicConfiguration<?> empty = ConfigHelper.createEmptySdc(
                             cType,

src/main/java/org/opensearch/security/configuration/ConfigurationRepository.java

@@ -249,14 +249,6 @@ private void initalizeClusterConfiguration(final boolean installDefaultConfig) {
                                 DEFAULT_CONFIG_VERSION,
                                 populateEmptyIfFileMissing
                             );
-                            ConfigHelper.uploadFile(
-                                client,
-                                cd + "whitelist.yml",
-                                securityIndex,
-                                CType.WHITELIST,
-                                DEFAULT_CONFIG_VERSION,
-                                populateEmptyIfFileMissing
-                            );
                             ConfigHelper.uploadFile(
                                 client,
                                 cd + "allowlist.yml",

src/main/java/org/opensearch/security/dlic/rest/api/Endpoint.java

@@ -27,7 +27,6 @@ public enum Endpoint {
     RATELIMITERS,
     MIGRATE,
     VALIDATE,
-    WHITELIST,
     ALLOWLIST,
     NODESDN,
     SSL;

src/main/java/org/opensearch/security/dlic/rest/api/SecurityRestApiActions.java

@@ -90,8 +90,6 @@ public static Collection<RestHandler> getHandler(
             new TenantsApiAction(clusterService, threadPool, securityApiDependencies),
             new AccountApiAction(clusterService, threadPool, securityApiDependencies, passwordHasher),
             new NodesDnApiAction(clusterService, threadPool, securityApiDependencies),
-            new WhitelistApiAction(clusterService, threadPool, securityApiDependencies),
-            // FIXME change it as soon as WhitelistApiAction will be removed
             new AllowlistApiAction(Endpoint.ALLOWLIST, clusterService, threadPool, securityApiDependencies),
             new AuditApiAction(clusterService, threadPool, securityApiDependencies),
             new MultiTenancyConfigApiAction(clusterService, threadPool, securityApiDependencies),

src/main/java/org/opensearch/security/filter/SecurityRestFilter.java

@@ -55,7 +55,6 @@
 import org.opensearch.security.privileges.PrivilegesEvaluatorResponse;
 import org.opensearch.security.privileges.RestLayerPrivilegesEvaluator;
 import org.opensearch.security.securityconf.impl.AllowlistingSettings;
-import org.opensearch.security.securityconf.impl.WhitelistingSettings;
 import org.opensearch.security.ssl.http.netty.Netty4HttpRequestHeaderVerifier;
 import org.opensearch.security.ssl.transport.PrincipalExtractor;
 import org.opensearch.security.ssl.util.ExceptionUtils;
@@ -86,7 +85,6 @@ public class SecurityRestFilter {
     private final Path configPath;
     private final CompatConfig compatConfig;
 
-    private WhitelistingSettings whitelistingSettings;
     private AllowlistingSettings allowlistingSettings;
 
     public static final String HEALTH_SUFFIX = "health";
@@ -114,7 +112,6 @@ public SecurityRestFilter(
         this.settings = settings;
         this.configPath = configPath;
         this.compatConfig = compatConfig;
-        this.whitelistingSettings = new WhitelistingSettings();
         this.allowlistingSettings = new AllowlistingSettings();
     }
 
@@ -179,8 +176,7 @@ public void handleRequest(RestRequest request, RestChannel channel, NodeClient c
             if (user != null) {
                 auditLog.logSucceededLogin(user.getName(), false, intiatingUser, requestChannel);
             }
-            final Optional<SecurityResponse> deniedResponse = whitelistingSettings.checkRequestIsAllowed(requestChannel)
-                .or(() -> allowlistingSettings.checkRequestIsAllowed(requestChannel));
+            final Optional<SecurityResponse> deniedResponse = allowlistingSettings.checkRequestIsAllowed(requestChannel);
 
             if (deniedResponse.isPresent()) {
                 channel.sendResponse(deniedResponse.get().asRestResponse());
@@ -207,7 +203,7 @@ public void handleRequest(RestRequest request, RestChannel channel, NodeClient c
      * If allowlisting is enabled, then Non-SuperAdmin is allowed to access only those APIs that are allowlisted in {@link #requests}
      * For example: if allowlisting is enabled and requests = ["/_cat/nodes"], then SuperAdmin can access all APIs, but non SuperAdmin
      * can only access "/_cat/nodes"
-     * Further note: Some APIs are only accessible by SuperAdmin, regardless of allowlisting. For example: /_opendistro/_security/api/whitelist is only accessible by SuperAdmin.
+     * Further note: Some APIs are only accessible by SuperAdmin, regardless of allowlisting. For example: /_opendistro/_security/api/allowlist is only accessible by SuperAdmin.
      * See {@link AllowlistApiAction} for the implementation of this API.
      * SuperAdmin is identified by credentials, which can be passed in the curl request.
      */
@@ -320,11 +316,6 @@ public void checkAndAuthenticateRequest(SecurityRequestChannel requestChannel) t
         }
     }
 
-    @Subscribe
-    public void onWhitelistingSettingChanged(WhitelistingSettings whitelistingSettings) {
-        this.whitelistingSettings = whitelistingSettings;
-    }
-
     @Subscribe
     public void onAllowlistingSettingChanged(AllowlistingSettings allowlistingSettings) {
         this.allowlistingSettings = allowlistingSettings;

src/main/java/org/opensearch/security/securityconf/DynamicConfigFactory.java

@@ -54,7 +54,6 @@
 import org.opensearch.security.securityconf.impl.CType;
 import org.opensearch.security.securityconf.impl.NodesDn;
 import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
-import org.opensearch.security.securityconf.impl.WhitelistingSettings;
 import org.opensearch.security.securityconf.impl.v7.ActionGroupsV7;
 import org.opensearch.security.securityconf.impl.v7.ConfigV7;
 import org.opensearch.security.securityconf.impl.v7.InternalUserV7;
@@ -76,7 +75,6 @@ public class DynamicConfigFactory implements Initializable, ConfigurationChangeL
     private static SecurityDynamicConfiguration<RoleV7> staticRoles = SecurityDynamicConfiguration.empty(CType.ROLES);
     private static SecurityDynamicConfiguration<ActionGroupsV7> staticActionGroups = SecurityDynamicConfiguration.empty(CType.ACTIONGROUPS);
     private static SecurityDynamicConfiguration<TenantV7> staticTenants = SecurityDynamicConfiguration.empty(CType.TENANTS);
-    private static final WhitelistingSettings defaultWhitelistingSettings = new WhitelistingSettings();
     private static final AllowlistingSettings defaultAllowlistingSettings = new AllowlistingSettings();
     private static final AuditConfig defaultAuditConfig = AuditConfig.from(Settings.EMPTY);
 
@@ -171,7 +169,6 @@ public void onChange(ConfigurationMap typeToConfig) {
         SecurityDynamicConfiguration<RoleMappingsV7> rolesmapping = cr.getConfiguration(CType.ROLESMAPPING);
         SecurityDynamicConfiguration<TenantV7> tenants = cr.getConfiguration(CType.TENANTS);
         SecurityDynamicConfiguration<NodesDn> nodesDn = cr.getConfiguration(CType.NODESDN);
-        SecurityDynamicConfiguration<WhitelistingSettings> whitelistingSetting = cr.getConfiguration(CType.WHITELIST);
         SecurityDynamicConfiguration<AllowlistingSettings> allowlistingSetting = cr.getConfiguration(CType.ALLOWLIST);
 
         if (log.isDebugEnabled()) {
@@ -213,11 +210,6 @@ public void onChange(ConfigurationMap typeToConfig) {
                 + " with "
                 + nodesDn.getCEntries().size()
                 + " entries\n"
-                + " whitelist "
-                + whitelistingSetting.getImplementingClass()
-                + " with "
-                + whitelistingSetting.getCEntries().size()
-                + " entries\n"
                 + " allowlist "
                 + allowlistingSetting.getImplementingClass()
                 + " with "
@@ -230,7 +222,6 @@ public void onChange(ConfigurationMap typeToConfig) {
         final InternalUsersModel ium;
         final ConfigModel cm;
         final NodesDnModel nm = new NodesDnModelImpl(nodesDn);
-        final WhitelistingSettings whitelist = cr.getConfiguration(CType.WHITELIST).getCEntry("config");
         final AllowlistingSettings allowlist = cr.getConfiguration(CType.ALLOWLIST).getCEntry("config");
         final AuditConfig audit = cr.getConfiguration(CType.AUDIT).getCEntry("config");
 
@@ -278,7 +269,6 @@ public void onChange(ConfigurationMap typeToConfig) {
         eventBus.post(dcm);
         eventBus.post(ium);
         eventBus.post(nm);
-        eventBus.post(whitelist == null ? defaultWhitelistingSettings : whitelist);
         eventBus.post(allowlist == null ? defaultAllowlistingSettings : allowlist);
         if (cr.isAuditHotReloadingEnabled()) {
             eventBus.post(audit == null ? defaultAuditConfig : audit);

src/main/java/org/opensearch/security/securityconf/impl/CType.java

@@ -83,7 +83,6 @@ public class CType<T> implements Comparable<CType<?>> {
     public static final CType<RoleV7> ROLES = new CType<>("roles", "roles", RoleV7.class, 6, false);
     public static final CType<RoleMappingsV7> ROLESMAPPING = new CType<>("rolesmapping", "roles_mapping", RoleMappingsV7.class, 7, false);
     public static final CType<TenantV7> TENANTS = new CType<>("tenants", "tenants", TenantV7.class, 8, false);
-    public static final CType<WhitelistingSettings> WHITELIST = new CType<>("whitelist", "whitelist", WhitelistingSettings.class, 9, true);
 
     private final String name;
     private final String nameUpperCase;