[Feature] Introduces Centralized Resource Access Control and Sharing #5016

DarshitChanpura · 2025-01-10T18:27:13Z

Description

Introduces a new authorization mechanism to control access to resources defined by plugins.
There are 4 major components to this PR:

Introduces an SPI that defines the contracts for a resource sharing plugin as well as Resource Access Control plugin.
Introduces a client that can be used by plugins to implement resource-access-control.
Introduces 4 new APIs that expose resource-sharing and access verification capabilities.
Adds a sample resource plugin with tests to demonstrate the usage of this new feature.
Adds a feature flag to toggle the feature. Feature is enabled by default.

Category : New feature
Why these changes are required?
- At present, plugins have implemented in-house authorization mechanisms for a lack of centralized framework. This PR introduces a centralized way to offload resource permissions check to security plugin.

Issues Resolved

Related to [Proposal] Resource Permissions and Sharing #4500

Testing

automated and manual testing

Check List

New functionality includes testing
New functionality has been documented
New Roles/Permissions have a corresponding security dashboards plugin PR
API changes companion pull request created
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Darshit Chanpura <[email protected]>

…in action Signed-off-by: Darshit Chanpura <[email protected]>

Signed-off-by: Darshit Chanpura <[email protected]>

… term Signed-off-by: Darshit Chanpura <[email protected]>

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura · 2025-03-17T00:38:51Z

Sample-resource-plugin integrations tests pass locally:

➜  security git:(resource-sharing-spi) ./gradlew clean :opensearch-sample-resource-plugin:integrationTest
=======================================
OpenSearch Build Hamster says Hello!
  Gradle Version        : 8.13
  OS Info               : Mac OS X 15.3.1 (aarch64)
  JDK Version           : 21 (Eclipse Temurin JDK)
  JAVA_HOME             : /.sdkman/candidates/java/21.0.4-tem
  Random Testing Seed   : 20F70E3D35573259
  In FIPS 140 mode      : false
=======================================

> Task :opensearch-security-common:compileJava
Note: ~/security/common/src/main/java/org/opensearch/security/common/support/Utils.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.

> Task :compileJava
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.

> Task :compileIntegrationTestJava
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.

[Incubating] Problems report is available at: file:///~/security/build/reports/problems/problems-report.html

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

For more on this, please refer to https://docs.gradle.org/8.13/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.

BUILD SUCCESSFUL in 42s
19 actionable tasks: 19 executed
➜  security git:(resource-sharing-spi)

nibix

This is a huge change. Meanwhile, it's architectural decisions like the common module are not entirely clear to me, which makes reviewing quite difficult.

Thus, I could only skim the changes, and added a few comments.

For a thorough review, I do not have the time ATM, though :-(

nibix · 2025-03-17T07:24:22Z

client/README.md

+
+# **Resource Sharing Client**
+
+This package provides a **ResourceSharing client** that resource plugins can use to **implement access control** by communicating with the **OpenSearch Security Plugin**.


How do plugins consume this? Is this published as a separate maven package?

This README should probably have instructions on how to consume it.

nibix · 2025-03-17T07:47:43Z

common/src/main/java/org/opensearch/security/common/package-info.java

+ */
+
+/**
+ * This package defines common classes required to implement resource access control in OpenSearch.


It is unclear to me why these classes need to be moved into an own module. I see that the client module depends on it via an implementation dependency, right? So, will each plugin then carry a JAR with these implementations?

As some of them feel rather security-core-ish, like AdminDNs, I am not sure if it is good to move these out of the security core.

nibix · 2025-03-17T07:51:46Z

common/src/main/java/org/opensearch/security/common/resources/ResourceAccessHandler.java

+
+        // If no user is authenticated, return an empty set
+        if (user == null) {
+            LOGGER.warn("Unable to fetch user details. User is null.");


A resource sharing plugin indirectly cosumes the code via the client dependency, right?

Will this be also the case when security is disabled?

If so, what's the strategy for the case that security is disabled? Here it looks like that resources are not available at all when security is disabled (i.e., the user object is null).

When security is disabled, the call will not reach here. Instead it would fail [here in the client] (

security/client/src/main/java/org/opensearch/security/client/resources/ResourceSharingNodeClient.java

Line 68 in e6d43b6

client.execute(ResourceAccessAction.INSTANCE, request, verifyAccessResponseListener(listener));

) with action not found

Does that mean that resource plugins cannot be used when security is disabled?

nibix · 2025-03-17T07:53:05Z

src/main/java/org/opensearch/security/auth/BackendRegistry.java

@@ -224,7 +225,7 @@ public boolean authenticate(final SecurityRequestChannel request) {
        if (adminDns.isAdminDN(sslPrincipal)) {
            // PKI authenticated REST call
            User superuser = new User(sslPrincipal);
-            UserSubject subject = new UserSubjectImpl(threadPool, superuser);
+            UserSubject subject = new UserSubjectImpl(threadPool, new org.opensearch.security.common.user.User(sslPrincipal));


Why is this change necessary?

At present, the persistent header is only utilized in ResourceAccessHandler. And since we have an implementation of User in common package, we utilize that package's User here to avoid mismatch issues during runtime. This will be cleaned up once User is completely moved to common package.

nibix · 2025-03-17T07:55:01Z

src/test/java/org/opensearch/security/IndexIntegrationTests.java

@@ -846,19 +846,16 @@ public void testIndexResolveMinus() throws Exception {
        resc = rh.executeGetRequest("/*,-foo*/_search", encodeBasicHeader("foo_all", "nagilum"));
        assertThat(resc.getStatusCode(), is(HttpStatus.SC_FORBIDDEN));

-        resc = rh.executeGetRequest("/*,-*security/_search", encodeBasicHeader("foo_all", "nagilum"));
+        resc = rh.executeGetRequest("/*,-*security,-*resource*/_search", encodeBasicHeader("foo_all", "nagilum"));


Following up on this: https://github.com/opensearch-project/security/pull/5016/files#r1992120543

I think this indicates a deeper problem that needs to be investigated.

I believe this might require updating the test framework. But I believe that could be done in a separate PR.

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura · 2025-03-17T16:33:15Z

@nibix I understand this is a huge change, but I've tried to split it into multiple components, and highlighted the same in PR description.

Client was added to allow plugins to call the resource sharing APIs. I've followed the framework implement by ml-commons
Common module was added to avoid circular dependency between SPI, client and security. This pattern is already present in ml-commons.
There are some redundant files that are needed in common, which will be removed in a fast follow PR. (adding those changes is out of scope for this PR)
I've added a comprehensive developer documentation here: https://github.com/opensearch-project/security/blob/d88ca438d69c17e0eb1b904178e10373a617e37b/RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

I've documented the final design in detail here: #4500 (comment)

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura · 2025-03-17T22:46:19Z

As reviewers are leaning towards smaller PR, I'm closing this monolith, in lieu of individual PRs:

[Resource Access Control] [Part1] Introduces SPI for resource access control #5185
[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation via common package #5186
[Resource Access Control] [Part3] Introduces a sample plugin to demonstrate usage of Resource Access Control feature #5187

nibix · 2025-03-18T06:28:21Z

@DarshitChanpura

I understand this is a huge change, but I've tried to split it into multiple components, and highlighted the same in PR description.

Apologies, I did not want to sound harsh. Just wanted to point out that I cannot give a thorough and complete review at the moment due to the size and time constraints.

DarshitChanpura added 30 commits November 20, 2024 17:34

Add a base setup for resource access evaluation

831dca3

Signed-off-by: Darshit Chanpura <[email protected]>

Adds handler and other access management components for resource sharing

1c65eff

Signed-off-by: Darshit Chanpura <[email protected]>

Adds sample resource plugin

118cb07

Signed-off-by: Darshit Chanpura <[email protected]>

Removes node_modules entry from gitingore

c41b67d

Signed-off-by: Darshit Chanpura <[email protected]>

Handles changes related to scope

45d4fa5

Signed-off-by: Darshit Chanpura <[email protected]>

Updates sample plugin to implement a custom scope

ae2464d

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes Checkstyle and spotless issues

aea2253

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes initialization error

1e17dc0

Signed-off-by: Darshit Chanpura <[email protected]>

Renames sample resource plugin and adds a logger statement

84746e8

Signed-off-by: Darshit Chanpura <[email protected]>

Changes package name for sample plugin

83e4da0

Signed-off-by: Darshit Chanpura <[email protected]>

Re-organizes and renames sample plugin files

4b9b9b1

Signed-off-by: Darshit Chanpura <[email protected]>

Updates method references to conform to core

81216f1

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes compile errors

1e33dad

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes some names and method implementations

a671cc1

Signed-off-by: Darshit Chanpura <[email protected]>

Adds few concrete method implementations in security plugin

47b73da

Signed-off-by: Darshit Chanpura <[email protected]>

Adds capability to introduce index listeners for all resource plugins

8942a80

Signed-off-by: Darshit Chanpura <[email protected]>

Removes sampleplugin to be added in a separate PR

2b06603

Signed-off-by: Darshit Chanpura <[email protected]>

Updates settings.gradle

6f42bf1

Signed-off-by: Darshit Chanpura <[email protected]>

Adds a sample resource plugin to demonstrate resource access control …

561e294

…in action Signed-off-by: Darshit Chanpura <[email protected]>

Fixes imports

45b002e

Signed-off-by: Darshit Chanpura <[email protected]>

Cleans up create action

57661e7

Signed-off-by: Darshit Chanpura <[email protected]>

Adds concrete implementations of remainder methods

a30be57

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes create API

d68f349

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes spotless errors

58003f6

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes log statement

078a976

Signed-off-by: Darshit Chanpura <[email protected]>

Adds Revoke API and cleans up existing APIs

0460549

Signed-off-by: Darshit Chanpura <[email protected]>

Renames ResourceManagement repository and add keyword to search query…

8e44cf3

… term Signed-off-by: Darshit Chanpura <[email protected]>

Fixes delete method

16a0ba6

Signed-off-by: Darshit Chanpura <[email protected]>

Adds delete API and refactors package structure

46960ea

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes updateByQuery painless script

ac53c8f

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura mentioned this pull request Mar 13, 2025

Introduce a feature flag for initial release to allow seamless upgrade experience #4563

Closed

DarshitChanpura added 4 commits March 14, 2025 14:19

Merge remote-tracking branch 'upstream/main' into resource-sharing-spi

e991134

Adds local staging publication

b97946f

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes readmes and clarifies tests

e050d1d

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes cache

f4cad15

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-spi branch from 2e97360 to f4cad15 Compare March 16, 2025 23:11

Optimizes maven publish workflow

f9ce77a

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-spi branch from 8f62c8f to f9ce77a Compare March 16, 2025 23:51

Explicitly adds enabled setting in integtests

4ccec7c

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-spi branch from 466734d to 4ccec7c Compare March 17, 2025 00:11

nibix reviewed Mar 17, 2025

View reviewed changes

DarshitChanpura added 2 commits March 17, 2025 12:20

Merge remote-tracking branch 'upstream/main' into resource-sharing-spi

69bf36a

Update plugin dev readme

d88ca43

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura added 6 commits March 17, 2025 15:18

Adds integ tests for security disabled case

bbab809

Signed-off-by: Darshit Chanpura <[email protected]>

Update ResourceSharingException to throw NOT_IMPLEMENTED

7462183

Signed-off-by: Darshit Chanpura <[email protected]>

Updates client with clearer message

8ee5805

Signed-off-by: Darshit Chanpura <[email protected]>

Updates test framework to include a security disabled setup

aac9724

Signed-off-by: Darshit Chanpura <[email protected]>

Merge remote-tracking branch 'upstream/main' into resource-sharing-spi

df217ee

Explicitly adds retry logic

2d19530

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-spi branch from 9195805 to 2d19530 Compare March 17, 2025 19:40

This was referenced Mar 17, 2025

[Resource Access Control] [Part1] Introduces SPI for resource access control #5185

Open

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation via common package #5186

Closed

Merge remote-tracking branch 'upstream/main' into resource-sharing-spi

e6a47f5

DarshitChanpura mentioned this pull request Mar 17, 2025

[Resource Access Control] [Part3] Introduces a sample plugin to demonstrate usage of Resource Access Control feature #5187

Draft

3 tasks

DarshitChanpura closed this Mar 17, 2025

DarshitChanpura mentioned this pull request Mar 20, 2025

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Feature] Introduces Centralized Resource Access Control and Sharing #5016

[Feature] Introduces Centralized Resource Access Control and Sharing #5016

DarshitChanpura commented Jan 10, 2025 •

edited

Loading

DarshitChanpura commented Mar 17, 2025

nibix left a comment

nibix Mar 17, 2025

nibix Mar 17, 2025

nibix Mar 17, 2025

DarshitChanpura Mar 17, 2025

nibix Mar 17, 2025

nibix Mar 17, 2025

DarshitChanpura Mar 17, 2025

nibix Mar 17, 2025

DarshitChanpura Mar 17, 2025

DarshitChanpura commented Mar 17, 2025

DarshitChanpura commented Mar 17, 2025 •

edited

Loading

nibix commented Mar 18, 2025


		# Resource Sharing Client

		This package provides a ResourceSharing client that resource plugins can use to implement access control by communicating with the OpenSearch Security Plugin.

[Feature] Introduces Centralized Resource Access Control and Sharing #5016

[Feature] Introduces Centralized Resource Access Control and Sharing #5016

Conversation

DarshitChanpura commented Jan 10, 2025 • edited Loading

Description

Issues Resolved

Testing

Check List

DarshitChanpura commented Mar 17, 2025

nibix left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura commented Mar 17, 2025

DarshitChanpura commented Mar 17, 2025 • edited Loading

nibix commented Mar 18, 2025

DarshitChanpura commented Jan 10, 2025 •

edited

Loading

DarshitChanpura commented Mar 17, 2025 •

edited

Loading