Allow custom authorization with an authorization engine #38225
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
commit 05b3a571658312fa4259b652d9b8478ecec278e7
Author: jaymode <jay@elastic.co>
Date: Thu Jan 31 15:48:48 2019 -0700
Move request interceptors to AuthorizationService
This change moves the RequestInterceptor iteration from the action
filter to the AuthorizationService. This is done to remove the need
for the use of a role within the request interceptors and replace it
with the AuthorizationEngine. The AuthorizationEngine interface was
also enhanced with a new method that is used to determine if a users
permission on one index is a subset of their permissions on a list
of indices or aliases.
Additionally, this change addresses some leftover cleanups.
commit 0e1c191
Merge: 3280607 b7de8e1
Author: jaymode <jay@elastic.co>
Date: Thu Jan 31 08:56:45 2019 -0700
Merge branch 'master' into security_authz_engine
commit 3280607
Author: Jay Modi <jaymode@users.noreply.github.com>
Date: Tue Jan 29 14:17:37 2019 -0700
Allow authorization engines as an extension (elastic#37785)
Authorization engines can now be registered by implementing a plugin,
which also has a service implementation of a security extension. Only
one extension may register an authorization engine and this engine will
be used for all users except reserved realm users and internal users.
commit d628008
Author: jaymode <jay@elastic.co>
Date: Tue Jan 29 10:06:09 2019 -0700
fix RBACEngine after restricted indices changes
commit 5074683
Merge: 74f2e99 3c9f703
Author: jaymode <jay@elastic.co>
Date: Tue Jan 29 08:09:39 2019 -0700
Merge branch 'master' into security_authz_engine
commit 74f2e99
Merge: 7846ee8 899dfc3
Author: jaymode <jay@elastic.co>
Date: Fri Jan 25 15:02:07 2019 -0700
Merge branch 'master' into security_authz_engine
commit 7846ee8
Merge: b9a2c81 a81931b
Author: jaymode <jay@elastic.co>
Date: Thu Jan 24 07:52:08 2019 -0700
Merge branch 'master' into security_authz_engine
commit b9a2c81
Author: jaymode <jay@elastic.co>
Date: Tue Jan 22 09:48:11 2019 -0700
Fix resolving restricted indices after merging
commit d98a77a
Merge: 83cde40 5c1a1f7
Author: jaymode <jay@elastic.co>
Date: Tue Jan 22 09:09:23 2019 -0700
Merge branch 'master' into security_authz_engine
commit 83cde40
Author: Jay Modi <jaymode@users.noreply.github.com>
Date: Tue Jan 22 08:03:19 2019 -0700
Add javadoc to the AuthorizationEngine interface (elastic#37620)
This commit adds javadocs to the AuthorizationEngine interface aimed at
developers of an authorization engine. Additionally, some classes were
also moved to the core project so that they are ready to be exposed
once we allow authorization engines to be plugged in.
commit 9a240c6
Author: Jay Modi <jaymode@users.noreply.github.com>
Date: Thu Jan 17 19:33:35 2019 -0700
Encapsulate request, auth, and action name (elastic#37495)
This change introduces a new class called RequestInfo that encapsulates
the common objects that are passed to the authorization engine methods.
By doing so, we give ourselves a way of adding additional data without
breaking the interface. Additionally, this also reduces the need to
ensure we pass these three parameters in the same order everywhere for
consistency.
commit 6278eab
Merge: c555a44 4351a5e
Author: jaymode <jay@elastic.co>
Date: Thu Jan 17 07:51:32 2019 -0700
Merge branch 'master' into security_authz_engine
commit c555a44
Merge: 1362ab6 ecf0de3
Author: jaymode <jay@elastic.co>
Date: Wed Jan 16 10:24:33 2019 -0700
Merge branch 'master' into security_authz_engine
commit 1362ab6
Author: Jay Modi <jaymode@users.noreply.github.com>
Date: Wed Jan 16 10:23:45 2019 -0700
Replace AuthorizedIndices class with a List (elastic#37328)
This change replaces the AuthorizedIndices class with a simple list.
The change to a simple list does remove the lazy loading of the
authorized indices in favor of simpler code as the loading of this
list is now an asynchronous operation that is delegated to the
authorization engine.
commit 0246442
Merge: 8ccdc19 a2a40c5
Author: jaymode <jay@elastic.co>
Date: Tue Jan 15 10:49:12 2019 -0700
Merge branch 'master' into security_authz_engine
commit 8ccdc19
Author: Jay Modi <jaymode@users.noreply.github.com>
Date: Mon Jan 7 13:43:22 2019 -0700
Introduce asynchronous RBACEngine (elastic#36245)
In order to support the concept of different authorization engines, this
change begins the refactoring of the AuthorizationService to support
this. Previously, the asynchronous work for authorization was performed
by the AsyncAuthorizer class, but this tied the authorization service
to a role based implementation. In this change, the authorize method
become asynchronous and delegates much of the actual permission checking
to an AuthorizationEngine. The pre-existing RBAC permission checking
has been abstracted into the RBACEngine. The majority of calls to
AuthorizationEngine instances are asynchronous as the underlying
implementation may need to make network calls that should not block
the current thread, which are often network threads.
This change is meant to be built upon. The basic concepts are introduced
without proper documentation, plumbing to enable other
AuthorizationEngine types, and some items we may want to refactor.
For example, the AuthorizedIndices class is lazily loaded but this might
actually be something we want to make asynchronous. We pass a lot of the
same arguments to the various methods and it would be prudent to wrap
these in a class; this class would provide a way for us to pass
additional items needed by future enhancements without breaking the
interface and requiring updates to all implementations.
See elastic#32435
This commit moves the evaluation of privileges from a few transport actions into the authorization engine. The APIs are used by other applications for making decisions and if a different authorization engine is used that is not role based, we should still allow these APIs to work. By moving this evaluation out of the transport action, the transport actions no longer have a dependency on roles.
jaymode
added
>feature
WIP
v7.0.0
:Security/Authorization
Collaborator
|
Pinging @elastic/es-security |
Member
Author
jaymode
added
v6.7.0
and removed
:Security/Authorization
Member
Author
|
closing in favor of #38358 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For some users, the built in authorization mechanism does not fit their
needs and no feature that we offer would allow them to control the
authorization process to meet their needs. In order to support this,
a concept of an
AuthorizationEngineis being introduced, which can beprovided using the security extension mechanism.
An AuthorizationEngine is responsible for making the authorization
decisions about a request. The engine is responsible for knowing how to
authorize and can be backed by whatever mechanism a user wants. The
default mechanism is one backed by roles to provide the authorization
decisions. The AuthorizationEngine will be called by the
AuthorizationService, which handles more of the internal workings that
apply in general to authorization within Elasticsearch.
In order to support external authorization services that would back an
authorization engine, the entire authorization process has become
asynchronous, which also includes all calls to the AuthorizationEngine.
The use of roles also leaked out of the AuthorizationService in our
existing code that is not specifically related to roles so this also
needed to be addressed. RequestInterceptor instances sometimes used a
role to ensure a user was not attempting to escalate their privileges.
Addressing this leakage of roles meant that the RequestInterceptor
execution needed to move within the AuthorizationService and that
AuthorizationEngines needed to support detection of whether a user has
more privileges on a name than another. The second area where roles
leaked to the user is in the handling of a few privilege APIs that
could be used to retrieve the user's privileges or ask if a user has
privileges to perform an action. To remove the leakage of roles from
these actions, the AuthorizationService and AuthorizationEngine gained
methods that enabled an AuthorizationEngine to return the response for
these APIs.
Ultimately this feature is the work included in:
#37785
#37495
#37328
#36245
#38137
#38219
Closes #32435