-
Notifications
You must be signed in to change notification settings - Fork 36
Adding User support for Detector and DetectorJob #251
Changes from 3 commits
d0894cb
81093f7
ec266d0
010c88c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -48,6 +48,7 @@ | |
|
||
import com.amazon.opendistroforelasticsearch.ad.annotation.Generated; | ||
import com.amazon.opendistroforelasticsearch.ad.util.ParseUtils; | ||
import com.amazon.opendistroforelasticsearch.commons.authuser.User; | ||
import com.google.common.base.Objects; | ||
|
||
/** | ||
|
@@ -80,6 +81,7 @@ public class AnomalyDetector implements Writeable, ToXContentObject { | |
private static final String LAST_UPDATE_TIME_FIELD = "last_update_time"; | ||
public static final String UI_METADATA_FIELD = "ui_metadata"; | ||
public static final String CATEGORY_FIELD = "category_field"; | ||
public static final String USER_FIELD = "user"; | ||
|
||
private final String detectorId; | ||
private final Long version; | ||
|
@@ -96,6 +98,7 @@ public class AnomalyDetector implements Writeable, ToXContentObject { | |
private final Integer schemaVersion; | ||
private final Instant lastUpdateTime; | ||
private final List<String> categoryFields; | ||
private User user; | ||
|
||
/** | ||
* Constructor function. | ||
|
@@ -114,7 +117,8 @@ public class AnomalyDetector implements Writeable, ToXContentObject { | |
* @param uiMetadata metadata used by Kibana | ||
* @param schemaVersion anomaly detector index mapping version | ||
* @param lastUpdateTime detector's last update time | ||
* @param categoryFields a list of partition fields | ||
* @param categoryFields a list of partition fields | ||
* @param user user to which detector is associated | ||
*/ | ||
public AnomalyDetector( | ||
String detectorId, | ||
|
@@ -131,7 +135,8 @@ public AnomalyDetector( | |
Map<String, Object> uiMetadata, | ||
Integer schemaVersion, | ||
Instant lastUpdateTime, | ||
List<String> categoryFields | ||
List<String> categoryFields, | ||
User user | ||
) { | ||
if (Strings.isBlank(name)) { | ||
throw new IllegalArgumentException("Detector name should be set"); | ||
|
@@ -166,6 +171,7 @@ public AnomalyDetector( | |
this.schemaVersion = schemaVersion; | ||
this.lastUpdateTime = lastUpdateTime; | ||
this.categoryFields = categoryFields; | ||
this.user = user; | ||
} | ||
|
||
// TODO: remove after complete code merges. Created to not to touch too | ||
|
@@ -184,7 +190,8 @@ public AnomalyDetector( | |
Integer shingleSize, | ||
Map<String, Object> uiMetadata, | ||
Integer schemaVersion, | ||
Instant lastUpdateTime | ||
Instant lastUpdateTime, | ||
User user | ||
) { | ||
this( | ||
detectorId, | ||
|
@@ -201,7 +208,8 @@ public AnomalyDetector( | |
uiMetadata, | ||
schemaVersion, | ||
lastUpdateTime, | ||
null | ||
null, | ||
user | ||
); | ||
} | ||
|
||
|
@@ -237,6 +245,11 @@ public AnomalyDetector(StreamInput input) throws IOException { | |
schemaVersion = input.readInt(); | ||
lastUpdateTime = input.readInstant(); | ||
this.categoryFields = input.readStringList(); | ||
if (input.readBoolean()) { | ||
this.user = new User(input); | ||
} else { | ||
user = null; | ||
} | ||
} | ||
|
||
public XContentBuilder toXContent(XContentBuilder builder) throws IOException { | ||
|
@@ -260,6 +273,12 @@ public void writeTo(StreamOutput output) throws IOException { | |
output.writeInt(schemaVersion); | ||
output.writeInstant(lastUpdateTime); | ||
output.writeStringCollection(categoryFields); | ||
if (user != null) { | ||
output.writeBoolean(true); // user exists | ||
user.writeTo(output); | ||
} else { | ||
output.writeBoolean(false); // user does not exist | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. For old detector, they have no user field, so they will be open to all users which has AD permission ? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Exactly, for existing detectors where User doesn't exist, the filter will not work and users who have all access to rest api's will be able to see those detectors. |
||
} | ||
} | ||
|
||
@Override | ||
|
@@ -289,6 +308,9 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws | |
if (categoryFields != null) { | ||
xContentBuilder.field(CATEGORY_FIELD, categoryFields.toArray()); | ||
} | ||
if (user != null) { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Great point sure. Will add. |
||
xContentBuilder.field(USER_FIELD, user); | ||
} | ||
return xContentBuilder.endObject(); | ||
} | ||
|
||
|
@@ -354,6 +376,7 @@ public static AnomalyDetector parse( | |
int schemaVersion = 0; | ||
Map<String, Object> uiMetadata = null; | ||
Instant lastUpdateTime = null; | ||
User user = null; | ||
|
||
List<String> categoryField = null; | ||
|
||
|
@@ -415,6 +438,9 @@ public static AnomalyDetector parse( | |
case CATEGORY_FIELD: | ||
categoryField = (List) parser.list(); | ||
break; | ||
case USER_FIELD: | ||
user = User.parse(parser); | ||
break; | ||
default: | ||
parser.skipChildren(); | ||
break; | ||
|
@@ -435,7 +461,8 @@ public static AnomalyDetector parse( | |
uiMetadata, | ||
schemaVersion, | ||
lastUpdateTime, | ||
categoryField | ||
categoryField, | ||
user | ||
); | ||
} | ||
|
||
|
@@ -583,4 +610,8 @@ public long getDetectorIntervalInSeconds() { | |
public Duration getDetectionIntervalDuration() { | ||
return ((IntervalTimeConfiguration) getDetectionInterval()).toDuration(); | ||
} | ||
|
||
public User getUser() { | ||
return user; | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Here we just add
User
in each detector document. Security plugin will do authorization check for each request based onbackend_roles
orroles
? Can you share the related code?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good question, security plugin will only provide the authorization headers.
My next PR will address this. Basically we have to query and filter by
roles
orbackend_roles
.Here is a code pointer in alerting which does that: opendistro-for-elasticsearch/alerting@44abca1#diff-39bec5249e2b91e055cdb30bb3edcd28ee868ab3676e98652547bcce28eed895R86
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it, that makes sense.