Introduce dfm_empty_overrides_all setting to enable role without dls/fls to override roles with dls/fls #1735
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
from
1bde700
to
2030b14
Compare
Codecov Report
@@ Coverage Diff @@
## main #1735 +/- ##
============================================
+ Coverage 60.42% 60.48% +0.06%
- Complexity 3197 3201 +4
============================================
Files 253 253
Lines 18093 18116 +23
Branches 3245 3251 +6
============================================
+ Hits 10933 10958 +25
Misses 5579 5579
+ Partials 1581 1579 -2
Continue to review full report at Codecov.
|
rursprung
reviewed
Apr 1, 2022
src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java
Outdated
Show resolved
Hide resolved
src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
Outdated
Show resolved
Hide resolved
src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
Outdated
Show resolved
Hide resolved
src/test/java/org/opensearch/security/dlic/dlsfls/DfmOverwritesAllTest.java
Outdated
Show resolved
Hide resolved
|
|
||
| @Test | ||
| public void testDFMUnrestrictedUser() throws Exception { | ||
| // admin user sees all, no dfm restrictions apply |
There was a problem hiding this comment.
why not move such descriptive comments up into a javadoc on the test method? then it's better visible that this is the description of the test method.
(same for the other tests below)
There was a problem hiding this comment.
Done. Java doc is actually barely used in this repo, especially in the tests. But this is a great idea!
src/test/java/org/opensearch/security/dlic/dlsfls/DfmOverwritesAllTest.java
Show resolved
Hide resolved
peternied
requested changes
Apr 1, 2022
src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java
Outdated
Show resolved
Hide resolved
src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
Outdated
Show resolved
Hide resolved
src/test/java/org/opensearch/security/dlic/dlsfls/DfmOverwritesAllTest.java
Show resolved
Hide resolved
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
from
2030b14
to
3f106b0
Compare
|
it seems that the newly pushed commit only changes the author (thanks!) but didn't address any of the other findings? |
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
3 times, most recently
from
0613072
to
1e1ddbd
Compare
…fls to override roles with dls/fls Signed-off-by: cliu123 <lc12251109@gmail.com>
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
from
1e1ddbd
to
ab668d6
Compare
peternied
requested changes
Apr 8, 2022
src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
Outdated
Show resolved
Hide resolved
src/test/java/org/opensearch/security/dlic/dlsfls/DfmOverwritesAllTest.java
Show resolved
Hide resolved
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
2 times, most recently
from
560c2cd
to
9ed11a1
Compare
Co-authored-by: Ralph Ursprung <39383228+rursprung@users.noreply.github.com> Signed-off-by: cliu123 <lc12251109@gmail.com>
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
from
3683270
to
efafa9d
Compare
Signed-off-by: cliu123 <lc12251109@gmail.com>
rursprung
reviewed
Apr 9, 2022
src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
Outdated
Show resolved
Hide resolved
Signed-off-by: cliu123 <lc12251109@gmail.com>
cliu123
force-pushed
the
dfm_empty_overrides_all
branch
from
5d676e0
to
c4b65c1
Compare
peternied
approved these changes
Apr 11, 2022
|
@opensearch-project/security Could we get a second reviewer to take a look? |
davidlago
approved these changes
Apr 12, 2022
This was referenced Apr 13, 2022
1 task
wuychn
pushed a commit
to ochprince/security
that referenced
this pull request
Mar 16, 2023
…fls to override roles with dls/fls (opensearch-project#1735) * Introduce dfm_empty_overrides_all setting to enable role without dls/fls to override roles with dls/fls Signed-off-by: cliu123 <lc12251109@gmail.com> Co-authored-by: jochenkressin <jkressin@floragunn.com> Co-authored-by: Ralph Ursprung <39383228+rursprung@users.noreply.github.com>
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: cliu123 lc12251109@gmail.com
Description
The default behavior of security plugin DLS and FLS follows the least privilege principle. When a user has more than 1 role, the role with the most restrictive permissions is honored.
With the new setting
dfm_empty_overrides_allsetting explicitly being set totrue, security plugin enables role without dls/fls to override roles with dls/fls.The setting
dfm_empty_overrides_allisfalseby default.Issues Resolved
#1572
Testing
ITs
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.