Skip to content

Commit 33c2dc4

Browse files
Conforms to SPI file name changes and removes spi package
Signed-off-by: Darshit Chanpura <[email protected]>
1 parent f18a530 commit 33c2dc4

29 files changed

+48
-1842
lines changed

RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ The **Resource Sharing and Access Control** feature in OpenSearch Security Plugi
88
- **Super admins** to access all resources.
99
- Plugins to **define and manage resource access** via a standardized interface.
1010

11-
This feature ensures **secure** and **controlled** access to resources while leveraging existing **index-level authorization** in OpenSearch.
11+
This feature ensures **secure** and **controlled** access to shareableResources while leveraging existing **index-level authorization** in OpenSearch.
1212

1313
---
1414

@@ -37,7 +37,7 @@ implementation group: 'org.opensearch', name:'opensearch-security-client', versi
3737
```
3838
- **Declare a `compileOnly` dependency** on `opensearch-resource-sharing-spi` package:
3939
```build.gradle
40-
compileOnly "org.opensearch:opensearch-resource-sharing-spi:${opensearch_build}"
40+
compileOnly group: 'org.opensearch', name:'opensearch-resource-sharing-spi', version:"${opensearch_build}"
4141
```
4242
- **Extend** `opensearch-security` plugin with optional flag:
4343
```build.gradle
@@ -77,7 +77,7 @@ This feature is controlled by the following flag:
7777
### **Declaring a Plugin as a Resource Plugin**
7878
To integrate with the security plugin, your plugin must:
7979
1. Extend `ResourceSharingExtension` and implement required methods.
80-
2. Implement the `Resource` interface for resource declaration.
80+
2. Implement the `ShareableResource` interface for resource declaration.
8181
3. Implement a resource parser to extract resource details.
8282

8383
[`opensearch-resource-sharing-spi` README.md](./spi/README.md) is a great resource to learn more about the components of SPI and how to set up.
@@ -108,7 +108,7 @@ public class SampleResourcePlugin extends Plugin implements SystemIndexPlugin, R
108108
}
109109

110110
@Override
111-
public ResourceParser<SampleResource> getResourceParser() {
111+
public ShareableResourceParser<SampleResource> getShareableResourceParser() {
112112
return new SampleResourceParser();
113113
}
114114
}
@@ -153,7 +153,7 @@ This feature introduces a new **sharing mechanism** called **scopes**. Scopes de
153153

154154
Each plugin must **document its scope definitions** so that users understand the **sharing semantics** and how different scopes affect access control.
155155

156-
Scopes enable **granular access control**, allowing resources to be shared with **customized permission levels**, making the system more flexible and adaptable to different use cases.
156+
Scopes enable **granular access control**, allowing shareableResources to be shared with **customized permission levels**, making the system more flexible and adaptable to different use cases.
157157

158158
### **Common Scopes for Plugins to declare**
159159
| Scope | Description |
@@ -162,7 +162,7 @@ Scopes enable **granular access control**, allowing resources to be shared with
162162
| `READ_ONLY` | Users can view but not modify the resource. |
163163
| `READ_WRITE` | Users can view and modify the resource. |
164164

165-
By default, all resources are private and only visible to the owner and super-admins. Resources become accessible to others only when explicitly shared.
165+
By default, all shareableResources are private and only visible to the owner and super-admins. Resources become accessible to others only when explicitly shared.
166166

167167
SPI provides you an interface, with two default scopes `PUBLIC` and `RESTRICTED`, which can be extended to introduce more plugin-specific values.
168168

@@ -451,7 +451,7 @@ Returns an array of accessible resources.
451451
---
452452

453453
## **Conclusion**
454-
The **Resource Sharing and Access Control** feature enhances OpenSearch security by introducing an **additional layer of fine-grained access management** for plugin-defined resources. While **Fine-Grained Access Control (FGAC)** is already enabled, this feature provides **even more granular control** specifically for **resource-level access** within plugins.
454+
The **Resource Sharing and Access Control** feature enhances OpenSearch security by introducing an **additional layer of fine-grained access management** for plugin-defined shareableResources. While **Fine-Grained Access Control (FGAC)** is already enabled, this feature provides **even more granular control** specifically for **resource-level access** within plugins.
455455

456456
By implementing the **Service Provider Interface (SPI)**, utilizing the **security client**, and following **best practices**, developers can seamlessly integrate this feature into their plugins to enforce controlled resource sharing and access management.
457457

client/README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ protected void doExecute(Task task, DeleteResourceRequest request, ActionListene
7979

8080
## **Available Java APIs**
8181

82-
The **`ResourceSharingClient`** provides **four Java APIs** for **resource access control**, enabling plugins to **verify, share, revoke, and list** resources.
82+
The **`ResourceSharingClient`** provides **four Java APIs** for **resource access control**, enabling plugins to **verify, share, revoke, and list** shareableResources.
8383

8484
**Package Location:**
8585
[`org.opensearch.security.client.resources.ResourceSharingClient`](../client/src/main/java/org/opensearch/security/client/resources/ResourceSharingClient.java)
@@ -185,7 +185,7 @@ resourceSharingClient.revokeResourceAccess(
185185
---
186186

187187
### **4. `listAllAccessibleResources`**
188-
**Retrieves all resources the current user has access to.**
188+
**Retrieves all shareableResources the current user has access to.**
189189

190190
#### **Method Signature:**
191191
```java
@@ -196,16 +196,16 @@ void listAllAccessibleResources(String resourceIndex, ActionListener<Set<? exten
196196
```java
197197
resourceSharingClient.listAllAccessibleResources(
198198
"resource_index",
199-
ActionListener.wrap(resources -> {
200-
for (Resource resource : resources) {
199+
ActionListener.wrap(shareableResources -> {
200+
for (Resource resource : shareableResources) {
201201
System.out.println("Accessible Resource: " + resource.getId());
202202
}
203203
}, e -> {
204-
System.err.println("Failed to list accessible resources: " + e.getMessage());
204+
System.err.println("Failed to list accessible shareableResources: " + e.getMessage());
205205
})
206206
);
207207
```
208-
> **Use Case:** Helps a user identify **which resources they can interact with**.
208+
> **Use Case:** Helps a user identify **which shareableResources they can interact with**.
209209
210210
---
211211

@@ -214,7 +214,7 @@ These APIs provide essential methods for **fine-grained resource access control*
214214

215215
**Verification** of resource access.
216216
**Granting and revoking** access dynamically.
217-
**Retrieval** of all accessible resources.
217+
**Retrieval** of all accessible shareableResources.
218218

219219
For further details, refer to the [`ResourceSharingClient` Java class](../client/src/main/java/org/opensearch/security/client/resources/ResourceSharingClient.java).
220220

client/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ repositories {
3434

3535
dependencies {
3636
compileOnly "org.opensearch:opensearch:${opensearch_version}"
37-
compileOnly project(path: ":opensearch-resource-sharing-spi")
37+
compileOnly group: 'org.opensearch', name:'opensearch-resource-sharing-spi', version:"${opensearch_build}"
3838
compileOnly project(":")
3939
}
4040

client/src/main/java/org/opensearch/security/client/resources/ResourceSharingClient.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
import java.util.Set;
1313

1414
import org.opensearch.core.action.ActionListener;
15-
import org.opensearch.security.spi.resources.Resource;
15+
import org.opensearch.security.spi.resources.ShareableResource;
1616
import org.opensearch.security.spi.resources.sharing.ResourceSharing;
1717

1818
/**
@@ -61,5 +61,5 @@ void revokeResourceAccess(
6161
* @param resourceIndex The index containing the resources.
6262
* @param listener The listener to be notified with the set of accessible resources.
6363
*/
64-
void listAllAccessibleResources(String resourceIndex, ActionListener<Set<? extends Resource>> listener);
64+
void listAllAccessibleResources(String resourceIndex, ActionListener<Set<? extends ShareableResource>> listener);
6565
}

client/src/main/java/org/opensearch/security/client/resources/ResourceSharingNodeClient.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
import org.opensearch.security.resources.rest.ResourceAccessAction;
2121
import org.opensearch.security.resources.rest.ResourceAccessRequest;
2222
import org.opensearch.security.resources.rest.ResourceAccessResponse;
23-
import org.opensearch.security.spi.resources.Resource;
23+
import org.opensearch.security.spi.resources.ShareableResource;
2424
import org.opensearch.security.spi.resources.exceptions.ResourceSharingException;
2525
import org.opensearch.security.spi.resources.sharing.ResourceSharing;
2626
import org.opensearch.security.support.ConfigConstants;
@@ -60,7 +60,7 @@ public ResourceSharingNodeClient(Client client, Settings settings) {
6060
@Override
6161
public void verifyResourceAccess(String resourceId, String resourceIndex, Set<String> scopes, ActionListener<Boolean> listener) {
6262
if (isSecurityDisabled || !resourceSharingEnabled) {
63-
String message = isSecurityDisabled ? "Security Plugin is disabled." : "Resource Access Control feature is disabled.";
63+
String message = isSecurityDisabled ? "Security Plugin is disabled." : "ShareableResource Access Control feature is disabled.";
6464

6565
log.warn("{} {}", message, "Access to resource is automatically granted");
6666
listener.onResponse(true);
@@ -133,7 +133,7 @@ public void revokeResourceAccess(
133133
* @param listener The listener to be notified with the set of accessible resources.
134134
*/
135135
@Override
136-
public void listAllAccessibleResources(String resourceIndex, ActionListener<Set<? extends Resource>> listener) {
136+
public void listAllAccessibleResources(String resourceIndex, ActionListener<Set<? extends ShareableResource>> listener) {
137137
if (isResourceAccessControlOrSecurityPluginDisabled("Unable to list all accessible resources.", listener)) {
138138
return;
139139
}

spi/README.md

-167
This file was deleted.

0 commit comments

Comments
 (0)