[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

DarshitChanpura · 2025-03-20T18:03:21Z

#5185 must be merged before merging this.

#5016 is being broken down into smaller pieces. This is part 2.

Description

Introduces a client to be consumed by plugins, and adds concrete implementation of ResourceAccessControl.

There are 4 java APIs as well as 4 REST APIs introduced as part of this PR. Plugins will leverage the client to call the java APIs to implement resource access control.

Refer to the RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md file to understand in-depth implementation of this feature.

Issues Resolved

Resolves [Proposal] Resource Permissions and Sharing #4500

Testing

automated tests + manual tests

Check List

New functionality includes testing
New functionality has been documented
New Roles/Permissions have a corresponding security dashboards plugin PR
~~- [ ] API changes companion pull request created~~
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Darshit Chanpura <[email protected]>

…ntrol implementation in common package Signed-off-by: Darshit Chanpura <[email protected]>

Signed-off-by: Darshit Chanpura <[email protected]>

nibix

Thanks for this interesting PR @DarshitChanpura !

I have added a couple of comments and questions. As I went through the code linearly, I also commented both on conceptual things and code level things (which I mostly marked with Nit:). I would recommend that you first have a look on conceptual things ... we can talk about the Nit stuff later.

If you want, we can also schedule a conversation at some point in time.

RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

client/src/main/java/org/opensearch/security/client/resources/ResourceSharingNodeClient.java

src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java

src/main/java/org/opensearch/security/user/User.java

src/main/java/org/opensearch/security/resources/rest/ResourceAccessRequest.java

src/main/java/org/opensearch/security/dlic/rest/support/Utils.java

RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

Signed-off-by: Darshit Chanpura <[email protected]>

…tion Signed-off-by: Darshit Chanpura <[email protected]>

…into resource-sharing-client

Signed-off-by: Darshit Chanpura <[email protected]>

…nges log level Signed-off-by: Darshit Chanpura <[email protected]>

src/main/java/org/opensearch/security/resources/rest/ResourceAccessRestAction.java

Signed-off-by: Darshit Chanpura <[email protected]>

derek-ho · 2025-03-28T18:54:07Z

RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

+  "entities_to_revoke": {
+    "roles": ["shared-roles"]
+  }


Does this need to be modified w.r.t. default action group?

no, this is just a list of entities. Action-groups will be supplied separately (not in scope of v1)

derek-ho · 2025-03-28T18:55:52Z

RESOURCE_ACCESS_CONTROL_FOR_PLUGINS.md

+- **Endpoint:**
+  ```
+  GET /_plugins/_security/resources/list/{resource_index}
+  ```
+- **Description:**
+  Retrieves a list of **resources that the current user has access to** within the specified `{resource_index}`.
+
+#### **Response:**


What are the performance implications of the "extra hop" with the resource sharing security index?

As we discussed during the design phase, there are is no concept of joins in OpenSearch. So the alternative to current approach would be to store resource data inside resource-sharing index, which results in significant amount of duplication and something we are moving away from.

derek-ho · 2025-03-28T19:11:49Z

client/README.md

+    resourceSharingClient.verifyResourceAccess(
+        resourceId,
+        RESOURCE_INDEX_NAME,
+        SampleResourceScope.PUBLIC.value(),


Please update this if we are removing the concept of scopes from this change

derek-ho · 2025-03-28T19:14:04Z

client/README.md

+
+#### **Method Signature:**
+```java
+void shareResource(String resourceId, String resourceIndex, Map<String, Object> shareWith, ActionListener<ResourceSharing> listener);


Comment about this and other similar methods - since we know that the keys would be "roles", "users", and "backend_roles", can we somehow enforce that they provide a ShareWith datastructure, instead of accepting an arbitrary map here?

This will eventually be replaced with ShareWith class. I can replace it for now to be of type: SharedWithActionGroup.ActionGroupRecipient

derek-ho · 2025-03-28T19:28:07Z

client/src/main/java/org/opensearch/security/client/resources/ResourceSharingNodeClient.java

+    private String securityOrFeatureDisabledMessage() {
+        boolean sharingEnabled = settings.getAsBoolean(
+            ConfigConstants.OPENSEARCH_RESOURCE_SHARING_ENABLED,
+            ConfigConstants.OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT
+        );
+
+        Settings securitySettings = settings.getByPrefix(ConfigConstants.SECURITY_SETTINGS_PREFIX);
+        boolean securityDisabled = securitySettings.isEmpty()
+            || this.settings.getAsBoolean(
+                ConfigConstants.OPENSEARCH_SECURITY_DISABLED,
+                ConfigConstants.OPENSEARCH_SECURITY_DISABLED_DEFAULT
+            );
+
+        if (securityDisabled) return "Security Plugin is disabled.";
+        if (!sharingEnabled) return "ShareableResource Access Control feature is disabled.";
+        return "";
+    }


Nit: do we want to check here whether system index protections is enabled, and also return a message if so? Since the feature is dependent on that?

This is checked at Transport Actions since that is the common sink between Rest APIs and client. Checkout ShareResourceTransportAction

Signed-off-by: Darshit Chanpura <[email protected]>

derek-ho · 2025-03-28T20:09:54Z

src/main/java/org/opensearch/security/resources/ResourceAccessHandler.java

+     * @return True if the resource is owned by the user, false otherwise.
+     */
+    private boolean isOwnerOfResource(ResourceSharing document, String userName) {
+        return document.getCreatedBy() != null && document.getCreatedBy().getCreator().equals(userName);


Question/concern here is whether username would be guaranteed to be unique, specifically when considering multiple SSO providers/internal users?

DarshitChanpura requested review from cwperks, derek-ho, nibix, peternied, RyanL1997, reta and willyborankin as code owners March 20, 2025 18:03

DarshitChanpura added 7 commits March 20, 2025 14:30

Introduces resource sharing and access control SPI

2246d91

Signed-off-by: Darshit Chanpura <[email protected]>

Introduces a resource sharing client and completes resource access co…

c8245dc

…ntrol implementation in common package Signed-off-by: Darshit Chanpura <[email protected]>

Updates client to handle security disabled scenario

7631bd0

Signed-off-by: Darshit Chanpura <[email protected]>

Updates build.gradle files and jarhell references

84b2a21

Signed-off-by: Darshit Chanpura <[email protected]>

Disables jar for common

3d9c9c1

Signed-off-by: Darshit Chanpura <[email protected]>

Removes common package and refactors classes

f167091

Signed-off-by: Darshit Chanpura <[email protected]>

Conforms to SPI file name changes and removes spi package

89d3a63

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-client branch from 33c2dc4 to 89d3a63 Compare March 20, 2025 18:33

DarshitChanpura added 2 commits March 20, 2025 16:24

Updates plugin dev doc

643e44f

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes CI

52f4ac5

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-client branch from 597172b to 52f4ac5 Compare March 20, 2025 20:38

nibix reviewed Mar 21, 2025

View reviewed changes

nibix mentioned this pull request Mar 21, 2025

[Resource Access Control] [Part1] Introduces SPI for resource access control #5185

Open

1 task

Updates exception types in client and root project

e05ae8a

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-client branch from e38b67e to e05ae8a Compare March 21, 2025 22:26

DarshitChanpura added 5 commits March 21, 2025 18:53

Addresses PR comments

c0c9f9b

Signed-off-by: Darshit Chanpura <[email protected]>

Refactors client to address action-groups and updates core implementa…

0cac90d

…tion Signed-off-by: Darshit Chanpura <[email protected]>

Merge remote-tracking branch 'upstream/feature/resource-permissions' …

95ff332

…into resource-sharing-client

Fixes build.gradle

b349a5c

Signed-off-by: Darshit Chanpura <[email protected]>

Fixes build-artifacts workflow

31b0d0b

Signed-off-by: Darshit Chanpura <[email protected]>

DarshitChanpura force-pushed the resource-sharing-client branch from d3b4304 to 31b0d0b Compare March 26, 2025 21:45

DarshitChanpura added 2 commits March 26, 2025 18:54

Addresses changes around recipient type registry removal

400a360

Signed-off-by: Darshit Chanpura <[email protected]>

Makes ResourceIndexListener non-singleton, refactors a method and cha…

906908a

…nges log level Signed-off-by: Darshit Chanpura <[email protected]>

nibix reviewed Mar 27, 2025

View reviewed changes

src/main/java/org/opensearch/security/resources/rest/ResourceAccessRestAction.java Outdated Show resolved Hide resolved

Splits singular resource rest action to individual actions

5ecac3a

Signed-off-by: Darshit Chanpura <[email protected]>

derek-ho reviewed Mar 28, 2025

View reviewed changes

Removes singleton pattern from ResourcePluginInfo

f943168

Signed-off-by: Darshit Chanpura <[email protected]>

derek-ho reviewed Mar 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

DarshitChanpura commented Mar 20, 2025 •

edited

Loading

nibix left a comment

derek-ho Mar 28, 2025

DarshitChanpura Mar 28, 2025

derek-ho Mar 28, 2025

DarshitChanpura Mar 28, 2025

derek-ho Mar 28, 2025

DarshitChanpura Mar 28, 2025

derek-ho Mar 28, 2025

DarshitChanpura Mar 28, 2025 •

edited

Loading

derek-ho Mar 28, 2025

DarshitChanpura Mar 28, 2025

derek-ho Mar 28, 2025

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

Are you sure you want to change the base?

[Resource Access Control] [Part2] Introduces a client for Resource Access Control and adds concrete implementation for resource access control #5194

Conversation

DarshitChanpura commented Mar 20, 2025 • edited Loading

Description

Issues Resolved

Testing

Check List

nibix left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura Mar 28, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura commented Mar 20, 2025 •

edited

Loading

DarshitChanpura Mar 28, 2025 •

edited

Loading