-
Notifications
You must be signed in to change notification settings - Fork 25k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add cache for application privileges (#55836)
Add caching support for application privileges to reduce number of round-trips to security index when building application privilege descriptors. Privilege retrieving in NativePrivilegeStore is changed to always fetching all privilege documents for a given application. The caching is applied to all places including "get privilege", "has privileges" APIs and CompositeRolesStore (for authentication).
- Loading branch information
Showing
22 changed files
with
1,526 additions
and
165 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
65 changes: 65 additions & 0 deletions
65
...gh-level/src/main/java/org/elasticsearch/client/security/ClearPrivilegesCacheRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.client.security; | ||
|
|
||
| import org.elasticsearch.client.Validatable; | ||
|
|
||
| import java.util.Arrays; | ||
|
|
||
| /** | ||
| * The request used to clear the cache for native application privileges stored in an index. | ||
| */ | ||
| public final class ClearPrivilegesCacheRequest implements Validatable { | ||
|
|
||
| private final String[] applications; | ||
|
|
||
| /** | ||
| * Sets the applications for which caches will be evicted. When not set all privileges will be evicted from the cache. | ||
| * | ||
| * @param applications The application names | ||
| */ | ||
| public ClearPrivilegesCacheRequest(String... applications) { | ||
| this.applications = applications; | ||
| } | ||
|
|
||
| /** | ||
| * @return an array of application names that will have the cache evicted or <code>null</code> if all | ||
| */ | ||
| public String[] applications() { | ||
| return applications; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean equals(Object o) { | ||
| if (this == o) { | ||
| return true; | ||
| } | ||
| if (o == null || getClass() != o.getClass()) { | ||
| return false; | ||
| } | ||
| ClearPrivilegesCacheRequest that = (ClearPrivilegesCacheRequest) o; | ||
| return Arrays.equals(applications, that.applications); | ||
| } | ||
|
|
||
| @Override | ||
| public int hashCode() { | ||
| return Arrays.hashCode(applications); | ||
| } | ||
| } |
50 changes: 50 additions & 0 deletions
50
...h-level/src/main/java/org/elasticsearch/client/security/ClearPrivilegesCacheResponse.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.client.security; | ||
|
|
||
| import org.elasticsearch.client.NodesResponseHeader; | ||
| import org.elasticsearch.common.xcontent.ConstructingObjectParser; | ||
| import org.elasticsearch.common.xcontent.XContentParser; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.List; | ||
|
|
||
| /** | ||
| * The response object that will be returned when clearing the privileges cache | ||
| */ | ||
| public final class ClearPrivilegesCacheResponse extends SecurityNodesResponse { | ||
|
|
||
| @SuppressWarnings("unchecked") | ||
| private static final ConstructingObjectParser<ClearPrivilegesCacheResponse, Void> PARSER = | ||
| new ConstructingObjectParser<>("clear_privileges_cache_response", false, | ||
| args -> new ClearPrivilegesCacheResponse((List<Node>)args[0], (NodesResponseHeader) args[1], (String) args[2])); | ||
|
|
||
| static { | ||
| SecurityNodesResponse.declareCommonNodesResponseParsing(PARSER); | ||
| } | ||
|
|
||
| public ClearPrivilegesCacheResponse(List<Node> nodes, NodesResponseHeader header, String clusterName) { | ||
| super(nodes, header, clusterName); | ||
| } | ||
|
|
||
| public static ClearPrivilegesCacheResponse fromXContent(XContentParser parser) throws IOException { | ||
| return PARSER.parse(parser, null); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
33 changes: 33 additions & 0 deletions
33
docs/java-rest/high-level/security/clear-privileges-cache.asciidoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
|
|
||
| -- | ||
| :api: clear-privileges-cache | ||
| :request: ClearPrivilegesCacheRequest | ||
| :response: ClearPrivilegesCacheResponse | ||
| -- | ||
| [role="xpack"] | ||
| [id="{upid}-{api}"] | ||
| === Clear Privileges Cache API | ||
|
|
||
| [id="{upid}-{api}-request"] | ||
| ==== Clear Privileges Cache Request | ||
|
|
||
| A +{request}+ supports defining the name of applications that the cache should be cleared for. | ||
|
|
||
| ["source","java",subs="attributes,callouts,macros"] | ||
| -------------------------------------------------- | ||
| include-tagged::{doc-tests-file}[{api}-request] | ||
| -------------------------------------------------- | ||
| <1> the name of the application(s) for which the cache should be cleared | ||
|
|
||
| include::../execution.asciidoc[] | ||
|
|
||
| [id="{upid}-{api}-response"] | ||
| ==== Clear Privileges Cache Response | ||
|
|
||
| The returned +{response}+ allows to retrieve information about where the cache was cleared. | ||
|
|
||
| ["source","java",subs="attributes,callouts,macros"] | ||
| -------------------------------------------------- | ||
| include-tagged::{doc-tests-file}[{api}-response] | ||
| -------------------------------------------------- | ||
| <1> the list of nodes that the cache was cleared on |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
x-pack/docs/en/rest-api/security/clear-privileges-cache.asciidoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| [role="xpack"] | ||
| [[security-api-clear-privilege-cache]] | ||
| === Clear privileges cache API | ||
| ++++ | ||
| <titleabbrev>Clear privileges cache</titleabbrev> | ||
| ++++ | ||
|
|
||
| Evicts privileges from the native application privilege cache. | ||
| The cache is also automatically cleared for applications that have their privileges updated. | ||
|
|
||
| [[security-api-clear-privilege-cache-request]] | ||
| ==== {api-request-title} | ||
|
|
||
| `POST /_security/privilege/<application>/_clear_cache` | ||
|
|
||
| [[security-api-clear-privilege-cache-prereqs]] | ||
| ==== {api-prereq-title} | ||
|
|
||
| * To use this API, you must have at least the `manage_security` cluster | ||
| privilege. | ||
|
|
||
| [[security-api-clear-privilege-cache-desc]] | ||
| ==== {api-description-title} | ||
|
|
||
| For more information about the native realm, see | ||
| <<realms>> and <<native-realm>>. | ||
|
|
||
| [[security-api-clear-privilege-cache-path-params]] | ||
| ==== {api-path-parms-title} | ||
|
|
||
| `application`:: | ||
| (string) The name of the application. If omitted, all entries are evicted from the cache. | ||
|
|
||
| [[security-api-clear-privilege-cache-example]] | ||
| ==== {api-examples-title} | ||
|
|
||
| The clear privileges cache API evicts privileges from the native application privilege cache. | ||
| For example, to clear the cache for `myapp`: | ||
|
|
||
| [source,console] | ||
| -------------------------------------------------- | ||
| POST /_security/privilege/myapp/_clear_cache | ||
| -------------------------------------------------- |
Oops, something went wrong.