From 809aedabbe340fe7c22d99f26c98adc61819bdcc Mon Sep 17 00:00:00 2001 From: Xun Zhang Date: Tue, 18 Jul 2023 10:55:03 -0700 Subject: [PATCH 1/4] add .plugins-ml-config in the system index (#2993) Signed-off-by: Xun Zhang --- tools/install_demo_configuration.bat | 2 +- tools/install_demo_configuration.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/install_demo_configuration.bat b/tools/install_demo_configuration.bat index 68e39267d4..f648b7bdf5 100755 --- a/tools/install_demo_configuration.bat +++ b/tools/install_demo_configuration.bat @@ -315,7 +315,7 @@ echo plugins.security.enable_snapshot_restore_privilege: true >> "%OPENSEARCH_CO echo plugins.security.check_snapshot_restore_write_privileges: true >> "%OPENSEARCH_CONF_FILE%" echo plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] >> "%OPENSEARCH_CONF_FILE%" echo plugins.security.system_indices.enabled: true >> "%OPENSEARCH_CONF_FILE%" -echo plugins.security.system_indices.indices: [".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models"] >> "%OPENSEARCH_CONF_FILE%" +echo plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models"] >> "%OPENSEARCH_CONF_FILE%" :: network.host >nul findstr /b /c:"network.host" "%OPENSEARCH_CONF_FILE%" && ( diff --git a/tools/install_demo_configuration.sh b/tools/install_demo_configuration.sh index 33dfc4696d..7cdbe5f2f0 100755 --- a/tools/install_demo_configuration.sh +++ b/tools/install_demo_configuration.sh @@ -383,7 +383,7 @@ echo "plugins.security.enable_snapshot_restore_privilege: true" | $SUDO_CMD tee echo "plugins.security.check_snapshot_restore_write_privileges: true" | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null echo 'plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null echo 'plugins.security.system_indices.enabled: true' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null -echo 'plugins.security.system_indices.indices: [".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models"]' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null +echo 'plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models"]' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null #network.host if $SUDO_CMD grep --quiet -i "^network.host" "$OPENSEARCH_CONF_FILE"; then From 744b5d4c116d0d41d0a2d34801d97e0ab5b98049 Mon Sep 17 00:00:00 2001 From: Derek Ho Date: Tue, 18 Jul 2023 15:51:24 -0400 Subject: [PATCH 2/4] add password regex setting onto dashboardsinfo backend call (#2999) * add password regex setting onto dashboardsinfo backend call Signed-off-by: Derek Ho --- .../org/opensearch/security/api/DashboardsInfoTest.java | 3 +++ .../security/api/DashboardsInfoWithSettingsTest.java | 6 +++++- .../org/opensearch/security/rest/DashboardsInfoAction.java | 6 ++++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoTest.java b/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoTest.java index a8936765d2..a1dbc611a3 100644 --- a/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoTest.java +++ b/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoTest.java @@ -27,6 +27,7 @@ import static org.hamcrest.Matchers.containsString; import static org.hamcrest.Matchers.equalTo; import static org.opensearch.security.rest.DashboardsInfoAction.DEFAULT_PASSWORD_MESSAGE; +import static org.opensearch.security.rest.DashboardsInfoAction.DEFAULT_PASSWORD_REGEX; import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL; @RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class) @@ -51,6 +52,8 @@ public void testDashboardsInfoValidationMessage() throws Exception { assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_OK)); assertThat(response.getBody(), containsString("password_validation_error_message")); assertThat(response.getBody(), containsString(DEFAULT_PASSWORD_MESSAGE)); + assertThat(response.getBody(), containsString("password_validation_regex")); + assertThat(response.getBody(), containsString(DEFAULT_PASSWORD_REGEX)); } } } diff --git a/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoWithSettingsTest.java b/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoWithSettingsTest.java index 01654e17cd..49f3872420 100644 --- a/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoWithSettingsTest.java +++ b/src/integrationTest/java/org/opensearch/security/api/DashboardsInfoWithSettingsTest.java @@ -41,6 +41,8 @@ public class DashboardsInfoWithSettingsTest { private static final String CUSTOM_PASSWORD_MESSAGE = "Password must be minimum 5 characters long and must contain at least one uppercase letter, one lowercase letter, one digit, and one special character."; + private static final String CUSTOM_PASSWORD_REGEX = "(?=.*[A-Z])(?=.*[^a-zA-Z\\d])(?=.*[0-9])(?=.*[a-z]).{5,}"; + @ClassRule public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS) .authc(AUTHC_HTTPBASIC_INTERNAL) @@ -48,7 +50,7 @@ public class DashboardsInfoWithSettingsTest { .nodeSettings( Map.of( ConfigConstants.SECURITY_RESTAPI_PASSWORD_VALIDATION_REGEX, - "(?=.*[A-Z])(?=.*[^a-zA-Z\\d])(?=.*[0-9])(?=.*[a-z]).{5,}", + CUSTOM_PASSWORD_REGEX, ConfigConstants.SECURITY_RESTAPI_PASSWORD_VALIDATION_ERROR_MESSAGE, CUSTOM_PASSWORD_MESSAGE ) @@ -63,6 +65,8 @@ public void testDashboardsInfoValidationMessageWithCustomMessage() throws Except assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_OK)); assertThat(response.getBody(), containsString("password_validation_error_message")); assertThat(response.getBody(), containsString(CUSTOM_PASSWORD_MESSAGE)); + assertThat(response.getBody(), containsString("password_validation_regex")); + assertThat(response.getBody(), containsString(CUSTOM_PASSWORD_REGEX)); } } } diff --git a/src/main/java/org/opensearch/security/rest/DashboardsInfoAction.java b/src/main/java/org/opensearch/security/rest/DashboardsInfoAction.java index 96221985fd..6a14541896 100644 --- a/src/main/java/org/opensearch/security/rest/DashboardsInfoAction.java +++ b/src/main/java/org/opensearch/security/rest/DashboardsInfoAction.java @@ -68,6 +68,8 @@ public class DashboardsInfoAction extends BaseRestHandler { public static final String DEFAULT_PASSWORD_MESSAGE = "Password should be at least 8 characters long and contain at least one " + "uppercase letter, one lowercase letter, one digit, and one special character."; + public static final String DEFAULT_PASSWORD_REGEX = "(?=.*[A-Z])(?=.*[^a-zA-Z\\d])(?=.*[0-9])(?=.*[a-z]).{8,}"; + public DashboardsInfoAction( final Settings settings, final RestController controller, @@ -110,6 +112,10 @@ public void accept(RestChannel channel) throws Exception { "password_validation_error_message", client.settings().get(ConfigConstants.SECURITY_RESTAPI_PASSWORD_VALIDATION_ERROR_MESSAGE, DEFAULT_PASSWORD_MESSAGE) ); + builder.field( + "password_validation_regex", + client.settings().get(ConfigConstants.SECURITY_RESTAPI_PASSWORD_VALIDATION_REGEX, DEFAULT_PASSWORD_REGEX) + ); builder.endObject(); response = new BytesRestResponse(RestStatus.OK, builder); From ab6778d135109e460d7019672a8c4cbecb2a4018 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Wed, 19 Jul 2023 11:10:24 -0400 Subject: [PATCH 3/4] Update ospackage, checker-qual, zcxvbn and error_prone_annotations, camel-xmlsecurity (#3023) - Bumps com.netflix.nebula.ospackage from 11.1.0 to 11.3.0 - Bumps org.checkerframework:checker-qual from 3.5.0 to 3.36.0 - Bumps com.nulab-inc:zxcvbn from 1.7.0 to 1.8.0 - Bumps com.google.errorprone:error_prone_annotations from 2.3.4 to 2.20.0 - Bumps org.apache.camel:camel-xmlsecurity from 3.14.2 to 3.21.0 Signed-off-by: Craig Perkins --- build.gradle | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build.gradle b/build.gradle index 90888ac548..87fe0d7934 100644 --- a/build.gradle +++ b/build.gradle @@ -63,7 +63,7 @@ plugins { id 'maven-publish' id 'com.diffplug.spotless' version '6.19.0' id 'checkstyle' - id 'com.netflix.nebula.ospackage' version "11.1.0" + id 'com.netflix.nebula.ospackage' version "11.3.0" id "org.gradle.test-retry" version "1.5.2" id 'eclipse' id "com.github.spotbugs" version "5.0.14" @@ -525,12 +525,12 @@ dependencies { runtimeOnly 'com.eclipsesource.minimal-json:minimal-json:0.9.5' runtimeOnly 'commons-codec:commons-codec:1.16.0' runtimeOnly 'org.cryptacular:cryptacular:1.2.4' - runtimeOnly 'com.google.errorprone:error_prone_annotations:2.3.4' + runtimeOnly 'com.google.errorprone:error_prone_annotations:2.20.0' runtimeOnly 'com.sun.istack:istack-commons-runtime:4.2.0' runtimeOnly 'jakarta.xml.bind:jakarta.xml.bind-api:4.0.0' runtimeOnly 'org.ow2.asm:asm:9.1' - testImplementation 'org.apache.camel:camel-xmlsecurity:3.14.2' + testImplementation 'org.apache.camel:camel-xmlsecurity:3.21.0' //OpenSAML implementation 'net.shibboleth.utilities:java-support:8.4.0' @@ -551,7 +551,7 @@ dependencies { runtimeOnly "org.opensaml:opensaml-soap-impl:${open_saml_version}" implementation "org.opensaml:opensaml-storage-api:${open_saml_version}" - implementation "com.nulab-inc:zxcvbn:1.7.0" + implementation "com.nulab-inc:zxcvbn:1.8.0" runtimeOnly 'com.google.guava:failureaccess:1.0.1' runtimeOnly 'org.apache.commons:commons-text:1.10.0' @@ -569,7 +569,7 @@ dependencies { runtimeOnly 'org.apache.ws.xmlschema:xmlschema-core:2.2.5' runtimeOnly 'org.apache.santuario:xmlsec:2.2.3' runtimeOnly "com.github.luben:zstd-jni:${versions.zstd}" - runtimeOnly 'org.checkerframework:checker-qual:3.5.0' + runtimeOnly 'org.checkerframework:checker-qual:3.36.0' runtimeOnly "org.bouncycastle:bcpkix-jdk15to18:${versions.bouncycastle}" runtimeOnly 'org.scala-lang.modules:scala-java8-compat_3:1.0.2' From 59e2657850193d00339e5f234cda15357b7b57f9 Mon Sep 17 00:00:00 2001 From: Surya Sashank Nistala Date: Fri, 21 Jul 2023 12:36:00 -0700 Subject: [PATCH 4/4] add workflow cluster permissions to alerting roles (#2994) * add workflow cluster permissions to alerting roles Signed-off-by: Surya Sashank Nistala * fix ordering of new cluster permissions in roles.yml Signed-off-by: Surya Sashank Nistala --------- Signed-off-by: Surya Sashank Nistala --- config/roles.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/roles.yml b/config/roles.yml index 3814a4fad4..bd0e0f6b21 100644 --- a/config/roles.yml +++ b/config/roles.yml @@ -32,12 +32,16 @@ alerting_read_access: - 'cluster:admin/opendistro/alerting/monitor/get' - 'cluster:admin/opendistro/alerting/monitor/search' - 'cluster:admin/opensearch/alerting/findings/get' + - 'cluster:admin/opensearch/alerting/workflow/get' + - 'cluster:admin/opensearch/alerting/workflow_alerts/get' # Allows users to view and acknowledge alerts alerting_ack_alerts: reserved: true cluster_permissions: - 'cluster:admin/opendistro/alerting/alerts/*' + - 'cluster:admin/opendistro/alerting/chained_alerts/*' + - 'cluster:admin/opendistro/alerting/workflow_alerts/*' # Allows users to use all alerting functionality alerting_full_access: