Skip to content

Commit 0da981a

Browse files
polyfractalpolyfractal
authored
[TEST] Add some ACL yaml tests for Rollup (#33035)
These two tests compliment the existing unit tests which check Rollup's ACL/security integration. The first test creates to indices, puts a document in each one, and then assigns a role to the test user that can only access one of the indices. A rollup job is created with a pattern that would match both indices, and we verify that only the allowed document was rolled up (e.g. verifying that the unpermissioned index stays hidden). The second test creates a single index with two documents tagged by the keyword "public"/"private". An attribute-based role is created that only allows viewing "public" documents. We then verify the rollup job only rolled the "public" doc, and not the "private" one.
1 parent 644c0de commit 0da981a

File tree

1 file changed

+343
-0
lines changed

1 file changed

+343
-0
lines changed

‎x-pack/plugin/src/test/resources/rest-api-spec/test/rollup/security_tests.yml‎

Lines changed: 343 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,343 @@
1+
setup:
2+
- skip:
3+
features: headers
4+
5+
- do:
6+
cluster.health:
7+
wait_for_status: yellow
8+
9+
10+
11+
---
12+
teardown:
13+
- do:
14+
xpack.security.delete_user:
15+
username: "test_user"
16+
ignore: 404
17+
18+
- do:
19+
xpack.security.delete_role:
20+
name: "foo_only_access"
21+
ignore: 404
22+
23+
---
24+
"Index-based access":
25+
26+
- do:
27+
xpack.security.put_role:
28+
name: "foo_only_access"
29+
body: >
30+
{
31+
"cluster": [ "all" ],
32+
"indices": [
33+
{ "names": ["foo"], "privileges": ["all"] },
34+
{ "names": ["rollup"], "privileges": ["all"] }
35+
]
36+
}
37+
38+
- do:
39+
xpack.security.put_user:
40+
username: "test_user"
41+
body: >
42+
{
43+
"password" : "x-pack-test-password",
44+
"roles" : [ "foo_only_access" ],
45+
"full_name" : "foo only"
46+
}
47+
48+
- do:
49+
indices.create:
50+
index: foo
51+
body:
52+
mappings:
53+
_doc:
54+
properties:
55+
timestamp:
56+
type: date
57+
value_field:
58+
type: integer
59+
- do:
60+
headers:
61+
Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA==" # run as x_pack_rest_user, i.e. the test setup superuser
62+
index:
63+
index: foo
64+
type: _doc
65+
body:
66+
timestamp: 123
67+
value_field: 1232
68+
69+
- do:
70+
indices.create:
71+
index: foobar
72+
body:
73+
mappings:
74+
_doc:
75+
properties:
76+
timestamp:
77+
type: date
78+
value_field:
79+
type: integer
80+
- do:
81+
headers:
82+
Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA==" # run as x_pack_rest_user, i.e. the test setup superuser
83+
index:
84+
index: foobar
85+
type: _doc
86+
body:
87+
timestamp: 123
88+
value_field: 456
89+
90+
- do:
91+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
92+
indices.refresh:
93+
index: foo
94+
95+
# This index pattern will match both indices, but we only have permission to read one
96+
- do:
97+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
98+
xpack.rollup.put_job:
99+
id: foo
100+
body: >
101+
{
102+
"index_pattern": "foo*",
103+
"rollup_index": "rollup",
104+
"cron": "*/1 * * * * ?",
105+
"page_size" :10,
106+
"groups" : {
107+
"date_histogram": {
108+
"field": "timestamp",
109+
"interval": "1s"
110+
}
111+
},
112+
"metrics": [
113+
{
114+
"field": "value_field",
115+
"metrics": ["min", "max", "sum"]
116+
}
117+
]
118+
}
119+
120+
- is_true: acknowledged
121+
122+
- do:
123+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
124+
xpack.rollup.start_job:
125+
id: foo
126+
- is_true: started
127+
128+
- do:
129+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
130+
indices.refresh:
131+
index: rollup
132+
133+
# this is a hacky way to sleep for 5s, since we will never have 10 nodes
134+
- do:
135+
catch: request_timeout
136+
cluster.health:
137+
wait_for_nodes: 10
138+
timeout: "5s"
139+
- match:
140+
timed_out: true
141+
142+
- do:
143+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
144+
xpack.rollup.get_jobs:
145+
id: foo
146+
- match:
147+
jobs.0.stats.documents_processed: 1
148+
149+
- do:
150+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
151+
search:
152+
index: foo
153+
body:
154+
query:
155+
match_all: {}
156+
157+
- match:
158+
hits.total: 1
159+
160+
- do:
161+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
162+
search:
163+
index: rollup
164+
body:
165+
query:
166+
match_all: {}
167+
168+
- match:
169+
hits.total: 1
170+
- match:
171+
hits.hits.0._id: "foo$VxMkzTqILshClbtbFi4-rQ"
172+
- match:
173+
hits.hits.0._source:
174+
timestamp.date_histogram.time_zone: "UTC"
175+
timestamp.date_histogram.timestamp: 0
176+
value_field.max.value: 1232.0
177+
_rollup.version: 2
178+
timestamp.date_histogram.interval: "1s"
179+
value_field.sum.value: 1232.0
180+
value_field.min.value: 1232.0
181+
timestamp.date_histogram._count: 1
182+
_rollup.id: "foo"
183+
184+
185+
---
186+
"Attribute-based access":
187+
188+
- do:
189+
xpack.security.put_role:
190+
name: "foo_only_access"
191+
body: >
192+
{
193+
"cluster": [ "all" ],
194+
"indices": [
195+
{
196+
"names": ["foo"],
197+
"privileges": ["all"],
198+
"query": {
199+
"template": {
200+
"source": "{\"bool\":{\"filter\":[{\"term\":{\"visibility\":\"public\"}}]}}"
201+
}
202+
}
203+
},
204+
{ "names": ["rollup"], "privileges": ["all"] }
205+
]
206+
}
207+
208+
- do:
209+
xpack.security.put_user:
210+
username: "test_user"
211+
body: >
212+
{
213+
"password" : "x-pack-test-password",
214+
"roles" : [ "foo_only_access" ],
215+
"full_name" : "foo only"
216+
}
217+
218+
- do:
219+
indices.create:
220+
index: foo
221+
body:
222+
mappings:
223+
_doc:
224+
properties:
225+
timestamp:
226+
type: date
227+
value_field:
228+
type: integer
229+
visibility:
230+
type: keyword
231+
- do:
232+
headers:
233+
Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA==" # run as x_pack_rest_user, i.e. the test setup superuser
234+
index:
235+
index: foo
236+
type: _doc
237+
body:
238+
timestamp: 123
239+
value_field: 1232
240+
visibility: "public"
241+
- do:
242+
headers:
243+
Authorization: "Basic eF9wYWNrX3Jlc3RfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA==" # run as x_pack_rest_user, i.e. the test setup superuser
244+
index:
245+
index: foobar
246+
type: _doc
247+
body:
248+
timestamp: 123
249+
value_field: 456
250+
visibility: "private"
251+
252+
- do:
253+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
254+
indices.refresh:
255+
index: foo
256+
257+
# Index contains two docs, but we should only be able to see one of them
258+
- do:
259+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
260+
xpack.rollup.put_job:
261+
id: foo
262+
body: >
263+
{
264+
"index_pattern": "foo",
265+
"rollup_index": "rollup",
266+
"cron": "*/1 * * * * ?",
267+
"page_size" :10,
268+
"groups" : {
269+
"date_histogram": {
270+
"field": "timestamp",
271+
"interval": "1s"
272+
}
273+
},
274+
"metrics": [
275+
{
276+
"field": "value_field",
277+
"metrics": ["min", "max", "sum"]
278+
}
279+
]
280+
}
281+
- is_true: acknowledged
282+
283+
- do:
284+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
285+
xpack.rollup.start_job:
286+
id: foo
287+
- is_true: started
288+
289+
- do:
290+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
291+
indices.refresh:
292+
index: rollup
293+
294+
# this is a hacky way to sleep for 5s, since we will never have 10 nodes
295+
- do:
296+
catch: request_timeout
297+
cluster.health:
298+
wait_for_nodes: 10
299+
timeout: "5s"
300+
- match:
301+
timed_out: true
302+
303+
- do:
304+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
305+
xpack.rollup.get_jobs:
306+
id: foo
307+
- match:
308+
jobs.0.stats.documents_processed: 1
309+
310+
- do:
311+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
312+
search:
313+
index: foo
314+
body:
315+
query:
316+
match_all: {}
317+
318+
- match:
319+
hits.total: 1
320+
321+
- do:
322+
headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
323+
search:
324+
index: rollup
325+
body:
326+
query:
327+
match_all: {}
328+
329+
- match:
330+
hits.total: 1
331+
- match:
332+
hits.hits.0._id: "foo$VxMkzTqILshClbtbFi4-rQ"
333+
- match:
334+
hits.hits.0._source:
335+
timestamp.date_histogram.time_zone: "UTC"
336+
timestamp.date_histogram.timestamp: 0
337+
value_field.max.value: 1232.0
338+
_rollup.version: 2
339+
timestamp.date_histogram.interval: "1s"
340+
value_field.sum.value: 1232.0
341+
value_field.min.value: 1232.0
342+
timestamp.date_histogram._count: 1
343+
_rollup.id: "foo"

0 commit comments

Comments
 (0)