OnBehalfOf claims take second duration #10664

stephen-crawford · 2023-10-17T17:03:55Z

Description

This change swaps the OnBehalfOf claims provider in core in order to work with external token providers. Without this change, implementing the TokenManager class is not straightforward. We would force users to to provide an expiration time (i.e. system time) when we want them to be able to provide a value in seconds and do the math for them.

Check List

~~New functionality includes testing.~~
- All tests pass
~~New functionality has been documented.~~
- ~~New functionality has javadoc added~~
Commits are signed per the DCO using --signoff
Commit changes are listed out in CHANGELOG.md file (See: Changelog)
~~Public documentation issue/PR created~~

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2023-10-17T17:32:17Z

Compatibility status:

Checks if related components are compatible with change 7718a2f

Incompatible components

Skipped components

Compatible components

Compatible components: [https://github.com/opensearch-project/security-analytics.git, https://github.com/opensearch-project/custom-codecs.git, https://github.com/opensearch-project/security.git, https://github.com/opensearch-project/opensearch-oci-object-storage.git, https://github.com/opensearch-project/index-management.git, https://github.com/opensearch-project/geospatial.git, https://github.com/opensearch-project/sql.git, https://github.com/opensearch-project/job-scheduler.git, https://github.com/opensearch-project/notifications.git, https://github.com/opensearch-project/observability.git, https://github.com/opensearch-project/k-nn.git, https://github.com/opensearch-project/neural-search.git, https://github.com/opensearch-project/cross-cluster-replication.git, https://github.com/opensearch-project/alerting.git, https://github.com/opensearch-project/performance-analyzer.git, https://github.com/opensearch-project/anomaly-detection.git, https://github.com/opensearch-project/performance-analyzer-rca.git, https://github.com/opensearch-project/asynchronous-search.git, https://github.com/opensearch-project/ml-commons.git, https://github.com/opensearch-project/common-utils.git, https://github.com/opensearch-project/reporting.git]

github-actions · 2023-10-17T17:48:41Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/28149/
CommitID: ca57018

codecov · 2023-10-17T17:51:03Z

Codecov Report

Merging #10664 (e046658) into main (e942483) will increase coverage by 0.02%.
Report is 2 commits behind head on main.
The diff coverage is 80.00%.

❗ Current head e046658 differs from pull request most recent head 7718a2f. Consider uploading reports for the commit 7718a2f to get more accurate results

@@             Coverage Diff              @@
##               main   #10664      +/-   ##
============================================
+ Coverage     71.12%   71.15%   +0.02%     
+ Complexity    58503    58502       -1     
============================================
  Files          4853     4853              
  Lines        275915   275660     -255     
  Branches      40153    40118      -35     
============================================
- Hits         196256   196149     -107     
+ Misses        63247    63122     -125     
+ Partials      16412    16389      -23

Files	Coverage Δ
...g/opensearch/identity/tokens/OnBehalfOfClaims.java	`87.50% <80.00%> (+9.72%)`	⬆️

... and 492 files with indirect coverage changes

github-actions · 2023-10-17T20:42:07Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/28174/
CommitID: 9c58d6f
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

github-actions · 2023-10-17T21:20:04Z

Gradle Check (Jenkins) Run Completed with:

RESULT: UNSTABLE ❕
TEST FAILURES:

      1 org.opensearch.indices.replication.SegmentReplicationIT.classMethod

URL: https://build.ci.opensearch.org/job/gradle-check/28175/
CommitID: e046658
Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

github-actions · 2023-10-17T21:36:03Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/28176/
CommitID: 3b06550

peternied · 2023-10-17T22:24:45Z

@scrawfor99 looks like there are some merge conflicts

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

stephen-crawford · 2023-10-18T13:21:55Z

Should be all fixed @peternied

github-actions · 2023-10-18T14:06:35Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/28258/
CommitID: 7718a2f
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

OnBehalfOf claims take second duration Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Siddhant Deshmukh <deshsid@amazon.com>

OnBehalfOf claims take second duration Signed-off-by: Stephen Crawford <steecraw@amazon.com>

#11052) * Implement on behalf of token passing for extensions (#8679) * Provide service accounts tokens to extensions (#9618) This change adds a new transport action which passes the extension a string representation of its service account auth token. This token is created by the TokenManager interface implementation. The token is expected to be an encoded basic auth credential string which can be used by the extension to interact with its own system index. * Cherry pick #10614 and #10664 Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Ryan Liang <jiallian@amazon.com> Signed-off-by: Peter Nied <petern@amazon.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Peter Nied <peternied@hotmail.com> Co-authored-by: Owais Kazi <owaiskazi19@gmail.com> Co-authored-by: Peter Nied <petern@amazon.com>

OnBehalfOf claims take second duration Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Shivansh Arora <hishiv@amazon.com>

stephen-crawford changed the title ~~Make it reasonable to provide time for expiration~~ [SKIP CHANGELOG] Make OnBehalfOf claims take second duration instead of absolute time Oct 17, 2023

stephen-crawford mentioned this pull request Oct 17, 2023

Implement IdentityPlugin in Security plugin opensearch-project/security#3538

Merged

3 tasks

stephen-crawford marked this pull request as draft October 17, 2023 17:24

stephen-crawford changed the title ~~[SKIP CHANGELOG] Make OnBehalfOf claims take second duration instead of absolute time~~ Make OnBehalfOf claims take second duration instead of absolute time Oct 17, 2023

stephen-crawford marked this pull request as ready for review October 17, 2023 20:33

peternied changed the title ~~Make OnBehalfOf claims take second duration instead of absolute time~~ OnBehalfOf claims take second duration Oct 17, 2023

peternied approved these changes Oct 17, 2023

View reviewed changes

stephen-crawford added 3 commits October 18, 2023 09:20

Make it reasonable to provide time for expiration

8cc86ee

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

OnBehalfOf claims

9d8fb4d

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

Fix changelog

7718a2f

Signed-off-by: Stephen Crawford <steecraw@amazon.com>

stephen-crawford force-pushed the swapExpirationToSecond branch from 3b06550 to 7718a2f Compare October 18, 2023 13:21

peternied merged commit d2c2e20 into opensearch-project:main Oct 18, 2023
12 of 13 checks passed

stephen-crawford deleted the swapExpirationToSecond branch October 18, 2023 18:36

austintlee pushed a commit to austintlee/OpenSearch that referenced this pull request Oct 23, 2023

OnBehalfOf claims take second duration (opensearch-project#10664)

7d76611

OnBehalfOf claims take second duration Signed-off-by: Stephen Crawford <steecraw@amazon.com>

RyanL1997 mentioned this pull request Nov 1, 2023

[Backport 2.x] Service accounts and on-behalf-of authentication in 2.x #11052

Merged

8 tasks

RyanL1997 pushed a commit to RyanL1997/OpenSearch that referenced this pull request Nov 1, 2023

OnBehalfOf claims take second duration (opensearch-project#10664)

1b2b65d

OnBehalfOf claims take second duration Signed-off-by: Stephen Crawford <steecraw@amazon.com>

RyanL1997 mentioned this pull request Nov 1, 2023

Backport Service Account into 2.x branch opensearch-project/security#3557

Closed

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OnBehalfOf claims take second duration #10664

OnBehalfOf claims take second duration #10664

stephen-crawford commented Oct 17, 2023 •

edited

Loading

github-actions bot commented Oct 17, 2023 •

edited

Loading

github-actions bot commented Oct 17, 2023

codecov bot commented Oct 17, 2023 •

edited

Loading

github-actions bot commented Oct 17, 2023

github-actions bot commented Oct 17, 2023

github-actions bot commented Oct 17, 2023

peternied commented Oct 17, 2023

stephen-crawford commented Oct 18, 2023

github-actions bot commented Oct 18, 2023

OnBehalfOf claims take second duration #10664

OnBehalfOf claims take second duration #10664

Conversation

stephen-crawford commented Oct 17, 2023 • edited Loading

Description

Check List

github-actions bot commented Oct 17, 2023 • edited Loading

Compatibility status:

Incompatible components

Skipped components

Compatible components

github-actions bot commented Oct 17, 2023

Gradle Check (Jenkins) Run Completed with:

codecov bot commented Oct 17, 2023 • edited Loading

Codecov Report

github-actions bot commented Oct 17, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 17, 2023

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 17, 2023

Gradle Check (Jenkins) Run Completed with:

peternied commented Oct 17, 2023

stephen-crawford commented Oct 18, 2023

github-actions bot commented Oct 18, 2023

Gradle Check (Jenkins) Run Completed with:

stephen-crawford commented Oct 17, 2023 •

edited

Loading

github-actions bot commented Oct 17, 2023 •

edited

Loading

codecov bot commented Oct 17, 2023 •

edited

Loading