[Feature/Identity] Adds Basic Auth mechanism via Internal IdP

CHANGELOG.md

@@ -20,6 +20,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - [Identity] Prototype Internal IdP ([#4659](https://github.com/opensearch-project/OpenSearch/pull/4659))
 - [Identity] Strategy for Delegated Authority using Tokens ([#4826](https://github.com/opensearch-project/OpenSearch/pull/4826))
 - [Identity] User operations: create update delete ([#4741](https://github.com/opensearch-project/OpenSearch/pull/4741))
+- [Identity] Adds Basic Auth mechanism via Internal IdP ([#4798](https://github.com/opensearch-project/OpenSearch/pull/4798))
 
 
 ### Dependencies

sandbox/libs/authn/build.gradle

@@ -18,7 +18,7 @@ dependencies {
   implementation "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
   implementation "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
 
-  implementation 'org.apache.shiro:shiro-core:1.9.1'
+  api 'org.apache.shiro:shiro-core:1.9.1'
   // Needed for shiro
   implementation "org.slf4j:slf4j-api:${versions.slf4j}"
   implementation "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}"

sandbox/libs/authn/src/main/java/org/opensearch/authn/DefaultObjectMapper.java

@@ -9,7 +9,9 @@
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.InjectableValues;
+import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
 
 import java.io.IOException;
@@ -18,14 +20,18 @@
  * @opensearch.experimental
  */
 public class DefaultObjectMapper {
-    public static final ObjectMapper objectMapper = new ObjectMapper();
+    public static ObjectMapper objectMapper;
     public final static ObjectMapper YAML_MAPPER = new ObjectMapper(new YAMLFactory());
     private static final ObjectMapper defaulOmittingObjectMapper = new ObjectMapper();
 
     static {
+        objectMapper = JsonMapper.builder()
+            .enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION)
+            .disable(MapperFeature.CAN_OVERRIDE_ACCESS_MODIFIERS) // to prevent access denied exception by Jackson
+            .build();
+
         objectMapper.setSerializationInclusion(Include.NON_NULL);
         // objectMapper.enable(DeserializationFeature.FAIL_ON_TRAILING_TOKENS);
-        objectMapper.enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION);
         defaulOmittingObjectMapper.setSerializationInclusion(Include.NON_DEFAULT);
         defaulOmittingObjectMapper.enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION);
         YAML_MAPPER.enable(JsonParser.Feature.STRICT_DUPLICATE_DETECTION);

sandbox/libs/authn/src/main/java/org/opensearch/authn/HttpHeaderToken.java

@@ -0,0 +1,23 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.authn;
+
+public class HttpHeaderToken implements AuthenticationToken {
+
+    public final static String HEADER_NAME = "Authorization";
+    private final String headerValue;
+
+    public HttpHeaderToken(final String headerValue) {
+        this.headerValue = headerValue;
+    }
+
+    public String getHeaderValue() {
+        return headerValue;
+    }
+}

sandbox/libs/authn/src/main/java/org/opensearch/authn/Subject.java

@@ -10,8 +10,6 @@
 /**
  * An individual, process, or device that causes information to flow among objects or change to the system state.
  *
- * Used to authorize activities inside of the OpenSearch ecosystem.
- *
  * @opensearch.experimental
  */
 public interface Subject {
@@ -22,7 +20,7 @@ public interface Subject {
     Principal getPrincipal();
 
     /**
-     * Authentications from a token
+     * Authentication check via the token
      * throws UnsupportedAuthenticationMethod
      * throws InvalidAuthenticationToken
      * throws SubjectNotFound

sandbox/libs/authn/src/main/java/org/opensearch/authn/User.java

@@ -10,13 +10,21 @@
 import java.util.Collections;
 import java.util.Map;
 
+/**
+ * A non-volatile and immutable object in the storage.
+ *
+ * @opensearch.experimental
+ */
+
 public class User {
 
     @JsonProperty(value = "primary_principal")
     private StringPrincipal primaryPrincipal;
 
     @JsonProperty(value = "hash")
     private String bcryptHash;
+
+    @JsonProperty(value = "attributes")
     private Map<String, String> attributes = Collections.emptyMap();
 
     @JsonProperty(value = "primary_principal")
@@ -25,8 +33,8 @@ public StringPrincipal getPrimaryPrincipal() {
     }
 
     @JsonProperty(value = "primary_principal")
-    public void setPrimaryPrincipal(StringPrincipal primaryPrincipal) {
-        this.primaryPrincipal = primaryPrincipal;
+    public void setPrimaryPrincipal(StringPrincipal principal) {
+        this.primaryPrincipal = principal;
     }
 
     @JsonProperty(value = "hash")
@@ -39,10 +47,12 @@ public void setBcryptHash(String bcryptHash) {
         this.bcryptHash = bcryptHash;
     }
 
+    @JsonProperty(value = "attributes")
     public Map<String, String> getAttributes() {
         return attributes;
     }
 
+    @JsonProperty(value = "attributes")
     public void setAttributes(Map<String, String> attributes) {
         this.attributes = attributes;
     }

sandbox/libs/authn/src/main/java/org/opensearch/authn/realm/InternalRealm.java

@@ -109,7 +109,7 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
                 return sai;
             } else {
                 // Bad password
-                throw new IncorrectCredentialsException();
+                throw new IncorrectCredentialsException("Incorrect credentials");
             }
         }
         // Don't know what to do with this token
@@ -240,7 +240,7 @@ public User removeUser(String primaryPrincipal) {
     }
 
     /**
-     * Generates an Exception message String
+     * Generates an Exception message
      * @param primaryPrincipal to be added to this message
      * @return the exception message string
      */

sandbox/libs/authn/src/main/java/org/opensearch/authn/realm/InternalUsersStore.java

@@ -12,6 +12,8 @@
 
 import java.io.IOException;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.Iterator;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
@@ -37,7 +39,27 @@ public static ConcurrentMap<String, User> readUsersAsMap(String pathToInternalUs
                 ObjectNode o = (ObjectNode) subjectNode;
                 o.put("primary_principal", primaryPrincipal);
                 String subjectNodeString = DefaultObjectMapper.writeValueAsString((JsonNode) o, false);
-                User user = DefaultObjectMapper.readValue(subjectNodeString, User.class);
+
+                /**
+                 * Reflects access permissions to prevent jackson databind from throwing InvalidDefinitionException
+                 * Counter-part is added in security.policy to grant jackson-databind ReflectPermission
+                 *
+                 * {@code
+                 * com.fasterxml.jackson.databind.exc.InvalidDefinitionException: Cannot access public org.opensearch.authn.User()
+                 * (from class org.opensearch.authn.User; failed to set access: access denied
+                 * ("java.lang.reflect.ReflectPermission" "suppressAccessChecks")
+                 * }
+                 *
+                 * TODO: Check if there is a better way around this
+                 */
+                User user = AccessController.doPrivileged((PrivilegedAction<User>) () -> {
+                    try {
+                        return DefaultObjectMapper.readValue(subjectNodeString, User.class);
+                    } catch (IOException e) {
+                        throw new RuntimeException(e);
+                    }
+                });
+
                 internalUsersMap.put(primaryPrincipal, user);
             }
         } catch (IOException e) {

server/src/main/java/org/opensearch/action/ActionModule.java

@@ -504,6 +504,7 @@ public ActionModule(
             Stream.of(new RestHeaderDefinition(Task.X_OPAQUE_ID, false))
         ).collect(Collectors.toSet());
         UnaryOperator<RestHandler> restWrapper = null;
+        // Only one plugin is allowed to have a rest wrapper. i.e. Security plugin
         for (ActionPlugin plugin : actionPlugins) {
             UnaryOperator<RestHandler> newRestWrapper = plugin.getRestHandlerWrapper(threadPool.getThreadContext());
             if (newRestWrapper != null) {
@@ -514,6 +515,7 @@ public ActionModule(
                 restWrapper = newRestWrapper;
             }
         }
+
         mappingRequestValidators = new RequestValidators<>(
             actionPlugins.stream().flatMap(p -> p.mappingRequestValidators().stream()).collect(Collectors.toList())
         );

server/src/main/java/org/opensearch/identity/AuthenticationTokenHandler.java

@@ -0,0 +1,70 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.identity;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.opensearch.authn.HttpHeaderToken;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+/**
+ * Extracts Shiro's {@link AuthenticationToken} from different types of auth headers
+ *
+ * @opensearch.experimental
+ */
+public class AuthenticationTokenHandler {
+
+    private static final Logger logger = LogManager.getLogger(AuthenticationTokenHandler.class);
+
+    /**
+     * Extracts shiro auth token from the given header token
+     * @param authenticationToken the token from which to extract
+     * @return the extracted shiro auth token to be used to perform login
+     */
+    public static AuthenticationToken extractShiroAuthToken(org.opensearch.authn.AuthenticationToken authenticationToken) {
+        AuthenticationToken authToken = null;
+
+        if (authenticationToken instanceof HttpHeaderToken) {
+            final HttpHeaderToken headerToken = (HttpHeaderToken) authenticationToken;
+
+            if (headerToken.getHeaderValue().contains("Basic")) {
+                authToken = handleBasicAuth(headerToken);
+            }
+
+            // TODO: check for other type of Headers
+        }
+        // TODO: Handle other type of auths, and see if we can use switch case here
+
+        return authToken;
+    }
+
+    /**
+     * Returns auth token extracted from basic auth header
+     * @param token the basic auth token
+     * @return the extracted auth token
+     */
+    private static AuthenticationToken handleBasicAuth(final HttpHeaderToken token) {
+
+        final byte[] decodedAuthHeader = Base64.getDecoder().decode(token.getHeaderValue().substring("Basic".length()).trim());
+        String decodedHeader = new String(decodedAuthHeader, StandardCharsets.UTF_8);
+
+        final String[] decodedUserNamePassword = decodedHeader.split(":");
+
+        // Malformed AuthHeader strings
+        if (decodedUserNamePassword.length != 2) return null;
+
+        logger.info("Logging in as: " + decodedUserNamePassword[0]);
+
+        return new UsernamePasswordToken(decodedUserNamePassword[0], decodedUserNamePassword[1]);
+    }
+}

server/src/main/java/org/opensearch/identity/internal/InternalAccessTokenManager.java

@@ -0,0 +1,37 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+package org.opensearch.identity.internal;
+
+import org.opensearch.authn.AccessToken;
+import org.opensearch.identity.AccessTokenManager;
+
+/**
+ * Implementation of access token manager that does not enforce authentication
+ *
+ * This class and related classes in this package will not return nulls or fail permissions checks
+ *
+ * @opensearch.internal
+ */
+public class InternalAccessTokenManager implements AccessTokenManager {
+
+    @Override
+    public void expireAllTokens() {
+        // Tokens cannot be expired
+    }
+
+    @Override
+    public AccessToken generate() {
+        return new AccessToken();
+    }
+
+    @Override
+    public AccessToken refresh(final AccessToken token) {
+        return new AccessToken();
+    }
+
+}

server/src/main/java/org/opensearch/identity/internal/InternalAuthenticationManager.java

@@ -0,0 +1,46 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.identity.internal;
+
+import org.opensearch.authn.realm.InternalRealm;
+import org.opensearch.identity.AccessTokenManager;
+import org.opensearch.identity.AuthenticationManager;
+import org.opensearch.authn.Subject;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.mgt.DefaultSecurityManager;
+import org.apache.shiro.mgt.SecurityManager;
+
+/**
+ * Implementation of authentication manager that does not enforce authentication
+ *
+ * This class and related classes in this package will not return nulls or fail permissions checks
+ *
+ * @opensearch.internal
+ */
+public class InternalAuthenticationManager implements AuthenticationManager {
+
+    public InternalAuthenticationManager() {
+        final SecurityManager securityManager = new DefaultSecurityManager(InternalRealm.INSTANCE);
+        SecurityUtils.setSecurityManager(securityManager);
+    }
+
+    public InternalAuthenticationManager(SecurityManager securityManager) {
+        SecurityUtils.setSecurityManager(securityManager);
+    }
+
+    @Override
+    public Subject getSubject() {
+        return new InternalSubject(SecurityUtils.getSubject());
+    }
+
+    @Override
+    public AccessTokenManager getAccessTokenManager() {
+        return null;
+    }
+}