Squashed commit of the following:

commit 1e24bbb Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 12:06:53 2023 -0700 Fixed the exception in keyutils Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 4b406c5 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 11:41:14 2023 -0700 Change the null check right after the jwtparserbuilder Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a805843 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 11:11:13 2023 -0700 Change to use copyof in getSecurityRoles in AuthCredentials class Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 308f269 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 11:02:04 2023 -0700 Add the null or empty check for signingkey in keyUtils Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 40eed32 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 09:55:19 2023 -0700 Fix V6 and V7 and lint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 3c76151 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 25 09:29:17 2023 -0700 Fix comment - Craig Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 7f2fc19 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 24 23:01:24 2023 -0700 Fix some comments 08/24 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 4841b25 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 24 10:50:24 2023 -0700 Add the constant for defaut service in create obo endpoint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 477b505 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 20:18:05 2023 -0700 Remove the unrelated line in AccountApiTest l77 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit f42d2f5 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 19:40:33 2023 -0700 Re-edit the error msg for createoboendpoint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a272ccb Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 19:34:56 2023 -0700 Rename the obo endpoint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit c021473 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 19:30:45 2023 -0700 Correct the getClusterName() Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 8b5158d Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 19:11:07 2023 -0700 Use ClusterInfoHolder to pass clusterName Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 336aa57 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 18:18:42 2023 -0700 Change the error msg in jwtvendorTests too Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 682379d Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 17:21:11 2023 -0700 Switch to assertThat in obo authenticator test Signed-off-by: Ryan Liang <jiallian@amazon.com> commit cb3406a Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:59:30 2023 -0700 Add comment in DynamicConfigModelV7 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 15c8530 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:47:13 2023 -0700 Change to assertThrows for obo authenticator tests Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e56bf01 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:39:24 2023 -0700 Rename to OnBehalfOfSettings in ConfigV6 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 62cfb4f Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:29:31 2023 -0700 Add comment for authentication failure in obo authenticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit d0ebe91 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:22:08 2023 -0700 Specify the error msg of missing signing key in jwtvendor Signed-off-by: Ryan Liang <jiallian@amazon.com> commit ca95380 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 16:12:46 2023 -0700 Refactor the jwtvendor expiry and set up upper limit Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 884f7a1 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 13:51:11 2023 -0700 Flip the boolean logic of roleSecurityMode Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e1021c2 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 13:36:05 2023 -0700 Refactor the bwc mode into roleSecurityMode Signed-off-by: Ryan Liang <jiallian@amazon.com> commit c1a825b Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 12:03:17 2023 -0700 Refactor in jwtVendor 1 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 8eac5cd Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 23 09:53:24 2023 -0700 Change the comment in backend registry Signed-off-by: Ryan Liang <jiallian@amazon.com> commit b0ac41a Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 17:58:15 2023 -0700 Revert the unrelated change in SecurityRestFilter Signed-off-by: Ryan Liang <jiallian@amazon.com> commit b64460d Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 17:53:32 2023 -0700 Remove stale function Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 54bca2a Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 17:36:05 2023 -0700 Refactor the obo endpoint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e429d7b Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 17:16:47 2023 -0700 Refactor the KeyUtils OBOAuthenticator and JwtAuthenticator with jwtParserBuilder Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 72dcec1 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 16:22:42 2023 -0700 Some minor refactoring in obo authenticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 6f0e79b Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 15:46:19 2023 -0700 Remove the malformed token warning for backendroles extraction Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 1ba378e Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 15:42:38 2023 -0700 Refactor the EncryptionDecryptionUtil Signed-off-by: Ryan Liang <jiallian@amazon.com> commit b315559 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 12:02:06 2023 -0700 Fix the exception type in JwtVendorTests Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 6f49801 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 11:35:10 2023 -0700 Remove the if condition in oboconfig for integ testing Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 034aa34 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 11:22:45 2023 -0700 Set up creatJwkException in exceptionUtils and apply that in JwtVendor constructor Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 0f0478d Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 10:14:55 2023 -0700 Rename the KeyUtils Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a4e7aff Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 09:46:27 2023 -0700 Refactor the backendroles claim into br Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 2ff746e Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 09:31:50 2023 -0700 Fix lint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 9ce36dc Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 01:11:24 2023 -0700 Refactor the OBO Authenticator part2 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e52c5ce Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 00:55:33 2023 -0700 Refactor the backendrole extraction in oboauthenticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 9c9e060 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 00:41:51 2023 -0700 Refactor the role extraction in oboauthenticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 387027b Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 00:18:31 2023 -0700 Refactor the logic in JwtVendor Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 267255c Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 22 00:01:15 2023 -0700 Add integration test case for obo permission Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 93bc8c6 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 19:18:49 2023 -0700 Remove unused constants variable in OBO authenticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 878a107 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 19:10:27 2023 -0700 Refactor the encryptiondecryptionutilstests Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 1c1bae6 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 14:53:45 2023 -0700 Remove the null check in oboconfig Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 7e3824e Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 14:44:07 2023 -0700 Remove the wording of seconds in obo endpoint and make the expiry into configconstants Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a126512 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 12:48:33 2023 -0700 Use constant util in Obo integration test Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e5a32c6 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 12:13:50 2023 -0700 Rename the obo endpoint path to generateobotoekn Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e09a902 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 21 09:15:53 2023 -0700 Remove the unused instance in configV6 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit af8aaa7 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 18 13:05:04 2023 -0700 Fix the lint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 9103b23 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 18 13:01:56 2023 -0700 Add permission obo/create for accessing create obo endpoint Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 2349213 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 15:54:38 2023 -0700 Change the name into keyUtils with the s Signed-off-by: Ryan Liang <jiallian@amazon.com> commit dae0ac7 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 15:48:12 2023 -0700 Switch to try/catch + assertEquals for JwtVendorTest Signed-off-by: Ryan Liang <jiallian@amazon.com> commit d918d7a Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 15:39:46 2023 -0700 Change the JwtVendorTest with manually built-up assertThrow Signed-off-by: Ryan Liang <jiallian@amazon.com> commit f47026b Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 14:35:13 2023 -0700 Fix the typo in exceptionUtils Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 43b8d5d Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 14:33:22 2023 -0700 Remove stacktrace debug statement in OBOAutehnticator Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a2c6db1 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 13:04:30 2023 -0700 Change some of the methods name into camle case instead of snake case Signed-off-by: Ryan Liang <jiallian@amazon.com> commit ee79b49 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 11:55:11 2023 -0700 Add unit tests for EncryptionDecryptionUtil Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 3ebff2b Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 17 09:43:43 2023 -0700 Work around for not set static cluster service Signed-off-by: Ryan Liang <jiallian@amazon.com> commit a4efad6 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 13:31:57 2023 -0700 Modify the getDynamicOnBehalfOfSettings() to return settings.Empty if there is no changes Signed-off-by: Ryan Liang <jiallian@amazon.com> commit e23d757 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 12:26:39 2023 -0700 Encapsulate the logic for endpoints access checking into a method Signed-off-by: Ryan Liang <jiallian@amazon.com> commit be26148 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 12:09:25 2023 -0700 Remove useless comments Signed-off-by: Ryan Liang <jiallian@amazon.com> commit bef85da Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 11:57:39 2023 -0700 Remove the enforcing of token type for OBO auth Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 1f79431 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 11:45:45 2023 -0700 Change the field name reason in obo endpoint to description Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 1f12e5e Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 16 11:15:56 2023 -0700 Change the backendrole check's claim name into br Signed-off-by: Ryan Liang <jiallian@amazon.com> commit b2c7d75 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 15 23:30:25 2023 -0700 Address some comment 2 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit d79973c Author: Ryan Liang <jiallian@amazon.com> Date: Tue Aug 15 23:24:16 2023 -0700 Address some comment 1 Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 8a96cab Author: Sam <128482925+samuelcostae@users.noreply.github.com> Date: Fri Aug 18 14:43:07 2023 +0100 Feature/extensions bwc setting (opensearch-project#3180) ### Description This Draft PR includes the new setting bwcPluginMode (backward compatible plugin mode for extensions ) ### Issues Resolved opensearch-project#2616 Is this a backport? If so, please add backport PR # and/or commits # ### Testing [Please provide details of testing done: unit testing, integration testing and manual testing] ### Check List - [ ] New functionality includes testing - [ ] New functionality has been documented - [x] Commits are signed per the DCO using --signoff By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check [here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin). --------- Signed-off-by: Sam <samuel.costa@eliatra.com> commit 91f4478 Merge: e42e4d3 88b6d23 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 14 23:30:37 2023 -0700 Merge branch 'main' into feature/extensions commit e42e4d3 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Mon Aug 14 10:12:58 2023 -0700 [Feature/Extension] Remove hostmapping from create OBO endpoint. (opensearch-project#3161) Signed-off-by: Ryan Liang <jiallian@amazon.com> commit ade34b4 Merge: 6d8e0e2 05f12d8 Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 11 11:37:21 2023 -0700 Merge branch 'main' into feature/extensions commit 6d8e0e2 Merge: 493b53f 3139c18 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Aug 10 21:11:43 2023 -0700 Merge branch 'main' into feature/extensions commit 493b53f Merge: 30cf5b1 46989b5 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 9 12:00:14 2023 -0700 Merge branch 'main' into feature/extensions commit 30cf5b1 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Wed Aug 9 10:10:24 2023 -0700 [Feature/Extension] Add cluster id check for OBO Authenticator (opensearch-project#3117) --------- Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 058f8ec Merge: d643fb2 6cc90e6 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Aug 7 12:33:57 2023 -0700 Merge branch 'main' into feature/extensions commit d643fb2 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Fri Aug 4 22:57:18 2023 -0700 [Feature/Extension] Restrict OBO token's usage for certain endpoints (opensearch-project#3008) Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 2319059 Merge: d634d60 527495d Author: Ryan Liang <jiallian@amazon.com> Date: Fri Aug 4 08:50:34 2023 -0700 Merge branch 'main' into feature/extensions commit d634d60 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Wed Aug 2 13:09:03 2023 -0700 [Feature/Extension] Add configuration of disable OBO (opensearch-project#3047) Signed-off-by: Ryan Liang <jiallian@amazon.com> commit df3dba3 Merge: 1268dee 5384272 Author: Ryan Liang <jiallian@amazon.com> Date: Wed Aug 2 09:42:04 2023 -0700 Merge branch 'main' into feature/extensions commit 1268dee Merge: a9451dd 8063e1b Author: Ryan Liang <jiallian@amazon.com> Date: Tue Jul 25 11:23:05 2023 -0700 Merge branch 'main' into feature/extensions commit a9451dd Merge: 671c772 59e2657 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Jul 24 13:30:37 2023 -0700 Merge branch 'main' into feature/extensions commit 671c772 Merge: 67515bc f1be2d7 Author: Ryan Liang <jiallian@amazon.com> Date: Tue Jul 18 09:04:25 2023 -0700 Merge branch 'main' into feature/extensions commit 67515bc Merge: 88f32e9 0e6608d Author: Ryan Liang <jiallian@amazon.com> Date: Thu Jul 13 11:18:07 2023 -0700 Merge branch 'main' into feature/extensions commit 88f32e9 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Fri Jul 7 11:42:21 2023 -0700 [Feature/Extension] Add oboauthcbackend registry and set up e2e endpoint testing flow (opensearch-project#2857) * Add OBO Authbackend Signed-off-by: Peter Nied <petern@amazon.com> Signed-off-by: Ryan Liang <jiallian@amazon.com> Co-authored-by: Peter Nied <petern@amazon.com> commit 8c3c639 Merge: 21891d7 4eef662 Author: Ryan Liang <jiallian@amazon.com> Date: Mon Jul 3 10:34:27 2023 -0700 Merge branch 'main' into feature/extensions commit 21891d7 Merge: 8ad24ad 7546c05 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Jun 29 13:28:12 2023 -0700 Merge branch 'feature-branch-sync-629' into feature/extensions commit 8ad24ad Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Thu Jun 29 13:23:04 2023 -0700 Revert "Feature branch sync 06/29/2023 (opensearch-project#2918)" (opensearch-project#2920) This reverts commit 748a711. commit 748a711 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Thu Jun 29 12:37:08 2023 -0700 Feature branch sync 06/29/2023 (opensearch-project#2918) * add search model group permission to ml_read_access role (opensearch-project#2855) * add search model group permission to ml_read_access role Signed-off-by: Bhavana Ramaram <rbhavna@amazon.com> * IntegrationTest spotless (opensearch-project#2863) Signed-off-by: Stephen Crawford <steecraw@amazon.com> * Format everything (opensearch-project#2866) * Use boucycastle PEM reader instead of reg expression (opensearch-project#2864) Use BouncyCastle PEMReader instead of regular expression to read and parse private key pem files. Signed-off-by: Andrey Pleskach <ples@aiven.io> * Adding field level security test cases for FlatFields (opensearch-project#2876) Signed-off-by: Peter Nied <petern@amazon.com> * Update snappy to 1.1.10.1 and guava to 32.0.1-jre (opensearch-project#2886) * Update snappy to 1.1.10.1 and guava to 32.0.1-jre Signed-off-by: Craig Perkins <cwperx@amazon.com> * Upgrade kafka to 3.5.0 Signed-off-by: Craig Perkins <cwperx@amazon.com> * Force snappy Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add runtime dependency on org.scala-lang.modules:scala-java8-compat_3:1.0.2 to fix issue with KafkaSinkTest Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com> * Role permissions order tool and workflow (opensearch-project#2733) * Check Permissions Order tool and workflow Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required. Signed-off-by: Peter Nied <peternied@hotmail.com> * Apply fixes to roles.yml files Signed-off-by: Peter Nied <peternied@hotmail.com> * Fixing busted test, adding findArrayInJson for response bodies Signed-off-by: Peter Nied <petern@amazon.com> --------- Signed-off-by: Peter Nied <peternied@hotmail.com> Signed-off-by: Peter Nied <petern@amazon.com> * Misc changes (opensearch-project#2902) Moved isStatic and isReserved methods to the SecurityDynamicConfiguration class Signed-off-by: Andrey Pleskach <ples@aiven.io> * Update triaging guidelines (opensearch-project#2899) * Update triaging guidelines Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> * fix cluster perm classification for msearch template (opensearch-project#2892) * fix cluster perm classification for msearch template Signed-off-by: Derek Ho <dxho@amazon.com> * move test to unit test file Signed-off-by: Derek Ho <dxho@amazon.com> * fully revert integration test file Signed-off-by: Derek Ho <dxho@amazon.com> * Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> * spotless Signed-off-by: Derek Ho <dxho@amazon.com> --------- Signed-off-by: Derek Ho <dxho@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> * [Doc] Add architecture document (opensearch-project#2869) * Add initial architecture document Signed-off-by: Peter Nied <petern@amazon.com> * [Enhancement] Parallel test jobs for CI (opensearch-project#2861) * Split multiple tests into separate gradle tasks. * Tasks are configured in "splitTestConfig" map in build.gradle file. Map allows to use all patterns from TestFilter like: includeTestsMatching, excludeTestsMatching, includeTest etc. * Tasks are automatically generated from "splitTestConfig" map. * Two new Gradle tasks: listTasksAsJSON and listTasksAsParam to output task names to console. First one outputs them as a JSON and second - in gradlew "-x <TASK>" format to use in CLI. * Patterns included in tasks are automatically excluded from main "test" task but at the same time generated tasks are dependencies for "test". Running "gradlew test" will run whole suite at once. * CI pipeline has been configured to accomodate all changes. * New 'master' task to generate list of jobs to run in parallel. * Updated matrix strategy to include task name to start. Signed-off-by: Pawel Gudel <pawel.gudel@eliatra.com> * Bump BouncyCastle from jdk15on to jdk15to18 (opensearch-project#2901) jdk15to18 contains fix for - CVE-2023-33201 - Medium Severity Vulnerability Signed-off-by: Andrey Pleskach <ples@aiven.io> * Spotless Apply Signed-off-by: Ryan Liang <jiallian@amazon.com> --------- Signed-off-by: Bhavana Ramaram <rbhavna@amazon.com> Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Peter Nied <petern@amazon.com> Signed-off-by: Craig Perkins <cwperx@amazon.com> Signed-off-by: Peter Nied <peternied@hotmail.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Signed-off-by: Derek Ho <dxho@amazon.com> Signed-off-by: Pawel Gudel <pawel.gudel@eliatra.com> Signed-off-by: Ryan Liang <jiallian@amazon.com> Co-authored-by: Bhavana Ramaram <rbhavna@amazon.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Andrey Pleskach <ples@aiven.io> Co-authored-by: Peter Nied <petern@amazon.com> Co-authored-by: Craig Perkins <cwperx@amazon.com> Co-authored-by: Derek Ho <derek01778@gmail.com> Co-authored-by: pawel-gudel-eliatra <136344230+pawel-gudel-eliatra@users.noreply.github.com> commit 7546c05 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Jun 29 11:50:58 2023 -0700 Spotless Apply Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 81b7818 Author: Andrey Pleskach <ples@aiven.io> Date: Thu Jun 29 15:54:21 2023 +0200 Bump BouncyCastle from jdk15on to jdk15to18 (opensearch-project#2901) jdk15to18 contains fix for - CVE-2023-33201 - Medium Severity Vulnerability Signed-off-by: Andrey Pleskach <ples@aiven.io> commit 95efddd Author: pawel-gudel-eliatra <136344230+pawel-gudel-eliatra@users.noreply.github.com> Date: Wed Jun 28 22:41:46 2023 +0200 [Enhancement] Parallel test jobs for CI (opensearch-project#2861) * Split multiple tests into separate gradle tasks. * Tasks are configured in "splitTestConfig" map in build.gradle file. Map allows to use all patterns from TestFilter like: includeTestsMatching, excludeTestsMatching, includeTest etc. * Tasks are automatically generated from "splitTestConfig" map. * Two new Gradle tasks: listTasksAsJSON and listTasksAsParam to output task names to console. First one outputs them as a JSON and second - in gradlew "-x <TASK>" format to use in CLI. * Patterns included in tasks are automatically excluded from main "test" task but at the same time generated tasks are dependencies for "test". Running "gradlew test" will run whole suite at once. * CI pipeline has been configured to accomodate all changes. * New 'master' task to generate list of jobs to run in parallel. * Updated matrix strategy to include task name to start. Signed-off-by: Pawel Gudel <pawel.gudel@eliatra.com> commit 766389b Author: Peter Nied <petern@amazon.com> Date: Wed Jun 28 15:28:11 2023 -0500 [Doc] Add architecture document (opensearch-project#2869) * Add initial architecture document Signed-off-by: Peter Nied <petern@amazon.com> commit c1d2127 Author: Derek Ho <derek01778@gmail.com> Date: Wed Jun 28 15:21:04 2023 -0400 fix cluster perm classification for msearch template (opensearch-project#2892) * fix cluster perm classification for msearch template Signed-off-by: Derek Ho <dxho@amazon.com> * move test to unit test file Signed-off-by: Derek Ho <dxho@amazon.com> * fully revert integration test file Signed-off-by: Derek Ho <dxho@amazon.com> * Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> * spotless Signed-off-by: Derek Ho <dxho@amazon.com> --------- Signed-off-by: Derek Ho <dxho@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> commit 37f277e Author: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Date: Mon Jun 26 15:28:13 2023 -0400 Update triaging guidelines (opensearch-project#2899) * Update triaging guidelines Signed-off-by: Stephen Crawford <steecraw@amazon.com> Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> commit 926bdda Author: Andrey Pleskach <ples@aiven.io> Date: Mon Jun 26 20:09:39 2023 +0200 Misc changes (opensearch-project#2902) Moved isStatic and isReserved methods to the SecurityDynamicConfiguration class Signed-off-by: Andrey Pleskach <ples@aiven.io> commit 9cd0198 Author: Peter Nied <petern@amazon.com> Date: Mon Jun 26 10:04:39 2023 -0500 Role permissions order tool and workflow (opensearch-project#2733) * Check Permissions Order tool and workflow Adds a NodeJS tool that can inspect yaml role definitions, check if they are in alphabetical order, correct them if required. Signed-off-by: Peter Nied <peternied@hotmail.com> * Apply fixes to roles.yml files Signed-off-by: Peter Nied <peternied@hotmail.com> * Fixing busted test, adding findArrayInJson for response bodies Signed-off-by: Peter Nied <petern@amazon.com> --------- Signed-off-by: Peter Nied <peternied@hotmail.com> Signed-off-by: Peter Nied <petern@amazon.com> commit 4bb144f Author: Craig Perkins <cwperx@amazon.com> Date: Wed Jun 21 09:31:47 2023 -0400 Update snappy to 1.1.10.1 and guava to 32.0.1-jre (opensearch-project#2886) * Update snappy to 1.1.10.1 and guava to 32.0.1-jre Signed-off-by: Craig Perkins <cwperx@amazon.com> * Upgrade kafka to 3.5.0 Signed-off-by: Craig Perkins <cwperx@amazon.com> * Force snappy Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add runtime dependency on org.scala-lang.modules:scala-java8-compat_3:1.0.2 to fix issue with KafkaSinkTest Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com> commit c71d9b3 Author: Peter Nied <petern@amazon.com> Date: Tue Jun 20 13:36:01 2023 -0500 Adding field level security test cases for FlatFields (opensearch-project#2876) Signed-off-by: Peter Nied <petern@amazon.com> commit e3b4f8f Author: Andrey Pleskach <ples@aiven.io> Date: Mon Jun 19 16:18:28 2023 +0200 Use boucycastle PEM reader instead of reg expression (opensearch-project#2864) Use BouncyCastle PEMReader instead of regular expression to read and parse private key pem files. Signed-off-by: Andrey Pleskach <ples@aiven.io> commit ef6224c Author: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Date: Thu Jun 15 23:32:10 2023 -0400 Format everything (opensearch-project#2866) commit ef048a2 Author: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Date: Thu Jun 15 11:57:25 2023 -0400 IntegrationTest spotless (opensearch-project#2863) Signed-off-by: Stephen Crawford <steecraw@amazon.com> commit b6bfb11 Author: Bhavana Ramaram <rbhavna@amazon.com> Date: Tue Jun 13 17:00:34 2023 -0700 add search model group permission to ml_read_access role (opensearch-project#2855) * add search model group permission to ml_read_access role Signed-off-by: Bhavana Ramaram <rbhavna@amazon.com> commit 26244e9 Merge: 56e77fe 1691ca7 Author: Craig Perkins <cwperx@amazon.com> Date: Tue Jun 13 16:14:33 2023 -0400 Merge branch 'format-feature-extensions-apply' into feature/extensions commit 1691ca7 Merge: efcadd4 2e263b8 Author: Craig Perkins <cwperx@amazon.com> Date: Tue Jun 13 16:05:59 2023 -0400 Merge branch 'main' into format-feature-extensions-apply commit efcadd4 Merge: 1a09a87 ceb5ad2 Author: Craig Perkins <cwperx@amazon.com> Date: Fri Jun 9 10:16:02 2023 -0400 Merge branch 'main' into format-feature-extensions-apply commit 1a09a87 Author: Craig Perkins <cwperx@amazon.com> Date: Fri Jun 9 09:57:42 2023 -0400 Run spotlessApply Signed-off-by: Craig Perkins <cwperx@amazon.com> commit 01917ff Author: Craig Perkins <cwperx@amazon.com> Date: Fri Jun 9 09:55:09 2023 -0400 Remove other spotless section Signed-off-by: Craig Perkins <cwperx@amazon.com> commit c83ad28 Author: Craig Perkins <cwperx@amazon.com> Date: Fri Jun 9 09:53:35 2023 -0400 Add formatting changes in feature/extensions Signed-off-by: Craig Perkins <cwperx@amazon.com> commit 56e77fe Merge: fa0fcc3 33aebb9 Author: Ryan Liang <jiallian@amazon.com> Date: Wed May 24 11:31:54 2023 -0700 Merge branch 'main' into feature/extensions commit fa0fcc3 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Tue May 16 10:55:57 2023 -0700 [Feature/Extension] Rename the term 'extension' into 'on_behalf_of' (opensearch-project#2774) Signed-off-by: Ryan Liang <jiallian@amazon.com> commit f1cee3b Merge: 95f9c77 15860b6 Author: Ryan Liang <jiallian@amazon.com> Date: Tue May 16 09:33:59 2023 -0700 Merge branch 'main' into feature/extensions commit 95f9c77 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Thu May 11 11:50:12 2023 -0700 [Security/Extension] Extension Authentication Backend (opensearch-project#2672) * Extension Authentication-backend Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 8f02d8d Merge: 9515181 9d758f9 Author: Ryan Liang <jiallian@amazon.com> Date: Wed May 10 12:12:20 2023 -0700 Merge branch 'main' into feature/extensions commit 9515181 Author: Ryan Liang <jiallian@amazon.com> Date: Wed May 10 09:51:26 2023 -0700 Fix the conflicts Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 06055c3 Merge: df75a37 f4def32 Author: Ryan Liang <jiallian@amazon.com> Date: Wed May 10 09:34:05 2023 -0700 merge main into security extension feature branch commit df75a37 Author: MaciejMierzwa <dev.maciej.mierzwa@gmail.com> Date: Tue May 2 15:44:04 2023 +0200 Extensions config for JWT signing/encryption key (opensearch-project#2671) * Extensions config for JWT signing/encryption key Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com> commit d4e5f1f Merge: 4da62c3 6997f97 Author: Ryan Liang <jiallian@amazon.com> Date: Thu Apr 27 07:05:39 2023 -0700 Merge branch 'main' into feature/extensions commit 4da62c3 Merge: 73ab1fc 6ace852 Author: Craig Perkins <cwperx@amazon.com> Date: Tue Apr 25 09:38:52 2023 -0400 Merge branch 'main' into feature/extensions commit 73ab1fc Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Thu Apr 6 13:38:19 2023 -0700 [Security/Extension] Role encryption/decryption (opensearch-project#2620) * Encryption/Decryption of `roles` Signed-off-by: Ryan Liang <jiallian@amazon.com> commit 1681823 Author: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Date: Fri Mar 31 06:58:56 2023 -0700 [Security/Extension] JWT Vendor for extensions (opensearch-project#2567) * JWT Vendor for extensions Signed-off-by: Ryan Liang <jiallian@amazon.com> Signed-off-by: Peter Nied <petern@amazon.com>
peternied · Aug 25, 2023 · 6486580 · 6486580
1 parent ed61646
commit 6486580
Show file tree

Hide file tree

Showing 29 changed files with 1,949 additions and 70 deletions.
diff --git a/src/integrationTest/java/org/opensearch/security/http/OnBehalfOfJwtAuthenticationTest.java b/src/integrationTest/java/org/opensearch/security/http/OnBehalfOfJwtAuthenticationTest.java
@@ -0,0 +1,170 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ * Modifications Copyright OpenSearch Contributors. See
+ * GitHub history for details.
+ */
+
+package org.opensearch.security.http;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.List;
+import java.util.Map;
+
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope;
+import org.apache.hc.core5.http.Header;
+import org.apache.hc.core5.http.HttpStatus;
+import org.apache.hc.core5.http.message.BasicHeader;
+import org.junit.Assert;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.opensearch.test.framework.OnBehalfOfConfig;
+import org.opensearch.test.framework.TestSecurityConfig;
+import org.opensearch.test.framework.cluster.ClusterManager;
+import org.opensearch.test.framework.cluster.LocalCluster;
+import org.opensearch.test.framework.cluster.TestRestClient;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.aMapWithSize;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasKey;
+import static org.opensearch.security.support.ConfigConstants.SECURITY_ALLOW_DEFAULT_INIT_SECURITYINDEX;
+import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ROLES_ENABLED;
+import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL;
+import static org.opensearch.test.framework.TestSecurityConfig.Role.ALL_ACCESS;
+
+@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
+@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
+public class OnBehalfOfJwtAuthenticationTest {
+
+    public static final String POINTER_USERNAME = "/user_name";
+
+    static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin").roles(ALL_ACCESS);
+
+    private static Boolean oboEnabled = true;
+    private static final String signingKey = Base64.getEncoder()
+        .encodeToString(
+            "jwt signing key for an on behalf of token authentication backend for testing of OBO authentication".getBytes(
+                StandardCharsets.UTF_8
+            )
+        );
+    private static final String encryptionKey = Base64.getEncoder().encodeToString("encryptionKey".getBytes(StandardCharsets.UTF_8));
+    public static final String ADMIN_USER_NAME = "admin";
+    public static final String OBO_USER_NAME_WITH_PERM = "obo_user";
+    public static final String OBO_USER_NAME_NO_PERM = "obo_user_no_perm";
+    public static final String DEFAULT_PASSWORD = "secret";
+    public static final String NEW_PASSWORD = "testPassword123!!";
+    public static final String OBO_TOKEN_REASON = "{\"reason\":\"Test generation\"}";
+    public static final String OBO_ENDPOINT_PREFIX = "_plugins/_security/api/generateonbehalfoftoken";
+    public static final String OBO_DESCRIPTION = "{\"description\":\"Testing\", \"service\":\"self-issued\"}";
+    public static final String CURRENT_AND_NEW_PASSWORDS = "{ \"current_password\": \""
+        + DEFAULT_PASSWORD
+        + "\", \"password\": \""
+        + NEW_PASSWORD
+        + "\" }";
+
+    protected final static TestSecurityConfig.User OBO_USER = new TestSecurityConfig.User(OBO_USER_NAME_WITH_PERM).roles(
+        new TestSecurityConfig.Role("obo_access_role").clusterPermissions("security:obo/create")
+    );
+
+    protected final static TestSecurityConfig.User OBO_USER_NO_PERM = new TestSecurityConfig.User(OBO_USER_NAME_NO_PERM).roles(
+        new TestSecurityConfig.Role("obo_user_no_perm")
+    );
+
+    @ClassRule
+    public static final LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
+        .anonymousAuth(false)
+        .users(ADMIN_USER, OBO_USER, OBO_USER_NO_PERM)
+        .nodeSettings(
+            Map.of(SECURITY_ALLOW_DEFAULT_INIT_SECURITYINDEX, true, SECURITY_RESTAPI_ROLES_ENABLED, List.of("user_admin__all_access"))
+        )
+        .authc(AUTHC_HTTPBASIC_INTERNAL)
+        .onBehalfOf(new OnBehalfOfConfig().oboEnabled(oboEnabled).signingKey(signingKey).encryptionKey(encryptionKey))
+        .build();
+
+    @Test
+    public void shouldAuthenticateWithOBOTokenEndPoint() {
+        String oboToken = generateOboToken(ADMIN_USER_NAME, DEFAULT_PASSWORD);
+        Header adminOboAuthHeader = new BasicHeader("Authorization", "Bearer " + oboToken);
+        authenticateWithOboToken(adminOboAuthHeader, ADMIN_USER_NAME, 200);
+    }
+
+    @Test
+    public void shouldNotAuthenticateWithATemperedOBOToken() {
+        String oboToken = generateOboToken(ADMIN_USER_NAME, DEFAULT_PASSWORD);
+        oboToken = oboToken.substring(0, oboToken.length() - 1); // tampering the token
+        Header adminOboAuthHeader = new BasicHeader("Authorization", "Bearer " + oboToken);
+        authenticateWithOboToken(adminOboAuthHeader, ADMIN_USER_NAME, 401);
+    }
+
+    @Test
+    public void shouldNotAuthenticateForUsingOBOTokenToAccessOBOEndpoint() {
+        String oboToken = generateOboToken(ADMIN_USER_NAME, DEFAULT_PASSWORD);
+        Header adminOboAuthHeader = new BasicHeader("Authorization", "Bearer " + oboToken);
+
+        try (TestRestClient client = cluster.getRestClient(adminOboAuthHeader)) {
+            TestRestClient.HttpResponse response = client.getOnBehalfOfToken(OBO_DESCRIPTION, adminOboAuthHeader);
+            response.assertStatusCode(401);
+        }
+    }
+
+    @Test
+    public void shouldNotAuthenticateForUsingOBOTokenToAccessAccountEndpoint() {
+        String oboToken = generateOboToken(ADMIN_USER_NAME, DEFAULT_PASSWORD);
+        Header adminOboAuthHeader = new BasicHeader("Authorization", "Bearer " + oboToken);
+
+        try (TestRestClient client = cluster.getRestClient(adminOboAuthHeader)) {
+            TestRestClient.HttpResponse response = client.changeInternalUserPassword(CURRENT_AND_NEW_PASSWORDS, adminOboAuthHeader);
+            response.assertStatusCode(401);
+        }
+    }
+
+    @Test
+    public void shouldAuthenticateForNonAdminUserWithOBOPermission() {
+        String oboToken = generateOboToken(OBO_USER_NAME_WITH_PERM, DEFAULT_PASSWORD);
+        Header oboAuthHeader = new BasicHeader("Authorization", "Bearer " + oboToken);
+        authenticateWithOboToken(oboAuthHeader, OBO_USER_NAME_WITH_PERM, 200);
+    }
+
+    @Test
+    public void shouldNotAuthenticateForNonAdminUserWithoutOBOPermission() {
+        try (TestRestClient client = cluster.getRestClient(OBO_USER_NO_PERM)) {
+            assertThat(client.post(OBO_ENDPOINT_PREFIX).getStatusCode(), equalTo(HttpStatus.SC_UNAUTHORIZED));
+        }
+    }
+
+    private String generateOboToken(String username, String password) {
+        try (TestRestClient client = cluster.getRestClient(username, password)) {
+            client.assertCorrectCredentials(username);
+            TestRestClient.HttpResponse response = client.postJson(OBO_ENDPOINT_PREFIX, OBO_TOKEN_REASON);
+            response.assertStatusCode(200);
+            Map<String, Object> oboEndPointResponse = response.getBodyAs(Map.class);
+            assertThat(
+                oboEndPointResponse,
+                allOf(aMapWithSize(3), hasKey("user"), hasKey("authenticationToken"), hasKey("durationSeconds"))
+            );
+            return oboEndPointResponse.get("authenticationToken").toString();
+        }
+    }
+
+    private void authenticateWithOboToken(Header authHeader, String expectedUsername, int expectedStatusCode) {
+        try (TestRestClient client = cluster.getRestClient(authHeader)) {
+            TestRestClient.HttpResponse response = client.getAuthInfo();
+            response.assertStatusCode(expectedStatusCode);
+            if (expectedStatusCode == 200) {
+                String username = response.getTextFromJsonBody(POINTER_USERNAME);
+                assertThat(username, equalTo(expectedUsername));
+            } else {
+                Assert.assertTrue(response.getBody().contains("Unauthorized"));
+            }
+        }
+    }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/OnBehalfOfConfig.java b/src/integrationTest/java/org/opensearch/test/framework/OnBehalfOfConfig.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ *
+ */
+package org.opensearch.test.framework;
+
+import java.io.IOException;
+
+import org.apache.commons.lang3.StringUtils;
+
+import org.opensearch.core.xcontent.ToXContent;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+
+public class OnBehalfOfConfig implements ToXContentObject {
+    private Boolean oboEnabled;
+    private String signing_key;
+    private String encryption_key;
+
+    public OnBehalfOfConfig oboEnabled(Boolean oboEnabled) {
+        this.oboEnabled = oboEnabled;
+        return this;
+    }
+
+    public OnBehalfOfConfig signingKey(String signing_key) {
+        this.signing_key = signing_key;
+        return this;
+    }
+
+    public OnBehalfOfConfig encryptionKey(String encryption_key) {
+        this.encryption_key = encryption_key;
+        return this;
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder xContentBuilder, ToXContent.Params params) throws IOException {
+        xContentBuilder.startObject();
+        xContentBuilder.field("enabled", oboEnabled);
+        xContentBuilder.field("signing_key", signing_key);
+        if (StringUtils.isNoneBlank(encryption_key)) {
+            xContentBuilder.field("encryption_key", encryption_key);
+        }
+        xContentBuilder.endObject();
+        return xContentBuilder;
+    }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/TestSecurityConfig.java b/src/integrationTest/java/org/opensearch/test/framework/TestSecurityConfig.java
@@ -114,6 +114,11 @@ public TestSecurityConfig xff(XffConfig xffConfig) {
         return this;
     }
 
+    public TestSecurityConfig onBehalfOf(OnBehalfOfConfig onBehalfOfConfig) {
+        config.onBehalfOfConfig(onBehalfOfConfig);
+        return this;
+    }
+
     public TestSecurityConfig authc(AuthcDomain authcDomain) {
         config.authc(authcDomain);
         return this;
@@ -170,6 +175,7 @@ public static class Config implements ToXContentObject {
 
         private Boolean doNotFailOnForbidden;
         private XffConfig xffConfig;
+        private OnBehalfOfConfig onBehalfOfConfig;
         private Map<String, AuthcDomain> authcDomainMap = new LinkedHashMap<>();
 
         private AuthFailureListeners authFailureListeners;
@@ -190,6 +196,11 @@ public Config xffConfig(XffConfig xffConfig) {
             return this;
         }
 
+        public Config onBehalfOfConfig(OnBehalfOfConfig onBehalfOfConfig) {
+            this.onBehalfOfConfig = onBehalfOfConfig;
+            return this;
+        }
+
         public Config authc(AuthcDomain authcDomain) {
             authcDomainMap.put(authcDomain.id, authcDomain);
             return this;
@@ -210,6 +221,10 @@ public XContentBuilder toXContent(XContentBuilder xContentBuilder, Params params
             xContentBuilder.startObject();
             xContentBuilder.startObject("dynamic");
 
+            if (onBehalfOfConfig != null) {
+                xContentBuilder.field("on_behalf_of", onBehalfOfConfig);
+            }
+
             if (anonymousAuth || (xffConfig != null)) {
                 xContentBuilder.startObject("http");
                 xContentBuilder.field("anonymous_auth_enabled", anonymousAuth);

diff --git a/src/integrationTest/java/org/opensearch/test/framework/cluster/LocalCluster.java b/src/integrationTest/java/org/opensearch/test/framework/cluster/LocalCluster.java
@@ -55,6 +55,7 @@
 import org.opensearch.test.framework.AuditConfiguration;
 import org.opensearch.test.framework.AuthFailureListeners;
 import org.opensearch.test.framework.AuthzDomain;
+import org.opensearch.test.framework.OnBehalfOfConfig;
 import org.opensearch.test.framework.RolesMapping;
 import org.opensearch.test.framework.TestIndex;
 import org.opensearch.test.framework.TestSecurityConfig;
@@ -471,6 +472,11 @@ public Builder xff(XffConfig xffConfig) {
             return this;
         }
 
+        public Builder onBehalfOf(OnBehalfOfConfig onBehalfOfConfig) {
+            testSecurityConfig.onBehalfOf(onBehalfOfConfig);
+            return this;
+        }
+
         public Builder loadConfigurationIntoIndex(boolean loadConfigurationIntoIndex) {
             this.loadConfigurationIntoIndex = loadConfigurationIntoIndex;
             return this;

diff --git a/src/integrationTest/java/org/opensearch/test/framework/cluster/TestRestClient.java b/src/integrationTest/java/org/opensearch/test/framework/cluster/TestRestClient.java
@@ -135,6 +135,28 @@ public HttpResponse getAuthInfo(Header... headers) {
         return executeRequest(new HttpGet(getHttpServerUri() + "/_opendistro/_security/authinfo?pretty"), headers);
     }
 
+    public HttpResponse getOnBehalfOfToken(String jsonData, Header... headers) {
+        try {
+            HttpPost httpPost = new HttpPost(
+                new URIBuilder(getHttpServerUri() + "/_plugins/_security/api/generateonbehalfoftoken?pretty").build()
+            );
+            httpPost.setEntity(toStringEntity(jsonData));
+            return executeRequest(httpPost, mergeHeaders(CONTENT_TYPE_JSON, headers));
+        } catch (URISyntaxException ex) {
+            throw new RuntimeException("Incorrect URI syntax", ex);
+        }
+    }
+
+    public HttpResponse changeInternalUserPassword(String jsonData, Header... headers) {
+        try {
+            HttpPut httpPut = new HttpPut(new URIBuilder(getHttpServerUri() + "/_plugins/_security/api/account?pretty").build());
+            httpPut.setEntity(toStringEntity(jsonData));
+            return executeRequest(httpPut, mergeHeaders(CONTENT_TYPE_JSON, headers));
+        } catch (URISyntaxException ex) {
+            throw new RuntimeException("Incorrect URI syntax", ex);
+        }
+    }
+
     public void assertCorrectCredentials(String expectedUserName) {
         HttpResponse response = getAuthInfo();
         assertThat(response, notNullValue());

diff --git a/src/integrationTest/resources/config.yml b/src/integrationTest/resources/config.yml
@@ -15,3 +15,8 @@ config:
         authentication_backend:
           type: "internal"
           config: {}
+    on_behalf_of:
+      # The decoded signing key is: This is the jwt signing key for an on behalf of token authentication backend for testing of extensions
+      # The decoded encryption key is: encryptionKey
+      signing_key: "VGhpcyBpcyB0aGUgand0IHNpZ25pbmcga2V5IGZvciBhbiBvbiBiZWhhbGYgb2YgdG9rZW4gYXV0aGVudGljYXRpb24gYmFja2VuZCBmb3IgdGVzdGluZyBvZiBleHRlbnNpb25z"
+      encryption_key: "ZW5jcnlwdGlvbktleQ=="