diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3e52a1cb..54539799 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -79,6 +79,12 @@ jobs: # This job runs on Linux. runs-on: ubuntu-latest steps: + # This step uses the setup-java Github action: https://github.com/actions/setup-java + - name: Set Up JDK ${{ matrix.java }} + uses: actions/setup-java@v3 + with: + distribution: temurin # Temurin is a distribution of adoptium + java-version: ${{ matrix.java }} - name: Checkout Branch uses: actions/checkout@v2 - uses: actions/download-artifact@v3 @@ -87,9 +93,9 @@ jobs: - name: Pull and Run Docker for security tests run: | plugin=${{ needs.linux-build.outputs.build-test-linux }} - version=`echo $plugin|awk -F- '{print $3}'| cut -d. -f 1-3` - plugin_version=`echo $plugin|awk -F- '{print $3}'| cut -d. -f 1-4` - qualifier=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-1` + version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-3` + plugin_version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-4` + qualifier=`echo $plugin|awk -F- '{print $5}'| cut -d. -f 1-1` if [ -n "$qualifier" ] && [ "$qualifier" != "SNAPSHOT" ]; then qualifier=-${qualifier} diff --git a/build.gradle b/build.gradle index b8b5efaf..f5eb6428 100644 --- a/build.gradle +++ b/build.gradle @@ -42,7 +42,8 @@ buildscript { //****************************************************************************/ plugins { - id 'com.netflix.nebula.ospackage' version "11.6.0" + id "de.undercouch.download" version "5.3.0" + id 'com.netflix.nebula.ospackage' version "11.10.0" id 'checkstyle' } @@ -79,6 +80,20 @@ ext { projectSubstitutions = [:] licenseFile = rootProject.file('LICENSE.txt') noticeFile = rootProject.file('NOTICE.txt') + + ['sample.pem', 'test-kirk.jks'].forEach { file -> + File local = getLayout().getBuildDirectory().file(file).get().getAsFile() + download.run { + src "https://raw.githubusercontent.com/opensearch-project/security/refs/heads/main/bwc-test/src/test/resources/security/" + file + dest local + overwrite false + } + } + + processResources { + from(getLayout().getBuildDirectory().file('sample.pem').get().getAsFile()) + from(getLayout().getBuildDirectory().file('test-kirk.jks').get().getAsFile()) + } } java { diff --git a/src/main/java/org/opensearch/search/asynchronous/management/AsynchronousSearchManagementService.java b/src/main/java/org/opensearch/search/asynchronous/management/AsynchronousSearchManagementService.java index 30df51a2..8d16c912 100644 --- a/src/main/java/org/opensearch/search/asynchronous/management/AsynchronousSearchManagementService.java +++ b/src/main/java/org/opensearch/search/asynchronous/management/AsynchronousSearchManagementService.java @@ -194,8 +194,6 @@ public void run() { public final void performCleanUp() { final ThreadContext threadContext = threadPool.getThreadContext(); try (ThreadContext.StoredContext ignore = threadContext.stashContext()) { - // we have to execute under the system context so that if security is enabled the sync is authorized - threadContext.markAsSystemContext(); final Map dataNodes = clusterService.state().nodes().getDataNodes(); List nodes = Stream.of(dataNodes.values().toArray(new DiscoveryNode[0])) .collect(Collectors.toList()); diff --git a/src/test/java/org/opensearch/search/asynchronous/SecurityEnabledRestTestCase.java b/src/test/java/org/opensearch/search/asynchronous/SecurityEnabledRestTestCase.java index 066a516c..23b63f64 100644 --- a/src/test/java/org/opensearch/search/asynchronous/SecurityEnabledRestTestCase.java +++ b/src/test/java/org/opensearch/search/asynchronous/SecurityEnabledRestTestCase.java @@ -7,11 +7,7 @@ import org.apache.http.Header; import org.apache.http.HttpHost; -import org.apache.http.auth.AuthScope; -import org.apache.http.auth.UsernamePasswordCredentials; -import org.apache.http.client.CredentialsProvider; import org.apache.http.conn.ssl.NoopHostnameVerifier; -import org.apache.http.impl.client.BasicCredentialsProvider; import org.apache.http.message.BasicHeader; import org.apache.http.ssl.SSLContextBuilder; import org.junit.After; @@ -33,8 +29,11 @@ import java.io.IOException; import java.net.URI; import java.net.URISyntaxException; +import java.nio.charset.StandardCharsets; import java.nio.file.Path; +import java.util.Base64; import java.util.Collections; +import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Objects; @@ -92,7 +91,7 @@ protected RestClient buildClient(Settings settings, HttpHost[] hosts) throws IOE if (Objects.nonNull(keystore)) { URI uri = null; try { - uri = this.getClass().getClassLoader().getResource("security/sample.pem").toURI(); + uri = this.getClass().getClassLoader().getResource("sample.pem").toURI(); } catch (URISyntaxException e) { throw new RuntimeException(e); } @@ -142,7 +141,15 @@ protected void wipeAllOSIndices() throws IOException { } protected static void configureHttpsClient(RestClientBuilder builder, Settings settings) throws IOException { - Map headers = ThreadContext.buildDefaultHeaders(settings); + Map headers = new HashMap<>(ThreadContext.buildDefaultHeaders(settings)); + if (System.getProperty("user") != null && System.getProperty("password") != null) { + String userName = System.getProperty("user"); + String password = System.getProperty("password"); + headers.put( + "Authorization", + "Basic " + Base64.getEncoder().encodeToString((userName + ":" + password).getBytes(StandardCharsets.UTF_8)) + ); + } Header[] defaultHeaders = new Header[headers.size()]; int i = 0; for (Map.Entry entry : headers.entrySet()) { @@ -150,17 +157,8 @@ protected static void configureHttpsClient(RestClientBuilder builder, Settings s } builder.setDefaultHeaders(defaultHeaders); builder.setHttpClientConfigCallback(httpClientBuilder -> { - String userName = Optional - .ofNullable(System.getProperty("user")) - .orElseThrow(() -> new RuntimeException("user name is missing")); - String password = Optional - .ofNullable(System.getProperty("password")) - .orElseThrow(() -> new RuntimeException("password is missing")); - CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); - credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(userName, password)); try { return httpClientBuilder - .setDefaultCredentialsProvider(credentialsProvider) // disable the certificate since our testing cluster just uses the default security configuration .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE) .setSSLContext(SSLContextBuilder.create().loadTrustMaterial(null, (chains, authType) -> true).build()); diff --git a/src/test/resources/security/sample.pem b/src/test/resources/security/sample.pem deleted file mode 100644 index b690a603..00000000 --- a/src/test/resources/security/sample.pem +++ /dev/null @@ -1,25 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEPDCCAySgAwIBAgIUaYSlET3nzsotWTrWueVPPh10yLYwDQYJKoZIhvcNAQEL -BQAwgY8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFt -cGxlMRkwFwYDVQQKDBBFeGFtcGxlIENvbSBJbmMuMSEwHwYDVQQLDBhFeGFtcGxl -IENvbSBJbmMuIFJvb3QgQ0ExITAfBgNVBAMMGEV4YW1wbGUgQ29tIEluYy4gUm9v -dCBDQTAeFw0yNDAyMjAxNzAzMjVaFw0zNDAyMTcxNzAzMjVaMFcxCzAJBgNVBAYT -AmRlMQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDARub2RlMQ0wCwYDVQQLDARub2Rl -MRswGQYDVQQDDBJub2RlLTAuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA -A4IBDwAwggEKAoIBAQCm93kXteDQHMAvbUPNPW5pyRHKDD42XGWSgq0k1D29C/Ud -yL21HLzTJa49ZU2ldIkSKs9JqbkHdyK0o8MO6L8dotLoYbxDWbJFW8bp1w6tDTU0 -HGkn47XVu3EwbfrTENg3jFu+Oem6a/501SzITzJWtS0cn2dIFOBimTVpT/4Zv5qr -XA6Cp4biOmoTYWhi/qQl8d0IaADiqoZ1MvZbZ6x76qTrRAbg+UWkpTEXoH1xTc8n -dibR7+HP6OTqCKvo1NhE8uP4pY+fWd6b6l+KLo3IKpfTbAIJXIO+M67FLtWKtttD -ao94B069skzKk6FPgW/OZh6PRCD0oxOavV+ld2SjAgMBAAGjgcYwgcMwRwYDVR0R -BEAwPogFKgMEBQWCEm5vZGUtMC5leGFtcGxlLmNvbYIJbG9jYWxob3N0hxAAAAAA -AAAAAAAAAAAAAAABhwR/AAABMAsGA1UdDwQEAwIF4DAdBgNVHSUEFjAUBggrBgEF -BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU0/qDQaY10jIo -wCjLUpz/HfQXyt8wHwYDVR0jBBgwFoAUF4ffoFrrZhKn1dD4uhJFPLcrAJwwDQYJ -KoZIhvcNAQELBQADggEBAGbij5WyF0dKhQodQfTiFDb73ygU6IyeJkFSnxF67gDz -pQJZKFvXuVBa3cGP5e7Qp3TK50N+blXGH0xXeIV9lXeYUk4hVfBlp9LclZGX8tGi -7Xa2enMvIt5q/Yg3Hh755ZxnDYxCoGkNOXUmnMusKstE0YzvZ5Gv6fcRKFBUgZLh -hUBqIEAYly1EqH/y45APiRt3Nor1yF6zEI4TnL0yNrHw6LyQkUNCHIGMJLfnJQ9L -camMGIXOx60kXNMTigF9oXXwixWAnDM9y3QT8QXA7hej/4zkbO+vIeV/7lGUdkyg -PAi92EvyxmsliEMyMR0VINl8emyobvfwa7oMeWMR+hg= ------END CERTIFICATE----- diff --git a/src/test/resources/security/test-kirk.jks b/src/test/resources/security/test-kirk.jks deleted file mode 100644 index 6c8c5ef7..00000000 Binary files a/src/test/resources/security/test-kirk.jks and /dev/null differ