Module org.elasticsearch.security

Package org.elasticsearch.xpack.security.authz.store

Class CompositeRolesStore

java.lang.Object

org.elasticsearch.xpack.security.authz.store.CompositeRolesStore

public class CompositeRolesStore
extends Object

A composite roles store that can retrieve roles from multiple sources.

See Also:

• RoleProviders

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static final record	CompositeRolesStore.ProjectScoped<T>	A wrapper class to apply a project-id to another object.

Constructor Summary

Constructors

Constructor

Description

CompositeRolesStore(Settings settings, ClusterService clusterService, RoleProviders roleProviders, NativePrivilegeStore privilegeStore, ThreadContext threadContext, XPackLicenseState licenseState, FieldPermissionsCache fieldPermissionsCache, ApiKeyService apiKeyService, ServiceAccountService serviceAccountService, ProjectResolver projectResolver, DocumentSubsetBitsetCache dlsBitsetCache, RestrictedIndices restrictedIndices, Executor roleBuildingExecutor, Consumer<Collection<RoleDescriptor>> effectiveRoleDescriptorsConsumer, List<ImplicitPrivilegesProvider> implicitPrivilegesProviders)

Method Summary

Modifier and Type	Method	Description
void	addImplicitPrivilegesToRoles(Collection<RoleDescriptor> roleDescriptors, ActionListener<Collection<RoleDescriptor>> listener)	Decorates each of the given role descriptors with the implicit index privileges its own application privileges would yield, returning a descriptor per input role.
static void	buildRoleFromDescriptors(Collection<RoleDescriptor> roleDescriptors, FieldPermissionsCache fieldPermissionsCache, NativePrivilegeStore privilegeStore, RestrictedIndices restrictedIndices, ActionListener<Role> listener, List<ImplicitPrivilegesProvider> implicitPrivilegesProviders, boolean dlsFlsEnabled)
void	buildRoleFromRoleReference(RoleReference roleReference, ProjectId projectId, ActionListener<Role> roleActionListener)
protected Role	getInternalUserRole(InternalUser user)
void	getRole(Subject subject, ActionListener<Role> roleActionListener)
void	getRoleDescriptors(Subject subject, ActionListener<Set<RoleDescriptor>> listener)
void	getRoles(Authentication authentication, ActionListener<Tuple<Role,Role>> roleActionListener)
static List<Setting<?>>	getSettings()
void	invalidate(String role)
void	invalidateAll()
void	invalidateClusterScopedRoles(Set<String> roles)
void	invalidateProject()
void	invalidateProject(ProjectId projectId)
void	onSecurityIndexStateChange(ProjectId projectId, SecurityIndexManager.IndexState previousState, SecurityIndexManager.IndexState currentState)
void	usageStats(ActionListener<Map<String,Object>> listener)
Map<String,Object>	usageStatsWithJustDls()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CompositeRolesStore

public CompositeRolesStore(Settings settings,
 ClusterService clusterService,
 RoleProviders roleProviders,
 NativePrivilegeStore privilegeStore,
 ThreadContext threadContext,
 XPackLicenseState licenseState,
 FieldPermissionsCache fieldPermissionsCache,
 ApiKeyService apiKeyService,
 ServiceAccountService serviceAccountService,
 ProjectResolver projectResolver,
 DocumentSubsetBitsetCache dlsBitsetCache,
 RestrictedIndices restrictedIndices,
 Executor roleBuildingExecutor,
 Consumer<Collection<RoleDescriptor>> effectiveRoleDescriptorsConsumer,
 List<ImplicitPrivilegesProvider> implicitPrivilegesProviders)

Method Details

getRoles

public void getRoles(Authentication authentication,
 ActionListener<Tuple<Role,Role>> roleActionListener)

getRole

public void getRole(Subject subject,
 ActionListener<Role> roleActionListener)

getInternalUserRole

protected Role getInternalUserRole(InternalUser user)

buildRoleFromRoleReference

public void buildRoleFromRoleReference(RoleReference roleReference,
 ProjectId projectId,
 ActionListener<Role> roleActionListener)

getRoleDescriptors

public void getRoleDescriptors(Subject subject,
 ActionListener<Set<RoleDescriptor>> listener)

buildRoleFromDescriptors

public static void buildRoleFromDescriptors(Collection<RoleDescriptor> roleDescriptors,
 FieldPermissionsCache fieldPermissionsCache,
 NativePrivilegeStore privilegeStore,
 RestrictedIndices restrictedIndices,
 ActionListener<Role> listener,
 List<ImplicitPrivilegesProvider> implicitPrivilegesProviders,
 boolean dlsFlsEnabled)

addImplicitPrivilegesToRoles

public void addImplicitPrivilegesToRoles(Collection<RoleDescriptor> roleDescriptors,
 ActionListener<Collection<RoleDescriptor>> listener)

Decorates each of the given role descriptors with the implicit index privileges its own application privileges would yield, returning a descriptor per input role. This backs the include_implicit option of the get-role API, whose response lists each role separately, so implicit privileges must be attributable to an individual role.

Accordingly, ImplicitPrivilegesProviders are invoked per role descriptor here — each sees only that descriptor's resolved application privileges. This differs from runtime role building (see buildRoleFromDescriptors(java.util.Collection<org.elasticsearch.xpack.core.security.authz.RoleDescriptor>, org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache, org.elasticsearch.xpack.security.authz.store.NativePrivilegeStore, org.elasticsearch.xpack.core.security.authz.RestrictedIndices, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authz.permission.Role>, java.util.List<org.elasticsearch.xpack.core.security.authz.privilege.ImplicitPrivilegesProvider>, boolean)), where a provider is invoked once with the union of application privileges across all of the user's roles. For a provider whose grants depend on combining application privileges from different roles, the implicit privileges reported for a role in isolation may therefore be a subset of what the user is granted at runtime. This divergence is intentional and part of the get-role API contract; see ImplicitPrivilegesProvider.

invalidateProject

public void invalidateProject()

invalidateProject

public void invalidateProject(ProjectId projectId)

invalidateAll

public void invalidateAll()

invalidate

public void invalidate(String role)

invalidateClusterScopedRoles

public void invalidateClusterScopedRoles(Set<String> roles)

usageStatsWithJustDls

public Map<String,Object> usageStatsWithJustDls()

usageStats

public void usageStats(ActionListener<Map<String,Object>> listener)

onSecurityIndexStateChange

public void onSecurityIndexStateChange(ProjectId projectId,
 SecurityIndexManager.IndexState previousState,
 SecurityIndexManager.IndexState currentState)

getSettings

public static List<Setting<?>> getSettings()