Reuse FieldPermissionsCache in Role parsing

docs/changelog/94931.yaml

@@ -0,0 +1,5 @@
+pr: 94931
+summary: Reuse `FieldPermissionsCache` in Role parsing
+area: Authorization
+type: enhancement
+issues: []

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptor.java

@@ -30,7 +30,7 @@
 import org.elasticsearch.xcontent.XContentType;
 import org.elasticsearch.xcontent.json.JsonXContent;
 import org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.PrivilegesToCheck;
-import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions;
+import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
 import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
 import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivileges;
 import org.elasticsearch.xpack.core.security.support.Validation;
@@ -857,7 +857,7 @@ private static ConfigurableClusterPrivilege[] sortConfigurableClusterPrivileges(
 
  private static void checkIfExceptFieldsIsSubsetOfGrantedFields(String roleName, String[] grantedFields, String[] deniedFields) {
  try {
- FieldPermissions.buildPermittedFieldsAutomaton(grantedFields, deniedFields);
+ FieldPermissionsCache.resolve(grantedFields, deniedFields);
  } catch (ElasticsearchSecurityException e) {
  throw new ElasticsearchParseException("failed to parse indices privileges for role [{}] - {}", e, roleName, e.getMessage());
  }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissionsCache.java

@@ -6,6 +6,7 @@
  */
 package org.elasticsearch.xpack.core.security.authz.permission;
 
+import org.apache.lucene.util.SetOnce;
 import org.apache.lucene.util.automaton.Automaton;
 import org.elasticsearch.ElasticsearchException;
 import org.elasticsearch.common.cache.Cache;
@@ -33,6 +34,8 @@
  */
 public final class FieldPermissionsCache {
 
+ private static final SetOnce<FieldPermissionsCache> INSTANCE = new SetOnce<>();
+
  public static final Setting<Long> CACHE_SIZE_SETTING = Setting.longSetting(
  setting("authz.store.roles.field_permissions.cache.max_size_in_bytes"),
  100 * 1024 * 1024,
@@ -41,13 +44,37 @@ public final class FieldPermissionsCache {
  );
  private final Cache<FieldPermissionsDefinition, FieldPermissions> cache;
 
+ public static FieldPermissionsCache init(Settings settings) {
+ final FieldPermissionsCache cache = new FieldPermissionsCache(settings);
+ INSTANCE.set(cache);
+ return cache;
+ }
+
+ public static FieldPermissionsCache getCache() {
+ return INSTANCE.get();
+ }
+
+ public Cache.CacheStats getCacheStats() {
+ return cache.stats();
+ }
+
  public FieldPermissionsCache(Settings settings) {
  this.cache = CacheBuilder.<FieldPermissionsDefinition, FieldPermissions>builder()
  .setMaximumWeight(CACHE_SIZE_SETTING.get(settings))
  .weigher((key, fieldPermissions) -> fieldPermissions.ramBytesUsed())
  .build();
  }
 
+ public static FieldPermissions resolve(String[] grantedFields, String[] deniedFields) {
+ final FieldPermissionsDefinition definition = new FieldPermissionsDefinition(grantedFields, deniedFields);
+ final FieldPermissionsCache cache = INSTANCE.get();
+ if (cache == null) {
+ return new FieldPermissions(definition);
+ } else {
+ return cache.getFieldPermissions(definition);
+ }
+ }
+
  /**
  * Gets a {@link FieldPermissions} instance that corresponds to the granted and denied parameters. The instance may come from the cache
  * or if it gets created, the instance will be cached

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/RoleDescriptorTests.java

@@ -11,11 +11,13 @@
 import org.elasticsearch.common.Strings;
 import org.elasticsearch.common.bytes.BytesArray;
 import org.elasticsearch.common.bytes.BytesReference;
+import org.elasticsearch.common.cache.Cache;
 import org.elasticsearch.common.io.stream.ByteBufferStreamInput;
 import org.elasticsearch.common.io.stream.BytesStreamOutput;
 import org.elasticsearch.common.io.stream.NamedWriteableAwareStreamInput;
 import org.elasticsearch.common.io.stream.NamedWriteableRegistry;
 import org.elasticsearch.common.io.stream.StreamInput;
+import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.common.util.set.Sets;
 import org.elasticsearch.common.xcontent.XContentHelper;
 import org.elasticsearch.test.ESTestCase;
@@ -27,6 +29,7 @@
 import org.elasticsearch.xcontent.XContentType;
 import org.elasticsearch.xpack.core.XPackClientPlugin;
 import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.ApplicationResourcePrivileges;
+import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
 import org.elasticsearch.xpack.core.security.authz.privilege.ClusterPrivilegeResolver;
 import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
 import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivileges;
@@ -394,6 +397,52 @@ public void testParse() throws Exception {
  assertThat(ex.getMessage(), containsString("not_supported"));
  }
 
+ public void testParsingFieldPermissionsUsesCache() throws IOException {
+ FieldPermissionsCache fieldPermissionsCache = FieldPermissionsCache.getCache();
+ if (fieldPermissionsCache == null) {
+ fieldPermissionsCache = FieldPermissionsCache.init(Settings.EMPTY);
+ }
+
+ final Cache.CacheStats beforeStats = fieldPermissionsCache.getCacheStats();
+
+ final String json = """
+ {
+ "index": [
+ {
+ "names": "index-001",
+ "privileges": [ "read" ],
+ "field_security": {
+ "grant": [ "field-001", "field-002" ]
+ }
+ },
+ {
+ "names": "index-001",
+ "privileges": [ "read" ],
+ "field_security": {
+ "grant": [ "*" ],
+ "except": [ "field-003" ]
+ }
+ }
+ ]
+ }
+ """;
+ RoleDescriptor.parse("test", new BytesArray(json), false, XContentType.JSON);
+
+ final int numberOfFieldSecurityBlocks = 2;
+ final Cache.CacheStats betweenStats = fieldPermissionsCache.getCacheStats();
+ assertThat(betweenStats.getMisses(), equalTo(beforeStats.getMisses() + numberOfFieldSecurityBlocks));
+ assertThat(betweenStats.getHits(), equalTo(beforeStats.getHits()));
+
+ final int iterations = randomIntBetween(1, 5);
+ for (int i = 0; i < iterations; i++) {
+ RoleDescriptor.parse("test", new BytesArray(json), false, XContentType.JSON);
+ }
+
+ final Cache.CacheStats afterStats = fieldPermissionsCache.getCacheStats();
+ assertThat(afterStats.getMisses(), equalTo(betweenStats.getMisses()));
+ assertThat(afterStats.getHits(), equalTo(beforeStats.getHits() + numberOfFieldSecurityBlocks * iterations));
+ }
+
  public void testSerializationForCurrentVersion() throws Exception {
  final TransportVersion version = TransportVersionUtils.randomCompatibleVersion(random());
  final boolean canIncludeRemoteIndices = version.onOrAfter(RoleDescriptor.TRANSPORT_VERSION_REMOTE_INDICES);

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -742,7 +742,7 @@ Collection<Object> createComponents(
  components.add(privilegeStore);
 
  dlsBitsetCache.set(new DocumentSubsetBitsetCache(settings, threadPool));
- final FieldPermissionsCache fieldPermissionsCache = new FieldPermissionsCache(settings);
+ final FieldPermissionsCache fieldPermissionsCache = FieldPermissionsCache.init(settings);
  final FileRolesStore fileRolesStore = new FileRolesStore(
  settings,
  environment,
@@ -910,6 +910,7 @@ Collection<Object> createComponents(
  final AuthorizationService authzService = new AuthorizationService(
  settings,
  allRolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  failureHandler,

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java

@@ -65,6 +65,7 @@
 import org.elasticsearch.xpack.core.security.authz.RestrictedIndices;
 import org.elasticsearch.xpack.core.security.authz.RoleDescriptorsIntersection;
 import org.elasticsearch.xpack.core.security.authz.accesscontrol.IndicesAccessControl;
+import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
 import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilegeDescriptor;
 import org.elasticsearch.xpack.core.security.authz.privilege.ClusterPrivilegeResolver;
 import org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege;
@@ -140,6 +141,7 @@ public class AuthorizationService {
  public AuthorizationService(
  Settings settings,
  CompositeRolesStore rolesStore,
+ FieldPermissionsCache fieldPermissionsCache,
  ClusterService clusterService,
  AuditTrailService auditTrailService,
  AuthenticationFailureHandler authcFailureHandler,
@@ -165,6 +167,7 @@ public AuthorizationService(
  this.rbacEngine = new RBACEngine(
  settings,
  rolesStore,
+ fieldPermissionsCache,
  new LoadAuthorizedIndicesTimeChecker.Factory(logger, settings, clusterService.getClusterSettings())
  );
  this.authorizationEngine = authorizationEngine == null ? this.rbacEngine : authorizationEngine;

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/RBACEngine.java

@@ -128,11 +128,12 @@ public class RBACEngine implements AuthorizationEngine {
  public RBACEngine(
  Settings settings,
  CompositeRolesStore rolesStore,
+ FieldPermissionsCache fieldPermissionsCache,
  LoadAuthorizedIndicesTimeChecker.Factory authzIndicesTimerFactory
  ) {
  this.settings = settings;
  this.rolesStore = rolesStore;
- this.fieldPermissionsCache = new FieldPermissionsCache(settings);
+ this.fieldPermissionsCache = fieldPermissionsCache;
  this.authzIndicesTimerFactory = authzIndicesTimerFactory;
  }
 

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizationServiceTests.java

@@ -237,6 +237,7 @@ public class AuthorizationServiceTests extends ESTestCase {
  private ThreadPool threadPool;
  private Map<String, RoleDescriptor> roleMap = new HashMap<>();
  private CompositeRolesStore rolesStore;
+ private FieldPermissionsCache fieldPermissionsCache;
  private OperatorPrivileges.OperatorPrivilegesService operatorPrivilegesService;
  private boolean shouldFailOperatorPrivilegesCheck = false;
  private boolean setFakeOriginatingAction = true;
@@ -245,6 +246,7 @@ public class AuthorizationServiceTests extends ESTestCase {
  @SuppressWarnings("unchecked")
  @Before
  public void setup() {
+ fieldPermissionsCache = new FieldPermissionsCache(Settings.EMPTY);
  rolesStore = mock(CompositeRolesStore.class);
  clusterService = mock(ClusterService.class);
  final Settings settings = Settings.builder().put("cluster.remote.other_cluster.seeds", "localhost:9999").build();
@@ -292,6 +294,7 @@ public void setup() {
  authorizationService = new AuthorizationService(
  settings,
  rolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  new DefaultAuthenticationFailureHandler(Collections.emptyMap()),
@@ -1626,6 +1629,7 @@ public void testDenialForAnonymousUser() {
  authorizationService = new AuthorizationService(
  settings,
  rolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  new DefaultAuthenticationFailureHandler(Collections.emptyMap()),
@@ -1673,6 +1677,7 @@ public void testDenialForAnonymousUserAuthorizationExceptionDisabled() {
  authorizationService = new AuthorizationService(
  settings,
  rolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  new DefaultAuthenticationFailureHandler(Collections.emptyMap()),
@@ -2768,6 +2773,7 @@ public void testAuthorizationEngineSelectionForCheckPrivileges() throws Exceptio
  authorizationService = new AuthorizationService(
  Settings.EMPTY,
  rolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  new DefaultAuthenticationFailureHandler(Collections.emptyMap()),
@@ -2922,6 +2928,7 @@ public void getUserPrivileges(AuthorizationInfo authorizationInfo, ActionListene
  authorizationService = new AuthorizationService(
  Settings.EMPTY,
  rolesStore,
+ fieldPermissionsCache,
  clusterService,
  auditTrailService,
  new DefaultAuthenticationFailureHandler(Collections.emptyMap()),

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java

@@ -157,7 +157,7 @@ public void createEngine() {
  final LoadAuthorizedIndicesTimeChecker.Factory timerFactory = mock(LoadAuthorizedIndicesTimeChecker.Factory.class);
  when(timerFactory.newTimer(any())).thenReturn(LoadAuthorizedIndicesTimeChecker.NO_OP_CONSUMER);
  rolesStore = mock(CompositeRolesStore.class);
- engine = new RBACEngine(Settings.EMPTY, rolesStore, timerFactory);
+ engine = new RBACEngine(Settings.EMPTY, rolesStore, new FieldPermissionsCache(Settings.EMPTY), timerFactory);
  }
 
  public void testResolveAuthorizationInfoForEmptyRolesWithAuthentication() {