elastic/elasticsearch

migrate tool throws a NPE when user exists without role

Open

#29,837 opened on Nov 13, 2017

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Java (76,700 stars) (25,882 forks)batch import
:Security/Authentication>bugTeam:Securityhelp wanted

Description

Original comment by @PhaedrusTheGreek:

Pretty easy to reproduce:

$ bin/x-pack/users useradd testguy
$ bin/x-pack/users useradd testguy2 -r admin
$ bin/x-pack/migrate native -U http://localhost:9200 -u elastic -p changeme
starting migration of users and roles...
importing users from [/Users/jay/workspace/elasticsearch-5.6.4/config/x-pack/users]...
found existing users: [logstash, logstash_system, elsearch_watcher, elastic, es_admin, kibanaadmin, kibana]
migrating user [testguy2]
{"user":{"created":true}}
migrating user [testguy]
Exception in thread "main" ElasticsearchException[failed to migrate user [testguy] with body: n/a]; nested: NullPointerException;
	at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.importUsers(ESNativeRealmMigrateTool.java:289)
	at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.execute(ESNativeRealmMigrateTool.java:143)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:70)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
	at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:69)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
	at org.elasticsearch.cli.Command.main(Command.java:90)
	at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool.main(ESNativeRealmMigrateTool.java:91)
Caused by: java.lang.NullPointerException
	at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.createUserJson(ESNativeRealmMigrateTool.java:240)
	at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.importUsers(ESNativeRealmMigrateTool.java:284)
	... 7 more

Contributor guide

Tech stack
java
Domain
backendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
JavaElasticsearch basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the stack trace in ESNativeRealmMigrateTool.java lines 240 and 289. The NullPointerException occurs when a user without a role is migrated. The method createUserJson likely assumes a non null role. Look at how users are parsed from the file and how roles are assigned. A fix would involve handling the case where a user has no role, likely by assigning an empty list or skipping the role mapping.