elastic/elasticsearch

Security BWC tests with more complex cluster topologies

Open

#30,109 opened on Sep 28, 2017

View on GitHub
 (3 comments) (0 reactions) (0 assignees)Java (76,700 stars) (25,882 forks)batch import
:Security/Security>testTeam:Securityhelp wanted

Description

Original comment by @tvernum:

The change to introduce the _xpack_security system user (LINK REDACTED) seems to have had a couple of different BWC issues that weren't picked up by our tests.

  1. If a new node, tried to load security data from an old node, it would try to use the new user and fail because the old node didn't recognise the _xpack_security system user. (Fixed in LINK REDACTED) LINK REDACTED

  2. If an old node tried to load security data from a new node, it would try to use the old user and fail because the older user no longer has permission to read security data. (Also fixed in LINK REDACTED) LINK REDACTED

It would be helpful to have some security tests that run with the sorts of more complex cluster setups (dedicated coordinating nodes, dedicated master nodes) that pull out these issues.

Contributor guide

Tech stack
java
Domain
testingsecurity
Issue type
test
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Understanding of Elasticsearch securityKnowledge of BWC testingJava programming
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
15
Research direction
Review the linked fixes in the issue description to understand the two BWC problems. Examine existing security test suites in the Elasticsearch codebase, particularly those related to system users and cluster topology. The comments may provide additional context. Focus on designing tests that simulate cluster topologies with dedicated coordinating and master nodes to reproduce the described issues.