[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on `all_shared_principals` #5600

cwperks · 2025-09-02T14:51:10Z

Description

This PR builds on the change in #5596 to use DLS to filter the results behind-the-scenes so that a resource plugin only needs to search on the resource index and only get results visible to the authenticated user in the result-set.

Take an example of a resource doc with all_shared_principals:

{
  "name": "sharedDashboard",
  "description": "A dashboard resource that is shared with multiple principals",
  "type": "dashboard",
  "created_at": "2025-09-02T14:30:00Z",
  "attributes": {
    "category": "analytics",
    "sensitivity": "internal"
  },
  "all_shared_principals": [
    "user:resource_sharing_test_user_alice",
    "user:resource_sharing_test_user_bob",
    "role:analytics_team",
    "role:all_access",
    "role:auditor"
  ]
}

With the changes in this PR, if a plugin goes to search on this index (for instance as part of an API handler to list the resources or search resources), then security will apply a filter to limit the result set to resource docs that are shared with the authenticated user. That is, docs that are either owned by the authenticated user, are public (convention user:*) or explicitly shared with the user directly with username or one of the user's roles.

An example of the DLS filter applied would be:

{"terms":{"all_shared_principals.keyword":["user:resource_sharing_test_user_alice","user:*","role:all_access","role:analytics_team","backend_role:Developers"]}}

Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Enhancement

Issues Resolved

Related to: #4500

Check List

New functionality includes testing
New functionality has been documented
New Roles/Permissions have a corresponding security dashboards plugin PR
API changes companion pull request created
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

…le for searching Signed-off-by: Craig Perkins <cwperx@amazon.com>

Signed-off-by: Craig Perkins <cwperx@amazon.com>

codecov · 2025-09-02T16:07:15Z

Codecov Report

❌ Patch coverage is 55.22388% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.89%. Comparing base (c51ce46) to head (8c58c37).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...rch/security/privileges/dlsfls/IndexToRuleMap.java	5.00%	19 Missing ⚠️
...search/security/configuration/DlsFlsValveImpl.java	65.00%	5 Missing and 2 partials ⚠️
...security/privileges/dlsfls/DocumentPrivileges.java	0.00%	3 Missing ⚠️
.../opensearch/security/OpenSearchSecurityPlugin.java	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5600      +/-   ##
==========================================
- Coverage   72.95%   72.89%   -0.07%     
==========================================
  Files         408      408              
  Lines       25314    25260      -54     
  Branches     3855     3861       +6     
==========================================
- Hits        18469    18414      -55     
- Misses       4970     4977       +7     
+ Partials     1875     1869       -6

Files with missing lines	Coverage Δ
.../actions/transport/GetResourceTransportAction.java	`90.47% <100.00%> (+1.79%)`	⬆️
...tions/transport/SearchResourceTransportAction.java	`100.00% <100.00%> (+36.36%)`	⬆️
...ecurity/resources/ResourceAccessControlClient.java	`77.77% <ø> (-4.05%)`	⬇️
...arch/security/resources/ResourceAccessHandler.java	`82.72% <ø> (+0.11%)`	⬆️
...ecurity/resources/ResourceSharingIndexHandler.java	`81.36% <ø> (+0.23%)`	⬆️
...g/opensearch/security/support/WildcardMatcher.java	`88.77% <100.00%> (+0.54%)`	⬆️
.../opensearch/security/OpenSearchSecurityPlugin.java	`85.00% <0.00%> (-0.11%)`	⬇️
...security/privileges/dlsfls/DocumentPrivileges.java	`90.74% <0.00%> (-5.34%)`	⬇️
...search/security/configuration/DlsFlsValveImpl.java	`64.66% <65.00%> (-0.67%)`	⬇️
...rch/security/privileges/dlsfls/IndexToRuleMap.java	`41.17% <5.00%> (-51.69%)`	⬇️

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cwperks · 2025-09-05T15:20:05Z

spi/src/main/java/org/opensearch/security/spi/resources/client/ResourceSharingClient.java

-     * @param resourceIndex The index containing the resources.
-     * @param listener The listener to be notified with the set of accessible resources.
-     */
-    void getAccessibleResourceIds(String resourceIndex, ActionListener<Set<String>> listener);


Makes sense. I'll add this back in until hierarchy is properly supported.

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java

DarshitChanpura · 2025-09-05T15:24:06Z

...ain/java/org/opensearch/sample/resource/actions/transport/SearchResourceTransportAction.java

-            src.query(QueryBuilders.boolQuery().filter(accessQB));
-            return;
-        }
+        pluginClient.search(request, listener);


we need to update plugin-dev documentation to declare plugin as IdentityAwarePlugin.

DarshitChanpura · 2025-09-05T15:25:11Z

spi/src/main/java/org/opensearch/security/spi/resources/client/ResourceSharingClient.java

-     * @param resourceIndex The index containing the resources.
-     * @param listener The listener to be notified with the set of accessible resources.
-     */
-    void getAccessibleResourceIds(String resourceIndex, ActionListener<Set<String>> listener);


ML uses modelGroupIds to filter search for models. We need to keep this here until we support hierarchy.

DarshitChanpura · 2025-09-05T15:26:17Z

src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java

-                dlsFlsBaseContext
+                dlsFlsBaseContext,
+                adminDns,
+                resourcePluginInfo != null ? resourcePluginInfo.getResourceIndices() : null


resourcePluginInfo will never be null since we instantiate it at class-level.

src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java

DarshitChanpura · 2025-09-05T15:28:21Z

src/main/java/org/opensearch/security/privileges/dlsfls/IndexToRuleMap.java

+            user.getRoles().forEach(r -> principals.add("role:" + r));
+        }
+
+        // Backend roles (LDAP/SAML/etc) – adjust getter name to your version!


nit: comment :D

DarshitChanpura · 2025-09-05T15:28:56Z

src/main/java/org/opensearch/security/privileges/dlsfls/IndexToRuleMap.java

+
+        List<String> principals = new ArrayList<>();
+        principals.add("user:*"); // Convention for publicly visible
+        principals.add("user:" + user.getName());


add a comment here like : // owner ?

DarshitChanpura · 2025-09-05T15:29:53Z

src/main/java/org/opensearch/security/privileges/dlsfls/IndexToRuleMap.java

+
+        // Build a single `terms` query JSON
+        String dlsJson = "{\"terms\":{\"all_shared_principals.keyword\":["
+            + principals.stream().map(p -> "\"" + p.replace("\"", "\\\"") + "\"").collect(Collectors.joining(","))


for my understanding why do we need .replace?

Its not needed. I'm going to refactor this to use XContentBuilder for json to avoid assembling json like this.

DarshitChanpura · 2025-09-05T15:31:32Z

src/main/java/org/opensearch/security/resources/ResourceAccessHandler.java

-     * @param resourceIndex The resource index to check for accessible resources.
-     * @param listener      The listener to be notified with the set of accessible resource IDs.
-     */
-    public void getOwnAndSharedResourceIdsForCurrentUser(@NonNull String resourceIndex, ActionListener<Set<String>> listener) {


same as above, we need to leave this as is to support ML.

DarshitChanpura · 2025-09-05T15:35:10Z

src/test/java/org/opensearch/security/resources/ResourceAccessHandlerTest.java

@@ -205,42 +205,6 @@ public void testHasPermission_pluginUserDenied() {
        verify(listener).onResponse(false);
    }

-    @Test
-    public void testGetOwnAndSharedResources_asAdmin() {


can leave this as is to test getAccessilbeResourceIds

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks · 2025-09-05T19:39:09Z

src/main/java/org/opensearch/security/privileges/ResourceAccessEvaluator.java

@@ -98,6 +99,7 @@ public boolean shouldEvaluate(ActionRequest request) {
            ConfigConstants.OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT
        );
        if (!isResourceSharingFeatureEnabled) return false;
+        if (request instanceof GetRequest) return false;


GetRequest needs to be skipped here as that is evaluated as a cluster permission.

cwperks · 2025-09-05T19:39:36Z

...onTest/java/org/opensearch/sample/resource/feature/enabled/multi_share/MixedAccessTests.java

+    }
+
+    @Test
+    public void multipleRoles_multipleLevels() {


Added an addition test here for sharing with role name.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks · 2025-09-05T19:51:35Z

src/main/java/org/opensearch/security/privileges/ResourceAccessEvaluator.java

@@ -99,6 +100,7 @@ public boolean shouldEvaluate(ActionRequest request) {
        );
        if (!isResourceSharingFeatureEnabled) return false;
        if (!(request instanceof DocRequest docRequest)) return false;
+        if (request instanceof GetRequest) return false;


Adding this here to handle the case where a plugin is making a GET Request to a system index using it's PluginSubject. In that case, the plugin should have permission to perform the GET, but because it wasn't being ignored here it was going through the resource access evaluation rather than the system index access evaluator.

cwperks added 17 commits August 26, 2025 15:54

WIP on tracking principals on the resource doc

f25ac34

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Update resource visibility in indexResourceSharing

746b239

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Update visibility when sharing

3b1f0fd

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Update in revoke as well

0bfc778

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Keep track of list of principals for which sharable resource is visib…

4aa049b

…le for searching Signed-off-by: Craig Perkins <cwperx@amazon.com>

Add to CHANGELOG

8bff6f3

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Merge branch 'main' into track-principals

6ef6d1f

Merge branch 'main' into track-principals

3d90774

Merge branch 'main' into track-principals

5f6e254

Rename to all_shared_principals

fee622b

Signed-off-by: Craig Perkins <cwperx@amazon.com>

WIP on RP DLS solution

373547e

Signed-off-by: Craig Perkins <cwperx@amazon.com>

WIP on resource restrictions

9cae246

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Get all resource plugin tests working

2cba16e

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Fix tests

21ae888

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Only on SearchRequest

2613852

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Only apply DLS if all indices in the request are resource indices

3c9ceec

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Handle publicly visible

f532d8e

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks changed the title ~~Use DLS to automatically filter sharable resources for authenticated user base on all_shared_principals~~ Use DLS to automatically filter sharable resources for authenticated user based on all_shared_principals Sep 2, 2025

cwperks changed the title ~~Use DLS to automatically filter sharable resources for authenticated user based on all_shared_principals~~ [Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on all_shared_principals Sep 2, 2025

cwperks added 2 commits September 2, 2025 11:41

Fix CHANGELOG

f539295

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Merge branch 'main' into track-principals-dls

ca58fa1

cwperks commented Sep 5, 2025

View reviewed changes

DarshitChanpura reviewed Sep 5, 2025

View reviewed changes

cwperks added 6 commits September 5, 2025 13:41

Merge branch 'main' into track-principals-dls

956487d

Remove sysouts

8c58c37

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Address review feedback

7ceafa8

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Re-add to client

f6519f0

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Use pluginClient in get

ddb9a7c

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Change to SecurityRoles

7e10713

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Add new test for sharing with roles

a3b3511

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks commented Sep 5, 2025

View reviewed changes

Re-arrange

b663a0e

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks commented Sep 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on `all_shared_principals` #5600

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on `all_shared_principals` #5600

cwperks commented Sep 2, 2025 •

edited

Loading

Uh oh!

codecov bot commented Sep 2, 2025 •

edited

Loading

Uh oh!

cwperks Sep 5, 2025

Uh oh!

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

cwperks Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

DarshitChanpura Sep 5, 2025

Uh oh!

cwperks Sep 5, 2025

Uh oh!

cwperks Sep 5, 2025

Uh oh!

cwperks Sep 5, 2025

Uh oh!

Uh oh!

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on all_shared_principals #5600

Are you sure you want to change the base?

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on all_shared_principals #5600

Conversation

cwperks commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Check List

Uh oh!

codecov bot commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on `all_shared_principals` #5600

[Resource Sharing] Use DLS to automatically filter sharable resources for authenticated user based on `all_shared_principals` #5600

cwperks commented Sep 2, 2025 •

edited

Loading

codecov bot commented Sep 2, 2025 •

edited

Loading