Add Alias Permission in Security Tests (#1245) (#1248)

The SecureADRestIT.testCreateAnomalyDetectorWithCustomResultIndex test failed because the cat user did not have the necessary permissions to create an alias, as the current custom index name is an alias. This PR addresses this issue by adding the required alias permission. Additionally, this PR includes other tests to improve test coverage. Testing: * Verified that all security tests pass. (cherry picked from commit b9eff78) Signed-off-by: Kaituo Li <kaituo@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Jun 13, 2024 · f6d262e · f6d262e
1 parent e1bb2f5
commit f6d262e
Show file tree

Hide file tree

Showing 13 changed files with 457 additions and 29 deletions.
diff --git a/src/test/java/org/opensearch/ad/AnomalyDetectorJobRunnerTests.java b/src/test/java/org/opensearch/ad/AnomalyDetectorJobRunnerTests.java
@@ -221,7 +221,7 @@ public void setup() throws Exception {
             ActionListener<GetResponse> listener = (ActionListener<GetResponse>) args[1];
 
             if (request.index().equals(CommonName.JOB_INDEX)) {
-                Job job = TestHelpers.randomAnomalyDetectorJob(true);
+                Job job = TestHelpers.randomJob(true);
                 listener.onResponse(TestHelpers.createGetResponse(job, randomAlphaOfLength(5), CommonName.JOB_INDEX));
             }
             return null;
@@ -788,7 +788,7 @@ public void testMarkResultIndexQueried() throws IOException {
 
         doAnswer(invocation -> {
             ActionListener<Optional<Job>> listener = invocation.getArgument(1);
-            listener.onResponse(Optional.of(TestHelpers.randomAnomalyDetectorJob(true, Instant.ofEpochMilli(1602401500000L), null)));
+            listener.onResponse(Optional.of(TestHelpers.randomJob(true, Instant.ofEpochMilli(1602401500000L), null)));
             return null;
         }).when(nodeStateManager).getJob(any(String.class), any(ActionListener.class));
 

diff --git a/src/test/java/org/opensearch/ad/AnomalyDetectorProfileRunnerTests.java b/src/test/java/org/opensearch/ad/AnomalyDetectorProfileRunnerTests.java
@@ -147,11 +147,11 @@ private void setUpClientGet(
                         listener.onFailure(new IndexNotFoundException(CommonName.JOB_INDEX));
                         break;
                     case DISABLED:
-                        job = TestHelpers.randomAnomalyDetectorJob(false, jobEnabledTime, null);
+                        job = TestHelpers.randomJob(false, jobEnabledTime, null);
                         listener.onResponse(TestHelpers.createGetResponse(job, detector.getId(), CommonName.JOB_INDEX));
                         break;
                     case ENABLED:
-                        job = TestHelpers.randomAnomalyDetectorJob(true, jobEnabledTime, null);
+                        job = TestHelpers.randomJob(true, jobEnabledTime, null);
                         listener.onResponse(TestHelpers.createGetResponse(job, detector.getId(), CommonName.JOB_INDEX));
                         break;
                     default:

diff --git a/src/test/java/org/opensearch/ad/AnomalyDetectorRestTestCase.java b/src/test/java/org/opensearch/ad/AnomalyDetectorRestTestCase.java
@@ -485,7 +485,8 @@ public Response createIndexRole(String role, String index) throws IOException {
                             + "\"masked_fields\": [],\n"
                             + "\"allowed_actions\": [\n"
                             + "\"crud\",\n"
-                            + "\"indices:admin/create\"\n"
+                            + "\"indices:admin/create\",\n"
+                            + "\"indices:admin/aliases\"\n"
                             + "]\n"
                             + "}\n"
                             + "],\n"

diff --git a/src/test/java/org/opensearch/ad/EntityProfileRunnerTests.java b/src/test/java/org/opensearch/ad/EntityProfileRunnerTests.java
@@ -126,7 +126,7 @@ public void setUp() throws Exception {
 
         categoryField = "a";
         detector = TestHelpers.randomAnomalyDetectorUsingCategoryFields(detectorId, Arrays.asList(categoryField));
-        job = TestHelpers.randomAnomalyDetectorJob(true);
+        job = TestHelpers.randomJob(true);
 
         requiredSamples = 128;
         client = mock(Client.class);

diff --git a/src/test/java/org/opensearch/ad/MultiEntityProfileRunnerTests.java b/src/test/java/org/opensearch/ad/MultiEntityProfileRunnerTests.java
@@ -129,7 +129,7 @@ public void setUp() throws Exception {
         detectorId = "A69pa3UBHuCbh-emo9oR";
         detector = TestHelpers.randomAnomalyDetectorUsingCategoryFields(detectorId, Arrays.asList("a"));
         result = new DetectorInternalState.Builder().lastUpdateTime(Instant.now());
-        job = TestHelpers.randomAnomalyDetectorJob(true);
+        job = TestHelpers.randomJob(true);
         adTaskManager = mock(ADTaskManager.class);
         transportService = mock(TransportService.class);
         doAnswer(invocation -> {

diff --git a/src/test/java/org/opensearch/ad/model/AnomalyDetectorJobTests.java b/src/test/java/org/opensearch/ad/model/AnomalyDetectorJobTests.java
@@ -39,7 +39,7 @@ protected NamedWriteableRegistry writableRegistry() {
     }
 
     public void testParseAnomalyDetectorJob() throws IOException {
-        Job anomalyDetectorJob = TestHelpers.randomAnomalyDetectorJob();
+        Job anomalyDetectorJob = TestHelpers.randomJob();
         String anomalyDetectorJobString = TestHelpers
             .xContentBuilderToString(anomalyDetectorJob.toXContent(TestHelpers.builder(), ToXContent.EMPTY_PARAMS));
         anomalyDetectorJobString = anomalyDetectorJobString
@@ -50,7 +50,7 @@ public void testParseAnomalyDetectorJob() throws IOException {
     }
 
     public void testSerialization() throws IOException {
-        Job anomalyDetectorJob = TestHelpers.randomAnomalyDetectorJob();
+        Job anomalyDetectorJob = TestHelpers.randomJob();
         BytesStreamOutput output = new BytesStreamOutput();
         anomalyDetectorJob.writeTo(output);
         NamedWriteableAwareStreamInput input = new NamedWriteableAwareStreamInput(output.bytes().streamInput(), writableRegistry());

diff --git a/src/test/java/org/opensearch/ad/rest/SecureADRestIT.java b/src/test/java/org/opensearch/ad/rest/SecureADRestIT.java
@@ -409,7 +409,11 @@ public void testCreateAnomalyDetectorWithCustomResultIndex() throws IOException
         AnomalyDetector detector = cloneDetector(anomalyDetector, resultIndex);
         // User goat has no permission to create index
         Exception exception = expectThrows(IOException.class, () -> { createAnomalyDetector(detector, true, goatClient); });
-        Assert.assertTrue(exception.getMessage().contains("no permissions for [indices:admin/create]"));
+        Assert
+            .assertTrue(
+                "got " + exception.getMessage(),
+                exception.getMessage().contains("no permissions for [indices:admin/aliases, indices:admin/create]")
+            );
 
         // User cat has permission to create index
         resultIndex = ADCommonName.CUSTOM_RESULT_INDEX_PREFIX + "test2";

diff --git a/src/test/java/org/opensearch/ad/transport/GetAnomalyDetectorResponseTests.java b/src/test/java/org/opensearch/ad/transport/GetAnomalyDetectorResponseTests.java
@@ -101,7 +101,7 @@ private GetAnomalyDetectorResponse createGetAnomalyDetectorResponse(boolean retu
             randomLong(),
             randomLong(),
             TestHelpers.randomAnomalyDetector(ImmutableList.of(), ImmutableMap.of(), Instant.now().truncatedTo(ChronoUnit.SECONDS)),
-            TestHelpers.randomAnomalyDetectorJob(),
+            TestHelpers.randomJob(),
             returnJob,
             TestHelpers.randomAdTask(),
             TestHelpers.randomAdTask(),

diff --git a/src/test/java/org/opensearch/ad/transport/GetAnomalyDetectorTransportActionTests.java b/src/test/java/org/opensearch/ad/transport/GetAnomalyDetectorTransportActionTests.java
@@ -171,7 +171,7 @@ public void testGetAnomalyDetectorRequestNoEntityValue() throws IOException {
     public void testGetAnomalyDetectorResponse() throws IOException {
         BytesStreamOutput out = new BytesStreamOutput();
         AnomalyDetector detector = TestHelpers.randomAnomalyDetector(ImmutableMap.of("testKey", "testValue"), Instant.now());
-        Job adJob = TestHelpers.randomAnomalyDetectorJob();
+        Job adJob = TestHelpers.randomJob();
         GetAnomalyDetectorResponse response = new GetAnomalyDetectorResponse(
             4321,
             "1234",
@@ -205,7 +205,7 @@ public void testGetAnomalyDetectorResponse() throws IOException {
     public void testGetAnomalyDetectorProfileResponse() throws IOException {
         BytesStreamOutput out = new BytesStreamOutput();
         AnomalyDetector detector = TestHelpers.randomAnomalyDetector(ImmutableMap.of("testKey", "testValue"), Instant.now());
-        Job adJob = TestHelpers.randomAnomalyDetectorJob();
+        Job adJob = TestHelpers.randomJob();
         InitProgressProfile initProgress = new InitProgressProfile("99%", 2L, 2);
         EntityProfile entityProfile = new EntityProfile.Builder().initProgress(initProgress).build();
         GetAnomalyDetectorResponse response = new GetAnomalyDetectorResponse(