|
@@ -7,10 +7,9 @@ package org.elasticsearch.upgrades;
|
|
|
|
|
|
import org.apache.http.HttpHeaders;
|
|
|
import org.apache.http.HttpHost;
|
|
|
-import org.apache.http.entity.ContentType;
|
|
|
-import org.apache.http.entity.StringEntity;
|
|
|
-import org.apache.http.message.BasicHeader;
|
|
|
import org.elasticsearch.Version;
|
|
|
+import org.elasticsearch.client.Request;
|
|
|
+import org.elasticsearch.client.RequestOptions;
|
|
|
import org.elasticsearch.client.Response;
|
|
|
import org.elasticsearch.client.ResponseException;
|
|
|
import org.elasticsearch.client.RestClient;
|
|
@@ -18,7 +17,6 @@ import org.elasticsearch.test.rest.yaml.ObjectPath;
|
|
|
|
|
|
import java.io.IOException;
|
|
|
import java.util.ArrayList;
|
|
|
-import java.util.Collections;
|
|
|
import java.util.List;
|
|
|
import java.util.Map;
|
|
|
|
|
@@ -26,43 +24,46 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
|
|
|
public void testGeneratingTokenInOldCluster() throws Exception {
|
|
|
assumeTrue("this test should only run against the old cluster", CLUSTER_TYPE == ClusterType.OLD);
|
|
|
- final StringEntity tokenPostBody = new StringEntity("{\n" +
|
|
|
+ Request createTokenRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ createTokenRequest.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"username\": \"test_user\",\n" +
|
|
|
" \"password\": \"x-pack-test-password\",\n" +
|
|
|
" \"grant_type\": \"password\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- Response response = client().performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenPostBody);
|
|
|
+ "}");
|
|
|
+ Response response = client().performRequest(createTokenRequest);
|
|
|
assertOK(response);
|
|
|
Map<String, Object> responseMap = entityAsMap(response);
|
|
|
String token = (String) responseMap.get("access_token");
|
|
|
assertNotNull(token);
|
|
|
assertTokenWorks(token);
|
|
|
|
|
|
- StringEntity oldClusterToken = new StringEntity("{\n" +
|
|
|
+ Request indexRequest1 = new Request("PUT", "token_backwards_compatibility_it/doc/old_cluster_token1");
|
|
|
+ indexRequest1.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"token\": \"" + token + "\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- Response indexResponse = client().performRequest("PUT", "token_backwards_compatibility_it/doc/old_cluster_token1",
|
|
|
- Collections.emptyMap(), oldClusterToken);
|
|
|
- assertOK(indexResponse);
|
|
|
+ "}");
|
|
|
+ client().performRequest(indexRequest1);
|
|
|
|
|
|
- response = client().performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenPostBody);
|
|
|
- assertOK(response);
|
|
|
+ Request createSecondTokenRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ createSecondTokenRequest.setEntity(createTokenRequest.getEntity());
|
|
|
+ response = client().performRequest(createSecondTokenRequest);
|
|
|
responseMap = entityAsMap(response);
|
|
|
token = (String) responseMap.get("access_token");
|
|
|
assertNotNull(token);
|
|
|
assertTokenWorks(token);
|
|
|
- oldClusterToken = new StringEntity("{\n" +
|
|
|
+ Request indexRequest2 = new Request("PUT", "token_backwards_compatibility_it/doc/old_cluster_token2");
|
|
|
+ indexRequest2.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"token\": \"" + token + "\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- indexResponse = client().performRequest("PUT", "token_backwards_compatibility_it/doc/old_cluster_token2",
|
|
|
- Collections.emptyMap(), oldClusterToken);
|
|
|
- assertOK(indexResponse);
|
|
|
+ "}");
|
|
|
+ client().performRequest(indexRequest2);
|
|
|
}
|
|
|
|
|
|
public void testTokenWorksInMixedOrUpgradedCluster() throws Exception {
|
|
|
assumeTrue("this test should only run against the mixed or upgraded cluster",
|
|
|
CLUSTER_TYPE == ClusterType.MIXED || CLUSTER_TYPE == ClusterType.UPGRADED);
|
|
|
- Response getResponse = client().performRequest("GET", "token_backwards_compatibility_it/doc/old_cluster_token1");
|
|
|
+ Response getResponse = client().performRequest(new Request("GET", "token_backwards_compatibility_it/doc/old_cluster_token1"));
|
|
|
assertOK(getResponse);
|
|
|
Map<String, Object> source = (Map<String, Object>) entityAsMap(getResponse).get("_source");
|
|
|
assertTokenWorks((String) source.get("token"));
|
|
@@ -71,26 +72,27 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
public void testMixedCluster() throws Exception {
|
|
|
assumeTrue("this test should only run against the mixed cluster", CLUSTER_TYPE == ClusterType.MIXED);
|
|
|
assumeTrue("the master must be on the latest version before we can write", isMasterOnLatestVersion());
|
|
|
- Response getResponse = client().performRequest("GET", "token_backwards_compatibility_it/doc/old_cluster_token2");
|
|
|
- assertOK(getResponse);
|
|
|
+ Response getResponse = client().performRequest(new Request("GET", "token_backwards_compatibility_it/doc/old_cluster_token2"));
|
|
|
Map<String, Object> source = (Map<String, Object>) entityAsMap(getResponse).get("_source");
|
|
|
final String token = (String) source.get("token");
|
|
|
assertTokenWorks(token);
|
|
|
|
|
|
- final StringEntity body = new StringEntity("{\"token\": \"" + token + "\"}", ContentType.APPLICATION_JSON);
|
|
|
- Response invalidationResponse = client().performRequest("DELETE", "_xpack/security/oauth2/token", Collections.emptyMap(), body);
|
|
|
- assertOK(invalidationResponse);
|
|
|
+ Request invalidateRequest = new Request("DELETE", "_xpack/security/oauth2/token");
|
|
|
+ invalidateRequest.setJsonEntity("{\"token\": \"" + token + "\"}");
|
|
|
+ invalidateRequest.addParameter("error_trace", "true");
|
|
|
+ client().performRequest(invalidateRequest);
|
|
|
assertTokenDoesNotWork(token);
|
|
|
|
|
|
// create token and refresh on version that supports it
|
|
|
- final StringEntity tokenPostBody = new StringEntity("{\n" +
|
|
|
+ Request createTokenRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ createTokenRequest.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"username\": \"test_user\",\n" +
|
|
|
" \"password\": \"x-pack-test-password\",\n" +
|
|
|
" \"grant_type\": \"password\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
+ "}");
|
|
|
try (RestClient client = getRestClientForCurrentVersionNodesOnly()) {
|
|
|
- Response response = client.performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenPostBody);
|
|
|
- assertOK(response);
|
|
|
+ Response response = client.performRequest(createTokenRequest);
|
|
|
Map<String, Object> responseMap = entityAsMap(response);
|
|
|
String accessToken = (String) responseMap.get("access_token");
|
|
|
String refreshToken = (String) responseMap.get("refresh_token");
|
|
@@ -98,12 +100,13 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
assertNotNull(refreshToken);
|
|
|
assertTokenWorks(accessToken);
|
|
|
|
|
|
- final StringEntity tokenRefresh = new StringEntity("{\n" +
|
|
|
+ Request tokenRefreshRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ tokenRefreshRequest.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"refresh_token\": \"" + refreshToken + "\",\n" +
|
|
|
" \"grant_type\": \"refresh_token\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- response = client.performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenRefresh);
|
|
|
- assertOK(response);
|
|
|
+ "}");
|
|
|
+ response = client.performRequest(tokenRefreshRequest);
|
|
|
responseMap = entityAsMap(response);
|
|
|
String updatedAccessToken = (String) responseMap.get("access_token");
|
|
|
String updatedRefreshToken = (String) responseMap.get("refresh_token");
|
|
@@ -118,31 +121,32 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
|
|
|
public void testUpgradedCluster() throws Exception {
|
|
|
assumeTrue("this test should only run against the mixed cluster", CLUSTER_TYPE == ClusterType.UPGRADED);
|
|
|
- Response getResponse = client().performRequest("GET", "token_backwards_compatibility_it/doc/old_cluster_token2");
|
|
|
+ Response getResponse = client().performRequest(new Request("GET", "token_backwards_compatibility_it/doc/old_cluster_token2"));
|
|
|
assertOK(getResponse);
|
|
|
Map<String, Object> source = (Map<String, Object>) entityAsMap(getResponse).get("_source");
|
|
|
final String token = (String) source.get("token");
|
|
|
|
|
|
// invalidate again since this may not have been invalidated in the mixed cluster
|
|
|
- final StringEntity body = new StringEntity("{\"token\": \"" + token + "\"}", ContentType.APPLICATION_JSON);
|
|
|
- Response invalidationResponse = client().performRequest("DELETE", "_xpack/security/oauth2/token",
|
|
|
- Collections.singletonMap("error_trace", "true"), body);
|
|
|
+ Request invalidateRequest = new Request("DELETE", "_xpack/security/oauth2/token");
|
|
|
+ invalidateRequest.setJsonEntity("{\"token\": \"" + token + "\"}");
|
|
|
+ invalidateRequest.addParameter("error_trace", "true");
|
|
|
+ Response invalidationResponse = client().performRequest(invalidateRequest);
|
|
|
assertOK(invalidationResponse);
|
|
|
assertTokenDoesNotWork(token);
|
|
|
|
|
|
- getResponse = client().performRequest("GET", "token_backwards_compatibility_it/doc/old_cluster_token1");
|
|
|
- assertOK(getResponse);
|
|
|
+ getResponse = client().performRequest(new Request("GET", "token_backwards_compatibility_it/doc/old_cluster_token1"));
|
|
|
source = (Map<String, Object>) entityAsMap(getResponse).get("_source");
|
|
|
final String workingToken = (String) source.get("token");
|
|
|
assertTokenWorks(workingToken);
|
|
|
|
|
|
- final StringEntity tokenPostBody = new StringEntity("{\n" +
|
|
|
+ Request getTokenRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ getTokenRequest.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"username\": \"test_user\",\n" +
|
|
|
" \"password\": \"x-pack-test-password\",\n" +
|
|
|
" \"grant_type\": \"password\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- Response response = client().performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenPostBody);
|
|
|
- assertOK(response);
|
|
|
+ "}");
|
|
|
+ Response response = client().performRequest(getTokenRequest);
|
|
|
Map<String, Object> responseMap = entityAsMap(response);
|
|
|
String accessToken = (String) responseMap.get("access_token");
|
|
|
String refreshToken = (String) responseMap.get("refresh_token");
|
|
@@ -150,12 +154,13 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
assertNotNull(refreshToken);
|
|
|
assertTokenWorks(accessToken);
|
|
|
|
|
|
- final StringEntity tokenRefresh = new StringEntity("{\n" +
|
|
|
+ Request refreshTokenRequest = new Request("POST", "_xpack/security/oauth2/token");
|
|
|
+ refreshTokenRequest.setJsonEntity(
|
|
|
+ "{\n" +
|
|
|
" \"refresh_token\": \"" + refreshToken + "\",\n" +
|
|
|
" \"grant_type\": \"refresh_token\"\n" +
|
|
|
- "}", ContentType.APPLICATION_JSON);
|
|
|
- response = client().performRequest("POST", "_xpack/security/oauth2/token", Collections.emptyMap(), tokenRefresh);
|
|
|
- assertOK(response);
|
|
|
+ "}");
|
|
|
+ response = client().performRequest(refreshTokenRequest);
|
|
|
responseMap = entityAsMap(response);
|
|
|
String updatedAccessToken = (String) responseMap.get("access_token");
|
|
|
String updatedRefreshToken = (String) responseMap.get("refresh_token");
|
|
@@ -168,16 +173,21 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
}
|
|
|
|
|
|
private void assertTokenWorks(String token) throws IOException {
|
|
|
- Response authenticateResponse = client().performRequest("GET", "_xpack/security/_authenticate", Collections.emptyMap(),
|
|
|
- new BasicHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token));
|
|
|
+ Request request = new Request("GET", "_xpack/security/_authenticate");
|
|
|
+ RequestOptions.Builder options = request.getOptions().toBuilder();
|
|
|
+ options.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token);
|
|
|
+ request.setOptions(options);
|
|
|
+ Response authenticateResponse = client().performRequest(request);
|
|
|
assertOK(authenticateResponse);
|
|
|
assertEquals("test_user", entityAsMap(authenticateResponse).get("username"));
|
|
|
}
|
|
|
|
|
|
private void assertTokenDoesNotWork(String token) {
|
|
|
- ResponseException e = expectThrows(ResponseException.class,
|
|
|
- () -> client().performRequest("GET", "_xpack/security/_authenticate", Collections.emptyMap(),
|
|
|
- new BasicHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token)));
|
|
|
+ Request request = new Request("GET", "_xpack/security/_authenticate");
|
|
|
+ RequestOptions.Builder options = request.getOptions().toBuilder();
|
|
|
+ options.addHeader(HttpHeaders.AUTHORIZATION, "Bearer " + token);
|
|
|
+ request.setOptions(options);
|
|
|
+ ResponseException e = expectThrows(ResponseException.class, () -> client().performRequest(request));
|
|
|
assertEquals(401, e.getResponse().getStatusLine().getStatusCode());
|
|
|
Response response = e.getResponse();
|
|
|
assertEquals("Bearer realm=\"security\", error=\"invalid_token\", error_description=\"The access token expired\"",
|
|
@@ -185,17 +195,17 @@ public class TokenBackwardsCompatibilityIT extends AbstractUpgradeTestCase {
|
|
|
}
|
|
|
|
|
|
private boolean isMasterOnLatestVersion() throws Exception {
|
|
|
- Response response = client().performRequest("GET", "_cluster/state");
|
|
|
+ Response response = client().performRequest(new Request("GET", "_cluster/state"));
|
|
|
assertOK(response);
|
|
|
final String masterNodeId = ObjectPath.createFromResponse(response).evaluate("master_node");
|
|
|
- response = client().performRequest("GET", "_nodes");
|
|
|
+ response = client().performRequest(new Request("GET", "_nodes"));
|
|
|
assertOK(response);
|
|
|
ObjectPath objectPath = ObjectPath.createFromResponse(response);
|
|
|
return Version.CURRENT.equals(Version.fromString(objectPath.evaluate("nodes." + masterNodeId + ".version")));
|
|
|
}
|
|
|
|
|
|
private RestClient getRestClientForCurrentVersionNodesOnly() throws IOException {
|
|
|
- Response response = client().performRequest("GET", "_nodes");
|
|
|
+ Response response = client().performRequest(new Request("GET", "_nodes"));
|
|
|
assertOK(response);
|
|
|
ObjectPath objectPath = ObjectPath.createFromResponse(response);
|
|
|
Map<String, Object> nodesAsMap = objectPath.evaluate("nodes");
|