elasticfence / elasticsearch-http-user-auth

HTTP Basic Authentication and IP ACL plugin for Elasticsearch :key: (UNMAINTAINED)
http://qxip.net
148 stars 32 forks source link

elasticfence 5.0.1 should be update #35

Closed zhangxiaoguang-baidu closed 7 years ago

zhangxiaoguang-baidu commented 7 years ago

recently I'm update elasticfence to 5.0.1,do you have plan to update ?

lmangani commented 7 years ago

Hi @zhangxiaoguang-baidu we're planning to but contributions are welcome ;)

ryanlutgen commented 7 years ago

Yesterday and today I have spent a little bit of time investigating how to update this to Elasticsearch 5. My primary focus has been the auth part itself, verifying with root. Most of what I have been doing is screwing around, since prior to yesterday I have never dug into the Elasticsearch (ES) or Elasticfence (EF) source code. I haven't really touched the endpoints that EF supplies. Here is what I've found so far:

1) ES changed a lot of their implementations to use NodeClient instead of Client. Changing all of the class references in EF should not be an issue. 2) ES no longer has Guava as a dependency, so the pom needs to be updated to bring it in.

ElasticfencePlugin: 1) onModuleis deprecated, so I changed the ElasticfencePluginclass to implement ScriptPluginand moved most of its contents to an overridden getRestHandlersmethod. 2) RestModuleno longer exists, but the addRestActionfunctionality appears to be wired into the getRestHandlersmethod, that method should return a Collections.singletonList(AuthRestHandler.class). This can be used to wire in multiple handlers, since the getRestHandlersmethod returns a list.

AuthRestHandler: 1) ES changed handleRequestto be final, so EF cannot override it anymore. They changed a great deal of the code related to how REST requests are handled, but what I've found is that the prepareRequestmethod is still able to be overridden, and it returns a RestChannelConsumer. I created an inner class that implements RestChannelConsumer, and moved the content of handleRequestinto it. It appears to not be working properly for me, but the main auth is my focus presently.

AuthRestFilter: 1) filterChain.continueProcessing now takes the client as a param.

RequestAnalyzer: 1) ES no longer has a built in Base64 decoder, need to use Java 8's

RequestParser: 1) The RestActionsimport has been moved to org.elasticsearch.rest.action.RestActions

EFLogger: 1) ES no longer wraps Log4j inside ESLogger, instead the factory method returns a Logger instance. So the pom needs to be updated to set log4j as a supplied dependency.

UserDataBridge: 1) setRefreshis no longer a method on the client builders, but I think setRefreshPolicy(WriteRequest.RefreshPolicy.IMMEDIATE) does the same thing

A current issue I am facing is that Elasticsearch is throwing exceptions when I try to specify config options in my elasticsearch.yml. My hunch is that EF needs to specify valid plugin settings, perhaps in an overridden additionalSettingsmethod, but I presently have no idea. I've resorted to hardcoding a password for testing.

lmangani commented 7 years ago

Hi Ryan! Thanks for your efforts trying to port the plugin to 5.x Please send a PR with your current work we can help smooth out the edges with the contributors team

ryanlutgen commented 7 years ago

PR of what I have now is up. Did most of this in my off time at work. I was going to prepare a more formal PR with better commit messages (and not using my work git config), but figured its too much of a hassle for getting this up.

Edit: Recreated PR due to my git config email on the machine I was initially working on not being tied to my GitHub account.

ryanlutgen commented 7 years ago

5.0.1 branch now up.