search

opensearch-project / security

🔐 Secure your cluster with TLS, numerous authentication backends, data masking, audit logging as well as role-based access control on indices, documents, and fields
https://opensearch.org/docs/latest/security-plugin/index/
Apache License 2.0
199 stars 278 forks source link

[BUG] An inconsistent number of audit logs is created when a snapshot is taken. #2169

Open lukasz-soszynski-eliatra opened 2 years ago

lukasz-soszynski-eliatra commented 2 years ago

What is the bug? A variable number of audit logs is created when a snapshot is taken:

  1. One or two audit logs are created with the category AUTHENTICATED and request path /_snapshot/test-snapshot-repository/snapshot-positive-test
  2. Two or four audit logs are created with the category GRANTED_PRIVILEGES and request type GetSnapshotsRequest

How can one reproduce the bug? The bug was found during work on integration tests for snapshot features. The easiest way to reproduce the problem is to run the test org.opensearch.security.SearchOperationTest#shouldCreateSnapshot_positive, https://github.com/opensearch-project/security/pull/2153/files#diff-a407f817ee7d41d20775ea3fec31ed0a1fb81230503909a94266e78fe73a07d0R1385

The number of audit logs depends on the test execution order. When only the above test is run from the IDE then always 2 audits AUTHENTICATED/_snapshot/test-snapshot-repository/snapshot-positive-test and 4 GRANTED_PRIVILEGES/GetSnapshotsRequest are created. But when all tests from the class SearchOperationTest are run then depending on the execution order only 1 audits AUTHENTICATED/_snapshot/test-snapshot-repository/snapshot-positive-test and 2 GRANTED_PRIVILEGES/GetSnapshotsRequest are created during test shouldCreateSnapshot_positive.

It is also worth mentioning that after each test snapshot repository is removed if exists.

What is the expected behaviour? The consistent number of audit logs is created

What is your host/environment?

Do you have any screenshots? no

Do you have any additional context? To easily tracks the number of audit logs created during tests it is worth assigning DEBUG level to logger org.opensearch.test.framework.audit.AuditLogsRule

MaciejMierzwa commented 1 year ago

Hi, it seems like the problem was caused by Awaitility.await() method used in SnapshotSteps.waitForSnapshotCreation() Default poll interval is 100 miliseconds, if the call wasn't succesfull in this time it would perform another request, increasing number of audit logs. This task should be solved by: https://github.com/opensearch-project/security/pull/3602 https://github.com/opensearch-project/security/issues/3426