Api token authc/z implementation with Cache

[derek-ho]

Description

This PR implements authc/z for api tokens. For authc it is based on token validity for as well as presence in a cache, which listens to index and delete operations on the api token index. For Authz, it onboards onto action privileges class, where instead of returning not authorized for cluster and index privileges, requests go through a final api token check, where if the user is an api token, it will evaluate whether the permissions in the cache are sufficient to execute the request.

Issues Resolved

[List any issues this PR will resolve]

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

Attention: Patch coverage is 55.76324% with 142 lines in your changes missing coverage. Please review.

Project coverage is 71.24%. Comparing base (0edba23) to head (9fcb720).
Report is 10 commits behind head on feature/api-tokens.

Files with missing lines	Patch %	Lines
...arch/security/action/apitokens/ApiTokenAction.java	2.50%	39 Missing ⚠️
...pensearch/security/http/ApiTokenAuthenticator.java	58.97%	22 Missing and 10 partials ⚠️
...urity/action/apitokens/ApiTokenUpdateResponse.java	0.00%	14 Missing ⚠️
...ction/apitokens/TransportApiTokenUpdateAction.java	22.22%	14 Missing ⚠️
...ensearch/security/privileges/ActionPrivileges.java	85.91%	4 Missing and 6 partials ⚠️
...curity/action/apitokens/ApiTokenUpdateRequest.java	0.00%	6 Missing ⚠️
...earch/security/auditlog/impl/AbstractAuditLog.java	40.00%	3 Missing and 3 partials ⚠️
...y/action/apitokens/ApiTokenUpdateNodeResponse.java	0.00%	4 Missing ⚠️
...nsearch/security/action/apitokens/Permissions.java	60.00%	4 Missing ⚠️
...curity/privileges/PrivilegesEvaluationContext.java	77.77%	3 Missing and 1 partial ⚠️
... and 4 more

Additional details and impacted files

@@                  Coverage Diff                   @@
##           feature/api-tokens    #4992      +/-   ##
======================================================
- Coverage               71.46%   71.24%   -0.22%     
======================================================
  Files                     334      347      +13     
  Lines                   22552    23190     +638     
  Branches                 3590     3667      +77     
======================================================
+ Hits                    16117    16522     +405     
- Misses                   4642     4847     +205     
- Partials                 1793     1821      +28     

Files with missing lines	Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java	83.65% <100.00%> (+0.09%)	⬆️
...opensearch/security/action/apitokens/ApiToken.java	91.30% <100.00%> (ø)
...ecurity/action/apitokens/ApiTokenUpdateAction.java	100.00% <100.00%> (ø)
...g/opensearch/security/authtoken/jwt/JwtVendor.java	86.66% <ø> (-2.43%)	⬇️
...g/opensearch/security/ssl/util/ExceptionUtils.java	45.83% <100.00%> (+2.35%)	⬆️
...a/org/opensearch/security/util/AuthTokenUtils.java	66.66% <100.00%> (+4.16%)	⬆️
...search/security/securityconf/impl/v7/ConfigV7.java	83.55% <0.00%> (-0.63%)	⬇️
.../security/action/apitokens/ApiTokenRepository.java	95.74% <93.93%> (ø)
...search/security/identity/SecurityTokenManager.java	81.03% <33.33%> (-8.33%)	⬇️
...y/action/apitokens/ApiTokenUpdateNodeResponse.java	0.00% <0.00%> (ø)
... and 10 more

... and 5 files with indirect coverage changes

[derek-ho]

Changes in this file are to correct a mis-merge that happened in prior PRs to this feature branch.

[cwperks]

Why add this to PrivilegesEvaluatorContext?

I think this should be handled similarly to the security configCache from ConfigurationRepository: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/configuration/ConfigurationRepository.java

[cwperks]

Note that security uses a publish-subscribe model to notify consumers about changes to the security config. See BackendRegistry.onDynamicConfigModelChanged for an example of a subscriber.

[derek-ho]

The reason why I am adding the instance to the context is for evaluation within the authz flow. I am not sure if the publish/subscribe model would work well for api tokens, which seems to be different than the other roles within the cluster. I feel like it is wrong to hook it up such that the actionprivileges need to be re-computed for all roles in the cluster on creation of a new api token (which does not affect the existing roles of the cluster). That is why I went forward with the instance approach that can be modified under the hood without re-computation of the other roles datastructures. Is there any concern with this instance approach other than not following the patterns existing within the security repo?

[cwperks]

This class is reserved for the context necessary to evaluate privileges on the currently executing ActionRequest. This class may need modification, but can we limit it to the smallest amount of what is required to evaluate privileges for the request? i.e. only the permissions of the token being utilized?

[cwperks]

If the roles in this are unused, can we use SecurityDynamicConfiguration.empty(CType.ROLES); instead?

[cwperks]

IMO Cache is an implementation detail. The class should be about accessing metadata about the tokens like the permissions associated with a token.

[cwperks]

See ConfigurationRepository which has methods for accessing the security configuration (from the security index or from the cache). I think repository is a good name here to let the caller of the class know that its used to access info about the security configuration.