Onboards flow-framework plugin to resource-sharing and access control framework #1251

DarshitChanpura · 2025-10-13T17:45:33Z

Description

Implements resource-access-control for workflow and workflow_state.

Related Issues

Resolves Onboard flow-framework plugin to Centralized Resource AuthZ framework #1250

Check List

New functionality includes testing.
New functionality has been documented.
API changes companion pull request created.
Commits are signed per the DCO using --signoff.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

… framework Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura · 2025-10-13T17:57:41Z

CI will resolve once: opensearch-project/security#5677 is merged.

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

…e-sharing tests Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura · 2025-10-15T17:09:47Z

CI blocked by #1252

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

owaiskazi19

1st iteration

build.gradle

src/main/java/org/opensearch/flowframework/util/ParseUtils.java

src/main/java/org/opensearch/flowframework/transport/PluginClient.java

src/main/java/org/opensearch/flowframework/util/PluginClient.java

src/main/java/org/opensearch/flowframework/util/ResourceSharingClientAccessor.java

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

owaiskazi19

2nd iteration

owaiskazi19 · 2025-10-27T03:04:17Z

.github/workflows/test_security.yml

    strategy:
      matrix:
        java: [21]
+        resource_sharing_flag: [ "", "-Dresource_sharing.enabled=true" ]


Can be replaced with

Suggested change

resource_sharing_flag: [ "", "-Dresource_sharing.enabled=true" ]

resource_sharing_flag: [ false, true ]

and later can be used -Dresource_sharing.enabled=${{ matrix.resource_sharing_flag }}.

owaiskazi19 · 2025-10-27T03:22:28Z

src/main/java/org/opensearch/flowframework/util/ParseUtils.java

+     */
+    public static void verifyResourceAccessAndProcessRequest(String resourceType, Runnable onSuccess, Runnable fallBackIfDisabled) {
+        // Resource access will be auto-evaluated
+        if (shouldUseResourceAuthz(resourceType)) {


Should be under a try/catch block here

owaiskazi19 · 2025-10-27T03:27:10Z

src/main/java/org/opensearch/flowframework/util/PluginClient.java

+        if (subject == null) {
+            throw new IllegalStateException("PluginClient is not initialized.");
+        }
+        try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().newStoredContext(false)) {


Suggested change

try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().newStoredContext(false)) {

try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().stashContext) {

newStoredContext(false) might unintentionally preserve or lose headers

owaiskazi19 · 2025-10-27T03:37:25Z

src/main/java/org/opensearch/flowframework/util/PluginClient.java

+        try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().newStoredContext(false)) {
+            subject.runAs(() -> {
+                logger.info("Running transport action with subject: {}", subject.getPrincipal().getName());
+                super.doExecute(action, request, ActionListener.runBefore(listener, ctx::restore));


Here, doExecute would still be running since it runs in async manner. Since the context is created in the try block, it would be restored once the try block finishes. So the doExecute request would still be running and can cause thread context leak or premature restoration.
Better way would be just

ThreadContext.StoredContext ctx = threadPool().getThreadContext().stashContext(); subject.runAs(() -> { super.doExecute(action, request, ActionListener.runBefore(listener, ctx::restore)); });

this would ensure context is restored back only when listener returns either a response or a failure

owaiskazi19 · 2025-10-27T03:38:23Z

src/main/java/org/opensearch/flowframework/util/ResourceSharingClientAccessor.java

+     * Set the resource sharing client
+     */
+    public void setResourceSharingClient(ResourceSharingClient client) {
+        resourceSharingClientAccessor.client.set(client);


no need to reference static field here

Suggested change

resourceSharingClientAccessor.client.set(client);

this.client.set(client);

owaiskazi19 · 2025-10-27T03:39:28Z

src/main/java/org/opensearch/flowframework/util/ResourceSharingClientAccessor.java

+     * Get the resource sharing client
+     */
+    public ResourceSharingClient getResourceSharingClient() {
+        return resourceSharingClientAccessor.client.get();


Suggested change

return resourceSharingClientAccessor.client.get();

return this.client.get();

Also, can we add a null check here and return IllegalStateException

owaiskazi19 · 2025-10-27T03:40:06Z

src/main/java/org/opensearch/flowframework/util/ResourceSharingClientAccessor.java

+public class ResourceSharingClientAccessor {
+    private final AtomicReference<ResourceSharingClient> client = new AtomicReference<>();
+
+    private static ResourceSharingClientAccessor resourceSharingClientAccessor;


For thread safety

Suggested change

private static ResourceSharingClientAccessor resourceSharingClientAccessor;

private static final ResourceSharingClientAccessor INSTANCE = new ResourceSharingClientAccessor();

owaiskazi19 · 2025-10-27T03:40:41Z

src/main/java/org/opensearch/flowframework/util/ResourceSharingClientAccessor.java

+        if (resourceSharingClientAccessor == null) {
+            resourceSharingClientAccessor = new ResourceSharingClientAccessor();
+        }
+
+        return resourceSharingClientAccessor;


Now we can just return

Suggested change

if (resourceSharingClientAccessor == null) {

resourceSharingClientAccessor = new ResourceSharingClientAccessor();

}

return resourceSharingClientAccessor;

return INSTANCE;

owaiskazi19 · 2025-10-27T06:36:27Z

build.gradle

    testImplementation("org.junit.jupiter:junit-jupiter:${junitJupiterVersion}")
    testImplementation("com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${versions.jackson_databind}")

+    testImplementation "org.awaitility:awaitility:${awaitlityVersion}"


Suggested change

testImplementation "org.awaitility:awaitility:${awaitlityVersion}"

testImplementation "org.awaitility:awaitility:${awaitilityVersion}"

Onboards flow-framework plugin to resource-sharing and access control…

72da7b3

… framework Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Adds javadoc and a changelog entry

dc16660

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura marked this pull request as ready for review October 14, 2025 15:50

DarshitChanpura requested review from amitgalitz, dbwiddis, jackiehanyang, joshpalis, junweid62, ohltyler and owaiskazi19 as code owners October 14, 2025 15:50

Adds tests for resource sharing flow and adds a CI job to run resourc…

6937e06

…e-sharing tests Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura force-pushed the resource-permissions branch from 8f62909 to 6937e06 Compare October 14, 2025 15:53

Explicitly set security spi version to 3.4

69009e6

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura force-pushed the resource-permissions branch from dace39b to 69009e6 Compare October 14, 2025 22:58

Refactors test to use in house Recipient class

bd13659

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

owaiskazi19 reviewed Oct 21, 2025

View reviewed changes

DarshitChanpura added 3 commits October 24, 2025 16:19

Address PR comments around renaming and version

3213442

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Merge remote-tracking branch 'upstream/main' into resource-permissions

d0230d9

Constant for awaitility version

fb373df

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

owaiskazi19 reviewed Oct 27, 2025

View reviewed changes

	resource_sharing_flag: [ "", "-Dresource_sharing.enabled=true" ]
	resource_sharing_flag: [ false, true ]

	try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().newStoredContext(false)) {
	try (ThreadContext.StoredContext ctx = threadPool().getThreadContext().stashContext) {

	resourceSharingClientAccessor.client.set(client);
	this.client.set(client);

	return resourceSharingClientAccessor.client.get();
	return this.client.get();

	private static ResourceSharingClientAccessor resourceSharingClientAccessor;
	private static final ResourceSharingClientAccessor INSTANCE = new ResourceSharingClientAccessor();

	testImplementation "org.awaitility:awaitility:${awaitlityVersion}"
	testImplementation "org.awaitility:awaitility:${awaitilityVersion}"

Onboards flow-framework plugin to resource-sharing and access control framework #1251

Are you sure you want to change the base?

Onboards flow-framework plugin to resource-sharing and access control framework #1251

Uh oh!

Conversation

DarshitChanpura commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

DarshitChanpura commented Oct 13, 2025

Uh oh!

DarshitChanpura commented Oct 15, 2025

Uh oh!

owaiskazi19 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

owaiskazi19 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

DarshitChanpura commented Oct 13, 2025 •

edited

Loading

owaiskazi19 left a comment •

edited

Loading