{"action":"created","comment":{"url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/comments/40214891","id":40214891,"diff_hunk":"@@ -0,0 +1,161 @@\n+/**\n+ * Copyright (C) 2015 Red Hat, Inc.\n+ *\n+ * Licensed under the Apache License, Version 2.0 (the \"License\");\n+ * you may not use this file except in compliance with the License.\n+ * You may obtain a copy of the License at\n+ *\n+ *         http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+package io.fabric8.elasticsearch.plugin;\n+\n+import java.io.IOException;\n+import java.util.Set;\n+\n+import org.apache.commons.lang.ObjectUtils;\n+import org.apache.commons.lang.StringUtils;\n+import org.elasticsearch.action.get.GetResponse;\n+import org.elasticsearch.client.Client;\n+import org.elasticsearch.common.logging.ESLogger;\n+import org.elasticsearch.common.settings.Settings;\n+import org.elasticsearch.rest.RestChannel;\n+import org.elasticsearch.rest.RestFilter;\n+import org.elasticsearch.rest.RestFilterChain;\n+import org.elasticsearch.rest.RestRequest;\n+\n+import com.fasterxml.jackson.core.JsonProcessingException;\n+import com.fasterxml.jackson.core.util.DefaultPrettyPrinter;\n+import com.fasterxml.jackson.databind.ObjectMapper;\n+\n+import io.fabric8.elasticsearch.plugin.acl.SearchGuardACL;\n+import io.fabric8.elasticsearch.plugin.osclient.Fabric8OpenShiftClientAdapter;\n+import io.fabric8.elasticsearch.plugin.osclient.OpenShiftClient;\n+import io.fabric8.kubernetes.client.internal.Utils;\n+\n+public class DynamicACLFilter extends RestFilter {\n+\n+\tprivate static final String AUTHORIZATION_HEADER = \"Authorization\";\n+\tprivate static final String DEFAULT_SECURITY_CONFIG_INDEX = \"searchguard\";\n+\tprivate static final String DEFAULT_AUTH_PROXY_HEADER = \"X-Authenticated-User\";\n+\tprivate static final String SEARCHGUARD_TYPE = \"ac\";\n+\tprivate static final String MASTER_API_URL = \"K8S_HOST_URL\";\n+\tprivate static final String CERT_CA_FILE = \"KUBERNETES_CERTS_CA_FILE\"; \n+\tprivate static final String TRUST_CERTS = \"KUBERNETES_TRUST_CERTIFICATES\"; \n+\tprivate static final String SEARCHGUARD_ID = \"ac\";\n+\tprivate static final String SEARCHGUARD_AUTHENTICATION_PROXY_HEADER = \"searchguard.authentication.proxy.header\";\n+\tprivate static final String SEARCHGUARD_CONFIG_INDEX_NAME = \"searchguard.config_index_name\";\n+\n+\n+\tprivate final ObjectMapper mapper = new ObjectMapper();\n+\tprivate final ESLogger logger;\n+\tprivate final UserProjectCache cache = new UserProjectCacheMapAdapter();\n+\tprivate final String proxyUserHeader;\n+\tprivate final Client esClient;\n+\tprivate final String searchGuardIndex;\n+\tprivate final String masterApiUrl;\n+\tprivate final String caCertFile;\n+\tprivate final Boolean trustCerts;\n+\n+\tpublic DynamicACLFilter(final Settings settings, final Client client, final ESLogger logger){\n+\t\tthis.logger = logger;\n+\t\tthis.esClient = client;\n+\t\tthis.proxyUserHeader = settings.get(SEARCHGUARD_AUTHENTICATION_PROXY_HEADER, DEFAULT_AUTH_PROXY_HEADER);\n+\t\tthis.searchGuardIndex = settings.get(SEARCHGUARD_CONFIG_INDEX_NAME, DEFAULT_SECURITY_CONFIG_INDEX);\n+\t\tthis.masterApiUrl = Utils.getSystemPropertyOrEnvVar(MASTER_API_URL);\n+\t\tthis.caCertFile = Utils.getSystemPropertyOrEnvVar(CERT_CA_FILE, \"/var/run/secrets/kubernetes.io/serviceaccount/ca.crt\");\n+\t\tthis.trustCerts = Utils.getSystemPropertyOrEnvVar(TRUST_CERTS, Boolean.FALSE);","path":"src/main/java/io/fabric8/elasticsearch/plugin/DynamicACLFilter.java","position":72,"original_position":72,"commit_id":"5d2dc477867ceed4b7a80c0c337588dae3401147","original_commit_id":"5d2dc477867ceed4b7a80c0c337588dae3401147","user":{"login":"jimmidyson","id":464659,"avatar_url":"https://avatars.githubusercontent.com/u/464659?v=3","gravatar_id":"","url":"https://api.github.com/users/jimmidyson","html_url":"https://github.com/jimmidyson","followers_url":"https://api.github.com/users/jimmidyson/followers","following_url":"https://api.github.com/users/jimmidyson/following{/other_user}","gists_url":"https://api.github.com/users/jimmidyson/gists{/gist_id}","starred_url":"https://api.github.com/users/jimmidyson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimmidyson/subscriptions","organizations_url":"https://api.github.com/users/jimmidyson/orgs","repos_url":"https://api.github.com/users/jimmidyson/repos","events_url":"https://api.github.com/users/jimmidyson/events{/privacy}","received_events_url":"https://api.github.com/users/jimmidyson/received_events","type":"User","site_admin":false},"body":"Ditto.","created_at":"2015-09-23T15:09:38Z","updated_at":"2015-09-23T15:09:38Z","html_url":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5#discussion_r40214891","pull_request_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5","_links":{"self":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/comments/40214891"},"html":{"href":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5#discussion_r40214891"},"pull_request":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5"}}},"pull_request":{"url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5","id":45790843,"html_url":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5","diff_url":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5.diff","patch_url":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5.patch","issue_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/5","number":5,"state":"open","locked":false,"title":"WIP - DO NOT merge Dynamic sync","user":{"login":"jcantrill","id":4548408,"avatar_url":"https://avatars.githubusercontent.com/u/4548408?v=3","gravatar_id":"","url":"https://api.github.com/users/jcantrill","html_url":"https://github.com/jcantrill","followers_url":"https://api.github.com/users/jcantrill/followers","following_url":"https://api.github.com/users/jcantrill/following{/other_user}","gists_url":"https://api.github.com/users/jcantrill/gists{/gist_id}","starred_url":"https://api.github.com/users/jcantrill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcantrill/subscriptions","organizations_url":"https://api.github.com/users/jcantrill/orgs","repos_url":"https://api.github.com/users/jcantrill/repos","events_url":"https://api.github.com/users/jcantrill/events{/privacy}","received_events_url":"https://api.github.com/users/jcantrill/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-09-23T15:07:43Z","updated_at":"2015-09-23T15:09:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"523de63ad0bbbf100c3b127ca810a86804074221","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5/commits","review_comments_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5/comments","review_comment_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/comments{/number}","comments_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/5/comments","statuses_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/statuses/5d2dc477867ceed4b7a80c0c337588dae3401147","head":{"label":"jcantrill:dynamic_sync","ref":"dynamic_sync","sha":"5d2dc477867ceed4b7a80c0c337588dae3401147","user":{"login":"jcantrill","id":4548408,"avatar_url":"https://avatars.githubusercontent.com/u/4548408?v=3","gravatar_id":"","url":"https://api.github.com/users/jcantrill","html_url":"https://github.com/jcantrill","followers_url":"https://api.github.com/users/jcantrill/followers","following_url":"https://api.github.com/users/jcantrill/following{/other_user}","gists_url":"https://api.github.com/users/jcantrill/gists{/gist_id}","starred_url":"https://api.github.com/users/jcantrill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcantrill/subscriptions","organizations_url":"https://api.github.com/users/jcantrill/orgs","repos_url":"https://api.github.com/users/jcantrill/repos","events_url":"https://api.github.com/users/jcantrill/events{/privacy}","received_events_url":"https://api.github.com/users/jcantrill/received_events","type":"User","site_admin":false},"repo":{"id":41877967,"name":"openshift-searchguard-sync","full_name":"jcantrill/openshift-searchguard-sync","owner":{"login":"jcantrill","id":4548408,"avatar_url":"https://avatars.githubusercontent.com/u/4548408?v=3","gravatar_id":"","url":"https://api.github.com/users/jcantrill","html_url":"https://github.com/jcantrill","followers_url":"https://api.github.com/users/jcantrill/followers","following_url":"https://api.github.com/users/jcantrill/following{/other_user}","gists_url":"https://api.github.com/users/jcantrill/gists{/gist_id}","starred_url":"https://api.github.com/users/jcantrill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcantrill/subscriptions","organizations_url":"https://api.github.com/users/jcantrill/orgs","repos_url":"https://api.github.com/users/jcantrill/repos","events_url":"https://api.github.com/users/jcantrill/events{/privacy}","received_events_url":"https://api.github.com/users/jcantrill/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jcantrill/openshift-searchguard-sync","description":null,"fork":true,"url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync","forks_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/forks","keys_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/teams","hooks_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/hooks","issue_events_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/issues/events{/number}","events_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/events","assignees_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/assignees{/user}","branches_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/branches{/branch}","tags_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/tags","blobs_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/git/refs{/sha}","trees_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/statuses/{sha}","languages_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/languages","stargazers_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/stargazers","contributors_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/contributors","subscribers_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/subscribers","subscription_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/subscription","commits_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/commits{/sha}","git_commits_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/git/commits{/sha}","comments_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/comments{/number}","issue_comment_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/issues/comments{/number}","contents_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/contents/{+path}","compare_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/merges","archive_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/downloads","issues_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/issues{/number}","pulls_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/pulls{/number}","milestones_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/milestones{/number}","notifications_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/labels{/name}","releases_url":"https://api.github.com/repos/jcantrill/openshift-searchguard-sync/releases{/id}","created_at":"2015-09-03T18:55:59Z","updated_at":"2015-09-03T18:56:01Z","pushed_at":"2015-09-23T15:06:17Z","git_url":"git://github.com/jcantrill/openshift-searchguard-sync.git","ssh_url":"git@github.com:jcantrill/openshift-searchguard-sync.git","clone_url":"https://github.com/jcantrill/openshift-searchguard-sync.git","svn_url":"https://github.com/jcantrill/openshift-searchguard-sync","homepage":null,"size":125,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"fabric8io:master","ref":"master","sha":"fc15b347d7c7998d232a73abca3484183ac9060a","user":{"login":"fabric8io","id":6074349,"avatar_url":"https://avatars.githubusercontent.com/u/6074349?v=3","gravatar_id":"","url":"https://api.github.com/users/fabric8io","html_url":"https://github.com/fabric8io","followers_url":"https://api.github.com/users/fabric8io/followers","following_url":"https://api.github.com/users/fabric8io/following{/other_user}","gists_url":"https://api.github.com/users/fabric8io/gists{/gist_id}","starred_url":"https://api.github.com/users/fabric8io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabric8io/subscriptions","organizations_url":"https://api.github.com/users/fabric8io/orgs","repos_url":"https://api.github.com/users/fabric8io/repos","events_url":"https://api.github.com/users/fabric8io/events{/privacy}","received_events_url":"https://api.github.com/users/fabric8io/received_events","type":"Organization","site_admin":false},"repo":{"id":41058701,"name":"openshift-searchguard-sync","full_name":"fabric8io/openshift-searchguard-sync","owner":{"login":"fabric8io","id":6074349,"avatar_url":"https://avatars.githubusercontent.com/u/6074349?v=3","gravatar_id":"","url":"https://api.github.com/users/fabric8io","html_url":"https://github.com/fabric8io","followers_url":"https://api.github.com/users/fabric8io/followers","following_url":"https://api.github.com/users/fabric8io/following{/other_user}","gists_url":"https://api.github.com/users/fabric8io/gists{/gist_id}","starred_url":"https://api.github.com/users/fabric8io/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabric8io/subscriptions","organizations_url":"https://api.github.com/users/fabric8io/orgs","repos_url":"https://api.github.com/users/fabric8io/repos","events_url":"https://api.github.com/users/fabric8io/events{/privacy}","received_events_url":"https://api.github.com/users/fabric8io/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/fabric8io/openshift-searchguard-sync","description":null,"fork":false,"url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync","forks_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/forks","keys_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/keys{/key_id}","collaborators_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/teams","hooks_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/hooks","issue_events_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/events{/number}","events_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/events","assignees_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/assignees{/user}","branches_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/branches{/branch}","tags_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/tags","blobs_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/git/refs{/sha}","trees_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/git/trees{/sha}","statuses_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/statuses/{sha}","languages_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/languages","stargazers_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/stargazers","contributors_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/contributors","subscribers_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/subscribers","subscription_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/subscription","commits_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/commits{/sha}","git_commits_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/git/commits{/sha}","comments_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/comments{/number}","issue_comment_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/comments{/number}","contents_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/contents/{+path}","compare_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/compare/{base}...{head}","merges_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/merges","archive_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/downloads","issues_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues{/number}","pulls_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls{/number}","milestones_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/milestones{/number}","notifications_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/labels{/name}","releases_url":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/releases{/id}","created_at":"2015-08-19T20:37:42Z","updated_at":"2015-08-19T20:44:14Z","pushed_at":"2015-09-23T15:07:44Z","git_url":"git://github.com/fabric8io/openshift-searchguard-sync.git","ssh_url":"git@github.com:fabric8io/openshift-searchguard-sync.git","clone_url":"https://github.com/fabric8io/openshift-searchguard-sync.git","svn_url":"https://github.com/fabric8io/openshift-searchguard-sync","homepage":null,"size":299,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":3,"forks":1,"open_issues":3,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5"},"html":{"href":"https://github.com/fabric8io/openshift-searchguard-sync/pull/5"},"issue":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/5"},"comments":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/issues/5/comments"},"review_comments":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5/comments"},"review_comment":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/pulls/5/commits"},"statuses":{"href":"https://api.github.com/repos/fabric8io/openshift-searchguard-sync/statuses/5d2dc477867ceed4b7a80c0c337588dae3401147"}}}}