Add cache for application privileges

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/privilege/ClearPrivilegesCacheAction.java

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+package org.elasticsearch.xpack.core.security.action.privilege;
+
+import org.elasticsearch.action.ActionType;
+
+public class ClearPrivilegesCacheAction extends ActionType<ClearPrivilegesCacheResponse> {
+
+    public static final ClearPrivilegesCacheAction INSTANCE = new ClearPrivilegesCacheAction();
+    public static final String NAME = "cluster:admin/xpack/security/privilege/cache/clear";
+
+    protected ClearPrivilegesCacheAction() {
+        super(NAME, ClearPrivilegesCacheResponse::new);
+    }
+}

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/privilege/ClearPrivilegesCacheRequest.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+package org.elasticsearch.xpack.core.security.action.privilege;
+
+import org.elasticsearch.action.support.nodes.BaseNodesRequest;
+import org.elasticsearch.common.io.stream.StreamInput;
+import org.elasticsearch.common.io.stream.StreamOutput;
+import org.elasticsearch.transport.TransportRequest;
+
+import java.io.IOException;
+
+public class ClearPrivilegesCacheRequest extends BaseNodesRequest<ClearPrivilegesCacheRequest> {
+
+    String[] applicationNames;
+
+    public ClearPrivilegesCacheRequest() {
+        super((String[]) null);
+    }
+
+    public ClearPrivilegesCacheRequest(StreamInput in) throws IOException {
+        super(in);
+        applicationNames = in.readOptionalStringArray();
+    }
+
+    public ClearPrivilegesCacheRequest applicationNames(String... applicationNames) {
+        this.applicationNames = applicationNames;
+        return this;
+    }
+
+    public String[] applicationNames() {
+        return applicationNames;
+    }
+
+    @Override
+    public void writeTo(StreamOutput out) throws IOException {
+        super.writeTo(out);
+        out.writeOptionalStringArray(applicationNames);
+    }
+
+    public static class Node extends TransportRequest {
+        private String[] applicationNames;
+
+        public Node(StreamInput in) throws IOException {
+            super(in);
+            applicationNames = in.readOptionalStringArray();
+        }
+
+        public Node(ClearPrivilegesCacheRequest request) {
+            this.applicationNames = request.applicationNames();
+        }
+
+        public String[] getApplicationNames() {
+            return applicationNames;
+        }
+
+        @Override
+        public void writeTo(StreamOutput out) throws IOException {
+            super.writeTo(out);
+            out.writeOptionalStringArray(applicationNames);
+        }
+    }
+}

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/privilege/ClearPrivilegesCacheResponse.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+package org.elasticsearch.xpack.core.security.action.privilege;
+
+import org.elasticsearch.action.FailedNodeException;
+import org.elasticsearch.action.support.nodes.BaseNodeResponse;
+import org.elasticsearch.action.support.nodes.BaseNodesResponse;
+import org.elasticsearch.cluster.ClusterName;
+import org.elasticsearch.cluster.node.DiscoveryNode;
+import org.elasticsearch.common.io.stream.StreamInput;
+import org.elasticsearch.common.io.stream.StreamOutput;
+import org.elasticsearch.common.xcontent.ToXContentFragment;
+import org.elasticsearch.common.xcontent.XContentBuilder;
+
+import java.io.IOException;
+import java.util.List;
+
+public class ClearPrivilegesCacheResponse extends BaseNodesResponse<ClearPrivilegesCacheResponse.Node>
+    implements ToXContentFragment {
+
+    public ClearPrivilegesCacheResponse(StreamInput in) throws IOException {
+        super(in);
+    }
+
+    public ClearPrivilegesCacheResponse(ClusterName clusterName, List<Node> nodes, List<FailedNodeException> failures) {
+        super(clusterName, nodes, failures);
+    }
+
+    @Override
+    protected List<Node> readNodesFrom(StreamInput in) throws IOException {
+        return in.readList(Node::new);
+    }
+
+    @Override
+    protected void writeNodesTo(StreamOutput out, List<Node> nodes) throws IOException {
+        out.writeList(nodes);
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject("nodes");
+        for (Node node : getNodes()) {
+            builder.startObject(node.getNode().getId());
+            builder.field("name", node.getNode().getName());
+            builder.endObject();
+        }
+        builder.endObject();
+        return builder;
+    }
+
+    public static class Node extends BaseNodeResponse {
+        public Node(StreamInput in) throws IOException {
+            super(in);
+        }
+
+        public Node(DiscoveryNode node) {
+            super(node);
+        }
+    }
+}

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/support/CacheIteratorHelper.java

@@ -10,6 +10,7 @@
 import org.elasticsearch.common.util.concurrent.ReleasableLock;
 
 import java.util.Iterator;
+import java.util.Map;
 import java.util.concurrent.locks.ReadWriteLock;
 import java.util.concurrent.locks.ReentrantReadWriteLock;
 import java.util.function.Predicate;
@@ -56,4 +57,17 @@ public void removeKeysIf(Predicate<K> removeIf) {
             }
         }
     }
+
+    public void removeValuesIf(Predicate<V> removeIf) {
+        // the cache cannot be modified while doing this operation per the terms of the cache iterator
+        try (ReleasableLock ignored = this.acquireForIterator()) {
+            Iterator<K> iterator = cache.keys().iterator();
+            while (iterator.hasNext()) {
+                K key = iterator.next();
+                if (removeIf.test(cache.get(key))) {
+                    iterator.remove();
+                }
+            }
+        }
+    }
 }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -88,6 +88,7 @@
 import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectAuthenticateAction;
 import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutAction;
 import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectPrepareAuthenticationAction;
+import org.elasticsearch.xpack.core.security.action.privilege.ClearPrivilegesCacheAction;
 import org.elasticsearch.xpack.core.security.action.privilege.DeletePrivilegesAction;
 import org.elasticsearch.xpack.core.security.action.privilege.GetBuiltinPrivilegesAction;
 import org.elasticsearch.xpack.core.security.action.privilege.GetPrivilegesAction;
@@ -151,6 +152,7 @@
 import org.elasticsearch.xpack.security.action.oidc.TransportOpenIdConnectAuthenticateAction;
 import org.elasticsearch.xpack.security.action.oidc.TransportOpenIdConnectLogoutAction;
 import org.elasticsearch.xpack.security.action.oidc.TransportOpenIdConnectPrepareAuthenticationAction;
+import org.elasticsearch.xpack.security.action.privilege.TransportClearPrivilegesCacheAction;
 import org.elasticsearch.xpack.security.action.privilege.TransportDeletePrivilegesAction;
 import org.elasticsearch.xpack.security.action.privilege.TransportGetBuiltinPrivilegesAction;
 import org.elasticsearch.xpack.security.action.privilege.TransportGetPrivilegesAction;
@@ -217,6 +219,7 @@
 import org.elasticsearch.xpack.security.rest.action.oidc.RestOpenIdConnectAuthenticateAction;
 import org.elasticsearch.xpack.security.rest.action.oidc.RestOpenIdConnectLogoutAction;
 import org.elasticsearch.xpack.security.rest.action.oidc.RestOpenIdConnectPrepareAuthenticationAction;
+import org.elasticsearch.xpack.security.rest.action.privilege.RestClearPrivilegesAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestDeletePrivilegesAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestGetBuiltinPrivilegesAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestGetPrivilegesAction;
@@ -727,6 +730,7 @@ public void onIndexModule(IndexModule module) {
         return Arrays.asList(
                 new ActionHandler<>(ClearRealmCacheAction.INSTANCE, TransportClearRealmCacheAction.class),
                 new ActionHandler<>(ClearRolesCacheAction.INSTANCE, TransportClearRolesCacheAction.class),
+                new ActionHandler<>(ClearPrivilegesCacheAction.INSTANCE, TransportClearPrivilegesCacheAction.class),
                 new ActionHandler<>(GetUsersAction.INSTANCE, TransportGetUsersAction.class),
                 new ActionHandler<>(PutUserAction.INSTANCE, TransportPutUserAction.class),
                 new ActionHandler<>(DeleteUserAction.INSTANCE, TransportDeleteUserAction.class),
@@ -786,6 +790,7 @@ public List<RestHandler> getRestHandlers(Settings settings, RestController restC
                 new RestAuthenticateAction(settings, securityContext.get(), getLicenseState()),
                 new RestClearRealmCacheAction(settings, getLicenseState()),
                 new RestClearRolesCacheAction(settings, getLicenseState()),
+                new RestClearPrivilegesAction(settings, getLicenseState()),
                 new RestGetUsersAction(settings, getLicenseState()),
                 new RestPutUserAction(settings, getLicenseState()),
                 new RestDeleteUserAction(settings, getLicenseState()),

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/action/privilege/TransportClearPrivilegesCacheAction.java

@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+package org.elasticsearch.xpack.security.action.privilege;
+
+import org.elasticsearch.action.FailedNodeException;
+import org.elasticsearch.action.support.ActionFilters;
+import org.elasticsearch.action.support.nodes.TransportNodesAction;
+import org.elasticsearch.cluster.service.ClusterService;
+import org.elasticsearch.common.inject.Inject;
+import org.elasticsearch.common.io.stream.StreamInput;
+import org.elasticsearch.tasks.Task;
+import org.elasticsearch.threadpool.ThreadPool;
+import org.elasticsearch.transport.TransportService;
+import org.elasticsearch.xpack.core.security.action.privilege.ClearPrivilegesCacheAction;
+import org.elasticsearch.xpack.core.security.action.privilege.ClearPrivilegesCacheRequest;
+import org.elasticsearch.xpack.core.security.action.privilege.ClearPrivilegesCacheResponse;
+import org.elasticsearch.xpack.security.authz.store.CompositeRolesStore;
+import org.elasticsearch.xpack.security.authz.store.NativePrivilegeStore;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+public class TransportClearPrivilegesCacheAction
+    extends TransportNodesAction<ClearPrivilegesCacheRequest, ClearPrivilegesCacheResponse, ClearPrivilegesCacheRequest.Node, ClearPrivilegesCacheResponse.Node> {
+
+    private final NativePrivilegeStore privilegesStore;
+    private final CompositeRolesStore rolesStore;
+
+    @Inject
+    public TransportClearPrivilegesCacheAction(
+        ThreadPool threadPool,
+        ClusterService clusterService,
+        TransportService transportService,
+        ActionFilters actionFilters,
+        NativePrivilegeStore privilegesStore,
+        CompositeRolesStore rolesStore) {
+        super(
+            ClearPrivilegesCacheAction.NAME,
+            threadPool,
+            clusterService,
+            transportService,
+            actionFilters,
+            ClearPrivilegesCacheRequest::new,
+            ClearPrivilegesCacheRequest.Node::new,
+            ThreadPool.Names.MANAGEMENT,
+            ClearPrivilegesCacheResponse.Node.class);
+        this.privilegesStore = privilegesStore;
+        this.rolesStore = rolesStore;
+    }
+
+    @Override
+    protected ClearPrivilegesCacheResponse newResponse(
+        ClearPrivilegesCacheRequest request, List<ClearPrivilegesCacheResponse.Node> nodes, List<FailedNodeException> failures) {
+        return new ClearPrivilegesCacheResponse(clusterService.getClusterName(), nodes, failures);
+    }
+
+    @Override
+    protected ClearPrivilegesCacheRequest.Node newNodeRequest(ClearPrivilegesCacheRequest request) {
+        return new ClearPrivilegesCacheRequest.Node(request);
+    }
+
+    @Override
+    protected ClearPrivilegesCacheResponse.Node newNodeResponse(StreamInput in) throws IOException {
+        return new ClearPrivilegesCacheResponse.Node(in);
+    }
+
+    @Override
+    protected ClearPrivilegesCacheResponse.Node nodeOperation(ClearPrivilegesCacheRequest.Node request, Task task) {
+        if (request.getApplicationNames() == null || request.getApplicationNames().length == 0) {
+            privilegesStore.invalidateAll();
+        } else {
+            privilegesStore.invalidate(Arrays.asList(request.getApplicationNames()));
+        }
+        rolesStore.invalidateAll();
+        return new ClearPrivilegesCacheResponse.Node(clusterService.localNode());
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java

@@ -422,6 +422,7 @@ public static void buildRoleFromDescriptors(Collection<RoleDescriptor> roleDescr
             final Set<String> applicationPrivilegeNames = applicationPrivilegesMap.values().stream()
                     .flatMap(Collection::stream)
                     .collect(Collectors.toSet());
+            // Role itself is cached, so skipping caching for application privileges
             privilegeStore.getPrivileges(applicationNames, applicationPrivilegeNames, ActionListener.wrap(appPrivileges -> {
                 applicationPrivilegesMap.forEach((key, names) -> ApplicationPrivilege.get(key.v1(), names, appPrivileges)
                     .forEach(priv -> builder.addApplicationPrivilege(priv, key.v2())));