4646import static java .util .Map .entry ;
4747import static org .elasticsearch .common .bytes .BytesReferenceTestUtils .equalBytes ;
4848import static org .elasticsearch .xpack .core .security .authc .Authentication .VERSION_API_KEY_ROLES_AS_BYTES ;
49+ import static org .elasticsearch .xpack .core .security .authc .Authentication .VERSION_REALM_DOMAINS ;
4950import static org .elasticsearch .xpack .core .security .authc .AuthenticationTestHelper .randomCloudApiKeyAuthentication ;
5051import static org .elasticsearch .xpack .core .security .authc .AuthenticationTestHelper .randomCrossClusterAccessSubjectInfo ;
5152import static org .elasticsearch .xpack .core .security .authc .CrossClusterAccessSubjectInfoTests .randomRoleDescriptorsIntersection ;
6465
6566public class AuthenticationTests extends ESTestCase {
6667
68+ private static final TransportVersion VERSION_7_0_0 = TransportVersion .fromId (7_00_00_99 );
69+ public static final TransportVersion [] AUTHENTICATION_TRANSPORT_VERSIONS = {
70+ VERSION_7_0_0 ,
71+ Authentication .VERSION_SYNTHETIC_ROLE_NAMES ,
72+ VERSION_API_KEY_ROLES_AS_BYTES ,
73+ Authentication .VERSION_REALM_DOMAINS ,
74+ Authentication .VERSION_METADATA_BEYOND_GENERIC_MAP ,
75+ TransportVersion .current () };
76+
6777 public void testIsFailedRunAs () {
6878 final Authentication failedAuthentication = randomRealmAuthentication (randomBoolean ()).runAs (randomUser (), null );
6979 assertTrue (failedAuthentication .isRunAs ());
@@ -982,11 +992,11 @@ public void testMaybeRewriteForOlderVersionErasesDomainForVersionsBeforeDomains(
982992 final TransportVersion olderVersion = TransportVersionUtils .randomVersionBetween (
983993 random (),
984994 TransportVersions .V_8_0_0 ,
985- TransportVersionUtils .getPreviousVersion (Authentication . VERSION_REALM_DOMAINS )
995+ TransportVersionUtils .getPreviousVersion (VERSION_REALM_DOMAINS )
986996 );
987997 final Authentication authentication = AuthenticationTestHelper .builder ()
988998 .realm () // randomize to test both when realm is null on the original auth and non-null, instead of setting `underDomain`
989- .transportVersion (TransportVersionUtils .randomVersionBetween (random (), Authentication . VERSION_REALM_DOMAINS , null ))
999+ .transportVersion (TransportVersionUtils .randomVersionBetween (random (), VERSION_REALM_DOMAINS , null ))
9901000 .build ();
9911001 assertThat (authentication .getEffectiveSubject ().getTransportVersion ().after (olderVersion ), is (true ));
9921002
@@ -1000,7 +1010,7 @@ public void testMaybeRewriteForOlderVersionErasesDomainForVersionsBeforeDomains(
10001010 public void testMaybeRewriteForOlderVersionDoesNotEraseDomainForVersionsAfterDomains () {
10011011 final TransportVersion olderVersion = TransportVersionUtils .randomVersionBetween (
10021012 random (),
1003- Authentication . VERSION_REALM_DOMAINS ,
1013+ VERSION_REALM_DOMAINS ,
10041014 // Don't include CURRENT, so we always have at least one newer version available below
10051015 TransportVersionUtils .getPreviousVersion ()
10061016 );
@@ -1053,19 +1063,15 @@ public void testMaybeRewriteRealmRef() {
10531063
10541064 assertThat (
10551065 Authentication .maybeRewriteRealmRef (
1056- TransportVersionUtils .randomVersionBetween (
1057- random (),
1058- null ,
1059- TransportVersionUtils .getPreviousVersion (Authentication .VERSION_REALM_DOMAINS )
1060- ),
1066+ TransportVersionUtils .randomVersionBetween (random (), null , TransportVersionUtils .getPreviousVersion (VERSION_REALM_DOMAINS )),
10611067 realmRefWithDomain
10621068 ).getDomain (),
10631069 nullValue ()
10641070 );
10651071
10661072 assertThat (
10671073 Authentication .maybeRewriteRealmRef (
1068- TransportVersionUtils .randomVersionBetween (random (), Authentication . VERSION_REALM_DOMAINS , null ),
1074+ TransportVersionUtils .randomVersionBetween (random (), VERSION_REALM_DOMAINS , null ),
10691075 realmRefWithDomain
10701076 ),
10711077 equalTo (realmRefWithDomain )
@@ -1095,10 +1101,9 @@ public void testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteIndices()
10951101 .build ();
10961102
10971103 // pick a version before that of the authentication instance to force a rewrite
1098- final TransportVersion olderVersion = TransportVersionUtils .randomVersionBetween (
1099- random (),
1104+ final TransportVersion olderVersion = randomTransportVersionBetween (
11001105 VERSION_API_KEY_ROLES_AS_BYTES ,
1101- TransportVersionUtils . getPreviousVersion ( original .getEffectiveSubject ().getTransportVersion () )
1106+ original .getEffectiveSubject ().getTransportVersion ()
11021107 );
11031108
11041109 final Map <String , Object > rewrittenMetadata = original .maybeRewriteForOlderVersion (olderVersion )
@@ -1140,10 +1145,9 @@ public void testMaybeRewriteMetadataForApiKeyRoleDescriptorsWithRemoteCluster()
11401145 .build ();
11411146
11421147 // pick a version before that of the authentication instance to force a rewrite
1143- final TransportVersion olderVersion = TransportVersionUtils .randomVersionBetween (
1144- random (),
1148+ final TransportVersion olderVersion = randomTransportVersionBetween (
11451149 VERSION_API_KEY_ROLES_AS_BYTES ,
1146- TransportVersionUtils . getPreviousVersion ( original .getEffectiveSubject ().getTransportVersion () )
1150+ original .getEffectiveSubject ().getTransportVersion ()
11471151 );
11481152
11491153 final Map <String , Object > rewrittenMetadata = original .maybeRewriteForOlderVersion (olderVersion )
@@ -1323,8 +1327,8 @@ public static Authentication randomAuthentication(User user, RealmRef realmRef,
13231327 realmRef = randomRealmRef (false );
13241328 }
13251329 // If the realm is expected to have a domain, we need a version that's at least compatible with domains
1326- final TransportVersion minVersion = realmRef .getDomain () != null ? Authentication . VERSION_REALM_DOMAINS : TransportVersions . V_7_0_0 ;
1327- final TransportVersion version = TransportVersionUtils . randomVersionBetween ( random (), minVersion , TransportVersion . current () );
1330+ final TransportVersion minVersion = realmRef .getDomain () != null ? VERSION_REALM_DOMAINS : VERSION_7_0_0 ;
1331+ final TransportVersion version = randomTransportVersion ( minVersion );
13281332 final Map <String , Object > metadata ;
13291333 if (randomBoolean ()) {
13301334 metadata = Map .of (randomAlphaOfLengthBetween (3 , 8 ), randomAlphaOfLengthBetween (3 , 8 ));
@@ -1337,13 +1341,37 @@ public static Authentication randomAuthentication(User user, RealmRef realmRef,
13371341 }
13381342
13391343 public static Authentication randomApiKeyAuthentication (User user , String apiKeyId ) {
1340- return randomApiKeyAuthentication (
1341- user ,
1342- apiKeyId ,
1343- TransportVersionUtils .randomVersionBetween (random (), TransportVersions .V_7_0_0 , TransportVersion .current ())
1344+ return randomApiKeyAuthentication (user , apiKeyId , randomTransportVersion ());
1345+ }
1346+
1347+ /**
1348+ * @param minVersion minimum version, inclusive
1349+ * @param maxVersion maximum version, exclusive
1350+ */
1351+ public static TransportVersion randomTransportVersionBetween (TransportVersion minVersion , TransportVersion maxVersion ) {
1352+ return randomFrom (
1353+ Arrays .stream (AUTHENTICATION_TRANSPORT_VERSIONS )
1354+ .filter (v -> v .onOrAfter (minVersion ) && v .before (maxVersion ))
1355+ .toArray (TransportVersion []::new )
1356+ );
1357+ }
1358+
1359+ public static TransportVersion randomTransportVersionBefore (TransportVersion maxVersion ) {
1360+ return randomFrom (
1361+ Arrays .stream (AUTHENTICATION_TRANSPORT_VERSIONS ).filter (v -> v .before (maxVersion )).toArray (TransportVersion []::new )
13441362 );
13451363 }
13461364
1365+ public static TransportVersion randomTransportVersion (TransportVersion minVersion ) {
1366+ return randomFrom (
1367+ Arrays .stream (AUTHENTICATION_TRANSPORT_VERSIONS ).filter (v -> v .onOrAfter (minVersion )).toArray (TransportVersion []::new )
1368+ );
1369+ }
1370+
1371+ public static TransportVersion randomTransportVersion () {
1372+ return randomFrom (AUTHENTICATION_TRANSPORT_VERSIONS );
1373+ }
1374+
13471375 public static Authentication randomApiKeyAuthentication (User user , String apiKeyId , TransportVersion version ) {
13481376 return randomApiKeyAuthentication (
13491377 user ,
0 commit comments