ccsMinimizeRoundtrips
+* option is enabled or disabled. Method {@link #parameters()} is a source of parameters values.
+*/
+@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
+@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
+public class CrossClusterSearchTests {
+
+ private static final String SONG_INDEX_NAME = "song_lyrics";
+
+ private static final String PROHIBITED_SONG_INDEX_NAME = "prohibited_song_lyrics";
+
+ public static final String REMOTE_CLUSTER_NAME = "ccsRemote";
+ public static final String REMOTE_SONG_INDEX = REMOTE_CLUSTER_NAME + ":" + SONG_INDEX_NAME;
+
+ public static final String SONG_ID_1R = "remote-00001";
+ public static final String SONG_ID_2L = "local-00002";
+ public static final String SONG_ID_3R = "remote-00003";
+ public static final String SONG_ID_4L = "local-00004";
+ public static final String SONG_ID_5R = "remote-00005";
+ public static final String SONG_ID_6R = "remote-00006";
+
+ private static final Role LIMITED_ROLE = new Role("limited_role").indexPermissions(
+ "indices:data/read/search",
+ "indices:admin/shards/search_shards"
+ ).on(SONG_INDEX_NAME, "user-${user.name}-${attr.internal.type}");
+
+ private static final Role DLS_ROLE_ROCK = new Role("dls_role_rock").indexPermissions(
+ "indices:data/read/search",
+ "indices:data/read/get",
+ "indices:admin/shards/search_shards"
+ ).dls(String.format("{\"match\":{\"%s\":\"%s\"}}", FIELD_GENRE, GENRE_ROCK)).on(SONG_INDEX_NAME);
+
+ private static final Role DLS_ROLE_JAZZ = new Role("dls_role_jazz").indexPermissions(
+ "indices:data/read/search",
+ "indices:data/read/get",
+ "indices:admin/shards/search_shards"
+ ).dls(String.format("{\"match\":{\"%s\":\"%s\"}}", FIELD_GENRE, GENRE_JAZZ)).on(SONG_INDEX_NAME);
+
+ private static final Role FLS_EXCLUDE_LYRICS_ROLE = new Role("fls_exclude_lyrics_role").indexPermissions(
+ "indices:data/read/search",
+ "indices:data/read/get",
+ "indices:admin/shards/search_shards"
+ ).fls("~" + FIELD_LYRICS).on(SONG_INDEX_NAME);
+
+ private static final Role FLS_INCLUDE_TITLE_ROLE = new Role("fls_include_title_role").indexPermissions(
+ "indices:data/read/search",
+ "indices:data/read/get",
+ "indices:admin/shards/search_shards"
+ ).fls(FIELD_TITLE).on(SONG_INDEX_NAME);
+
+ public static final String TYPE_ATTRIBUTE = "type";
+
+ private static final User ADMIN_USER = new User("admin").roles(ALL_ACCESS).attr(TYPE_ATTRIBUTE, "administrative");
+ private static final User LIMITED_USER = new User("limited_user").attr(TYPE_ATTRIBUTE, "personal");
+
+ private static final User FLS_INCLUDE_TITLE_USER = new User("fls_include_title_user");
+
+ private static final User FLS_EXCLUDE_LYRICS_USER = new User("fls_exclude_lyrics_user");
+
+ private static final User DLS_USER_ROCK = new User("dls-user-rock");
+
+ private static final User DLS_USER_JAZZ = new User("dls-user-jazz");
+
+ public static final String LIMITED_USER_INDEX_NAME = "user-" + LIMITED_USER.getName() + "-" + LIMITED_USER.getAttribute(TYPE_ATTRIBUTE);
+ public static final String ADMIN_USER_INDEX_NAME = "user-" + ADMIN_USER.getName() + "-" + ADMIN_USER.getAttribute(TYPE_ATTRIBUTE);
+
+ private static final TestCertificates TEST_CERTIFICATES = new TestCertificates();
+
+ private final boolean ccsMinimizeRoundtrips;
+
+ public static final String PLUGINS_SECURITY_RESTAPI_ROLES_ENABLED = "plugins.security.restapi.roles_enabled";
+ @ClassRule
+ public static final LocalCluster remoteCluster = new LocalCluster.Builder().certificates(TEST_CERTIFICATES)
+ .clusterManager(ClusterManager.SINGLENODE)
+ .anonymousAuth(false)
+ .clusterName(REMOTE_CLUSTER_NAME)
+ .authc(AUTHC_HTTPBASIC_INTERNAL)
+ .roles(LIMITED_ROLE, DLS_ROLE_ROCK, DLS_ROLE_JAZZ, FLS_EXCLUDE_LYRICS_ROLE, FLS_INCLUDE_TITLE_ROLE)
+ .users(ADMIN_USER)
+ .build();
+
+ @ClassRule
+ public static final LocalCluster cluster = new LocalCluster.Builder().certificates(TEST_CERTIFICATES)
+ .clusterManager(ClusterManager.SINGLE_REMOTE_CLIENT)
+ .anonymousAuth(false)
+ .clusterName("ccsLocal")
+ .nodeSettings(Map.of(PLUGINS_SECURITY_RESTAPI_ROLES_ENABLED, List.of("user_" + ADMIN_USER.getName() + "__" + ALL_ACCESS.getName())))
+ .remote(REMOTE_CLUSTER_NAME, remoteCluster)
+ .roles(LIMITED_ROLE, DLS_ROLE_ROCK, DLS_ROLE_JAZZ, FLS_EXCLUDE_LYRICS_ROLE, FLS_INCLUDE_TITLE_ROLE)
+ .authc(AUTHC_HTTPBASIC_INTERNAL)
+ .users(ADMIN_USER, LIMITED_USER, DLS_USER_ROCK, DLS_USER_JAZZ, FLS_INCLUDE_TITLE_USER, FLS_EXCLUDE_LYRICS_USER)
+ .build();
+
+ @ParametersFactory(shuffle = false)
+ public static Iterableextended-proxy authentication.
+*/
+@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
+@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
+public class ExtendedProxyAuthenticationTest extends CommonProxyAuthenticationTests {
+
+ public static final String ID_ONE_1 = "one#1";
+ public static final String ID_TWO_2 = "two#2";
+ public static final Mapproxy authentication.
+*/
+@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
+@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
+public class ProxyAuthenticationTest extends CommonProxyAuthenticationTests {
+
+ private static final MapLdapAuthenticationConfigBuilder return proper subclass
+* type so that all method defined in subclass are available in one of builder superclass method is invoked. Please see
+* {@link LdapAuthorizationConfigBuilder}
+*/
+public class LdapAuthenticationConfigBuilderthis
+ */
+ private final T builderSubclass;
+
+ protected LdapAuthenticationConfigBuilder(Functionrole
+ * @param role OpenSearch role, must not be null.
+ */
+ public RolesMapping(Role role) {
+ requireNonNull(role);
+ this.roleName = requireNonNull(role.getName());
+ this.backendRoles = new ArrayList<>();
+ this.hostIPs = new ArrayList<>();
+ }
+
+ /**
+ * Defines backend role names
+ * @param backendRoles backend roles names
+ * @return current {@link RolesMapping} instance
+ */
+ public RolesMapping backendRoles(String... backendRoles) {
+ this.backendRoles.addAll(Arrays.asList(backendRoles));
+ return this;
+ }
+
+ /**
+ * Defines host IP address
+ * @param hostIPs host IP address
+ * @return current {@link RolesMapping} instance
+ */
+ public RolesMapping hostIPs(String... hostIPs) {
+ this.hostIPs.addAll(Arrays.asList(hostIPs));
+ return this;
+ }
+
+ /**
+ * Determines if role is reserved
+ * @param reserved true for reserved roles
+ * @return current {@link RolesMapping} instance
+ */
+ public RolesMapping reserved(boolean reserved) {
+ this.reserved = reserved;
+ return this;
+ }
+
+ /**
+ * Returns OpenSearch role name
+ * @return role name
+ */
+ public String getRoleName() {
+ return roleName;
+ }
+
+ /**
+ * Controls serialization to JSON
+ * @param xContentBuilder must not be null
+ * @param params not used parameter, but required by the interface {@link ToXContentObject}
+ * @return builder form parameter xContentBuilder
+ * @throws IOException denotes error during serialization to JSON
+ */
+ @Override
+ public XContentBuilder toXContent(XContentBuilder xContentBuilder, Params params) throws IOException {
+ xContentBuilder.startObject();
+ xContentBuilder.field("reserved", reserved);
+ xContentBuilder.field("backend_roles", backendRoles);
+ xContentBuilder.field("hosts", hostIPs);
+ xContentBuilder.endObject();
+ return xContentBuilder;
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/TestIndex.java b/src/integrationTest/java/org/opensearch/test/framework/TestIndex.java
new file mode 100644
index 0000000000..6f6bd935a5
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/TestIndex.java
@@ -0,0 +1,83 @@
+/*
+* Copyright 2021-2022 floragunn GmbH
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+*/
+
+/*
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+* Modifications Copyright OpenSearch Contributors. See
+* GitHub history for details.
+*/
+
+package org.opensearch.test.framework;
+
+import org.opensearch.action.admin.indices.create.CreateIndexRequest;
+import org.opensearch.client.Client;
+import org.opensearch.common.settings.Settings;
+
+public class TestIndex {
+
+ private final String name;
+ private final Settings settings;
+
+ public TestIndex(String name, Settings settings) {
+ this.name = name;
+ this.settings = settings;
+
+ }
+
+ public void create(Client client) {
+ client.admin().indices().create(new CreateIndexRequest(name).settings(settings)).actionGet();
+ }
+
+ public String getName() {
+ return name;
+ }
+
+ public static Builder name(String name) {
+ return new Builder().name(name);
+ }
+
+ public static class Builder {
+ private String name;
+ private Settings.Builder settings = Settings.builder();
+
+ public Builder name(String name) {
+ this.name = name;
+ return this;
+ }
+
+ public Builder setting(String name, int value) {
+ settings.put(name, value);
+ return this;
+ }
+
+ public Builder shards(int value) {
+ settings.put("index.number_of_shards", 5);
+ return this;
+ }
+
+ public TestIndex build() {
+ return new TestIndex(name, settings.build());
+ }
+
+ }
+
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/TestSecurityConfig.java b/src/integrationTest/java/org/opensearch/test/framework/TestSecurityConfig.java
new file mode 100644
index 0000000000..2fd3fc474d
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/TestSecurityConfig.java
@@ -0,0 +1,731 @@
+/*
+* Copyright 2021 floragunn GmbH
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+*/
+
+/*
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+* Modifications Copyright OpenSearch Contributors. See
+* GitHub history for details.
+*/
+
+package org.opensearch.test.framework;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.nio.ByteBuffer;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.bouncycastle.crypto.generators.OpenBSDBCrypt;
+
+import org.opensearch.action.admin.indices.create.CreateIndexRequest;
+import org.opensearch.action.index.IndexRequest;
+import org.opensearch.action.update.UpdateRequest;
+import org.opensearch.client.Client;
+import org.opensearch.core.common.bytes.BytesReference;
+import org.opensearch.common.xcontent.XContentFactory;
+import org.opensearch.core.xcontent.ToXContentObject;
+import org.opensearch.core.xcontent.XContentBuilder;
+import org.opensearch.security.securityconf.impl.CType;
+import org.opensearch.test.framework.cluster.OpenSearchClientProvider.UserCredentialsHolder;
+
+import static org.apache.http.HttpHeaders.AUTHORIZATION;
+import static org.opensearch.action.support.WriteRequest.RefreshPolicy.IMMEDIATE;
+
+/**
+* This class allows the declarative specification of the security configuration; in particular:
+*
+* - config.yml
+* - internal_users.yml
+* - roles.yml
+* - roles_mapping.yml
+*
+* The class does the whole round-trip, i.e., the configuration is serialized to YAML/JSON and then written to
+* the configuration index of the security plugin.
+*/
+public class TestSecurityConfig {
+
+ private static final Logger log = LogManager.getLogger(TestSecurityConfig.class);
+
+ private Config config = new Config();
+ private Map
+* XFF is an abbreviation of X-Forwarded-For. X-Forwarded-For is an HTTP header which contains client source IP address
+* and additionally IP addresses of proxies which forward the request.
+* The X-Forwarded-For header is used by HTTP authentication of type
+*
proxy defined by class {@link org.opensearch.security.http.HTTPProxyAuthenticator}extended-proxy defined by the class {@link org.opensearch.security.http.proxy.HTTPExtendedProxyAuthenticator}+* The above authenticators use the X-Forwarded-For to determine if an HTTP request comes from trusted proxies. The trusted proxies +* are defined by a regular expression {@link #internalProxiesRegexp}. The proxy authentication can be applied only to HTTP requests +* which were forwarded by trusted HTTP proxies. +*
+* +*+* The class can be serialized to JSON and then stored in an OpenSearch index which contains security plugin configuration. +*
+*/ +public class XffConfig implements ToXContentObject { + + private final boolean enabled; + + /** + * Regular expression used to determine if HTTP proxy is trusted or not. IP address of trusted proxies must match the regular + * expression defined by the below field. + */ + private String internalProxiesRegexp; + + private String remoteIpHeader; + + public XffConfig(boolean enabled) { + this.enabled = enabled; + } + + /** + * Builder-like method used to set value of the field {@link #internalProxiesRegexp} + * @param internalProxiesRegexp regular expression which matches IP address of a HTTP proxies if the proxies are trusted. + * @return builder + */ + public XffConfig internalProxiesRegexp(String internalProxiesRegexp) { + this.internalProxiesRegexp = internalProxiesRegexp; + return this; + } + + public XffConfig remoteIpHeader(String remoteIpHeader) { + this.remoteIpHeader = remoteIpHeader; + return this; + } + + @Override + public XContentBuilder toXContent(XContentBuilder xContentBuilder, Params params) throws IOException { + xContentBuilder.startObject(); + xContentBuilder.field("enabled", enabled); + xContentBuilder.field("internalProxies", internalProxiesRegexp); + if (StringUtils.isNoneBlank(remoteIpHeader)) { + xContentBuilder.field("remoteIpHeader", remoteIpHeader); + } + xContentBuilder.endObject(); + return xContentBuilder; + } +} diff --git a/src/integrationTest/java/org/opensearch/test/framework/audit/AuditLogsRule.java b/src/integrationTest/java/org/opensearch/test/framework/audit/AuditLogsRule.java new file mode 100644 index 0000000000..3d13d731eb --- /dev/null +++ b/src/integrationTest/java/org/opensearch/test/framework/audit/AuditLogsRule.java @@ -0,0 +1,137 @@ +/* +* Copyright OpenSearch Contributors +* SPDX-License-Identifier: Apache-2.0 +* +* The OpenSearch Contributors require contributions made to +* this file be licensed under the Apache-2.0 license or a +* compatible open source license. +* +*/ +package org.opensearch.test.framework.audit; + +import java.util.ArrayList; +import java.util.List; +import java.util.concurrent.TimeUnit; +import java.util.function.Predicate; +import java.util.stream.Collectors; + +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; +import org.awaitility.Awaitility; +import org.awaitility.core.ConditionTimeoutException; +import org.hamcrest.Matcher; +import org.junit.rules.TestRule; +import org.junit.runner.Description; +import org.junit.runners.model.Statement; + +import org.opensearch.security.auditlog.impl.AuditMessage; + +import static java.util.Collections.synchronizedList; +import static org.hamcrest.MatcherAssert.assertThat; +import static org.hamcrest.Matchers.allOf; +import static org.hamcrest.Matchers.greaterThanOrEqualTo; +import static org.hamcrest.Matchers.lessThanOrEqualTo; +import static org.opensearch.test.framework.matcher.AuditMessageMatchers.atLeastCertainNumberOfAuditsFulfillPredicate; +import static org.opensearch.test.framework.matcher.AuditMessageMatchers.exactNumberOfAuditsFulfillPredicate; + +public class AuditLogsRule implements TestRule { + + private static final Logger log = LogManager.getLogger(AuditLogsRule.class); + + private Listnull for unencrypted key.
+ * @return private key encoded in PEM format
+ */
+ public String privateKeyInPemFormat(String privateKeyPassword) {
+ return PemConverter.toPem(keyPair.getPrivate(), privateKeyPassword);
+ }
+
+ X500Name getCertificateSubject() {
+ return certificate.getSubject();
+ }
+
+ KeyPair getKeyPair() {
+ return keyPair;
+ }
+
+ public Key getKey() {
+ return keyPair.getPrivate();
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificateMetadata.java b/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificateMetadata.java
new file mode 100644
index 0000000000..cc94621f72
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificateMetadata.java
@@ -0,0 +1,220 @@
+/*
+* Copyright OpenSearch Contributors
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+*/
+package org.opensearch.test.framework.certificate;
+
+// CS-SUPPRESS-SINGLE: RegexpSingleline Extension is used to refer to certificate extensions, keeping this rule disable for the whole file
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Set;
+
+import com.google.common.base.Strings;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.KeyPurposeId;
+import org.bouncycastle.asn1.x509.KeyUsage;
+
+import static java.util.Arrays.asList;
+import static java.util.Collections.emptyList;
+import static java.util.Collections.emptySet;
+import static java.util.Objects.requireNonNull;
+
+/**
+* +* The class represents metadata which should be embedded in certificate to describe a certificate subject (person, company, web server, +* IoT device). The class contains some basic metadata and metadata which should be placed in certificate extensions. +*
+* +*+* The class is immutable. +*
+* +*/ +class CertificateMetadata { + /** + * Certification subject (person, company, web server, IoT device). The subject of certificate is an owner of the certificate + * (simplification). The format of this field must adhere to RFC 4514. + * @see RFC 4514 + */ + private final String subject; + + /** + * It describes certificate expiration date + */ + private final int validityDays; + + /** + * Optionally used by Open Search to indicate that the certificate can be used by Open Search node to confirm the node identity. The + * value becomes a part of + * SAN (Subject Alternative Name) extension + * + * @see #dnsNames + * @see SAN (Subject Alternative Name) extension + */ + private final String nodeOid; + + /** + * The certificate contains only one {@link #subject}. This is a common limitation when a certificate is used by a web server which is + * associated with a few domains. To overcome this limitation SAN (Subject Alternative Name) extension was introduced. + * The field contains additional subject names which enables creation of so called multi-domain certificates. The extension is defined + * in section 4.2.1.6 of RFC 5280 + * + * @see RFC 5280 + */ + private final Listtrue.
+ */
+ private final boolean basicConstrainIsCa;
+
+ /**
+ * Allowed usages for public key associated with certificate
+ */
+ private final Set+* The class is used to generate public key certificate. The class hides low level details related to certificate creation and +* usage of underlying Bouncy Castle library. +*
+*+* The public key certificate according to its name contains a public key and some metadata. The metadata describes an entity (human, +* company, web server, IoT device, etc.) which is an owner of private key associated with the certificate (private key is not included +* into certificate and is a kind of secret). The responsibility of the class is to issue a certificate. To issue a certificate it is +* necessary to provide metadata which is embedded in the certificates. The metadata is represented by the class +* {@link CertificateMetadata}. Furthermore, the class needs a public key which also must be embedded in the certificate. To obtain public +* and private key pair the class uses {@link AlgorithmKit}. The result of creating certificate is data structure {@link CertificateData}. +* The class {@link CertificateData} contains entire information which is necessary to use the certificate by its owner, that is: +* certificate and private key. +*
+* +*+* The class is able to create self-signed certificates or certificates signed by some entity. To create a self signed certificate +* the method {@link #issueSignedCertificate(CertificateMetadata, CertificateData)} is used, whereas to create signed certificates +* the method {@link #issueSignedCertificate(CertificateMetadata, CertificateData)} is employed. +*
+*+* The instance of the class can be obtained by invocation of static method defined in class {@link CertificatesIssuerFactory}. +*
+*/ +class CertificatesIssuer { + + private static final Logger log = LogManager.getLogger(CertificatesIssuer.class); + + private static final AtomicLong ID_COUNTER = new AtomicLong(System.currentTimeMillis()); + + private final Provider securityProvider; + private final AlgorithmKit algorithmKit; + private final JcaX509ExtensionUtils extUtils; + + CertificatesIssuer(Provider securityProvider, AlgorithmKit algorithmKit) { + this.securityProvider = securityProvider; + this.algorithmKit = algorithmKit; + this.extUtils = getExtUtils(); + } + + /** + * The method creates a certificate with provided metadata and public key obtained from {@link #algorithmKit}. The result of invocation + * contains required data to use a certificate by its owner. + * + * @param certificateMetadata metadata which should be embedded into created certificate + * @return {@link CertificateData} which contain certificate and private key associated with the certificate. + */ + public CertificateData issueSelfSignedCertificate(CertificateMetadata certificateMetadata) { + try { + KeyPair publicAndPrivateKey = algorithmKit.generateKeyPair(); + X500Name issuerName = stringToX500Name(requireNonNull(certificateMetadata.getSubject(), "Certificate metadata are required.")); + X509CertificateHolder x509CertificateHolder = buildCertificateHolder( + certificateMetadata, + issuerName, + publicAndPrivateKey.getPublic(), + publicAndPrivateKey + ); + return new CertificateData(x509CertificateHolder, publicAndPrivateKey); + } catch (OperatorCreationException | CertIOException e) { + log.error("Error while generating certificate", e); + throw new RuntimeException("Error while generating self signed certificate", e); + } + } + + /** + * The method is similar to {@link #issueSignedCertificate(CertificateMetadata, CertificateData)} but additionally it signs created + * certificate using data fromparentCertificateData.
+ *
+ * @param metadata metadata which should be embedded into created certificate
+ * @param parentCertificateData data required to signe a newly issued certificate (private key among others things).
+ * @return {@link CertificateData} which contain certificate and private key associated with the certificate.
+ */
+ public CertificateData issueSignedCertificate(CertificateMetadata metadata, CertificateData parentCertificateData) {
+ try {
+ KeyPair publicAndPrivateKey = algorithmKit.generateKeyPair();
+ KeyPair parentKeyPair = requireNonNull(parentCertificateData, "Issuer certificate data are required").getKeyPair();
+ X500Name issuerName = parentCertificateData.getCertificateSubject();
+ var x509CertificateHolder = buildCertificateHolder(
+ requireNonNull(metadata, "Certificate metadata are required"),
+ issuerName,
+ publicAndPrivateKey.getPublic(),
+ parentKeyPair
+ );
+ return new CertificateData(x509CertificateHolder, publicAndPrivateKey);
+ } catch (OperatorCreationException | CertIOException e) {
+ log.error("Error while generating signed certificate", e);
+ throw new RuntimeException("Error while generating signed certificate", e);
+ }
+ }
+
+ private X509CertificateHolder buildCertificateHolder(
+ CertificateMetadata certificateMetadata,
+ X500Name issuerName,
+ PublicKey certificatePublicKey,
+ KeyPair parentKeyPair
+ ) throws CertIOException, OperatorCreationException {
+ X509v3CertificateBuilder builder = builderWithBasicExtensions(
+ certificateMetadata,
+ issuerName,
+ certificatePublicKey,
+ parentKeyPair.getPublic()
+ );
+ addSubjectAlternativeNameExtension(builder, certificateMetadata);
+ addExtendedKeyUsageExtension(builder, certificateMetadata);
+ return builder.build(createContentSigner(parentKeyPair.getPrivate()));
+ }
+
+ private ContentSigner createContentSigner(PrivateKey privateKey) throws OperatorCreationException {
+ return new JcaContentSignerBuilder(algorithmKit.getSignatureAlgorithmName()).setProvider(securityProvider).build(privateKey);
+ }
+
+ private void addExtendedKeyUsageExtension(X509v3CertificateBuilder builder, CertificateMetadata certificateMetadata)
+ throws CertIOException {
+ if (certificateMetadata.hasExtendedKeyUsage()) {
+ builder.addExtension(Extension.extendedKeyUsage, true, certificateMetadata.getExtendedKeyUsage());
+ }
+ }
+
+ private X509v3CertificateBuilder builderWithBasicExtensions(
+ CertificateMetadata certificateMetadata,
+ X500Name issuerName,
+ PublicKey certificatePublicKey,
+ PublicKey parentPublicKey
+ ) throws CertIOException {
+ X500Name subjectName = stringToX500Name(certificateMetadata.getSubject());
+ Date validityStartDate = new Date(System.currentTimeMillis() - (24 * 3600 * 1000));
+ Date validityEndDate = getEndDate(validityStartDate, certificateMetadata.getValidityDays());
+
+ BigInteger certificateSerialNumber = generateNextCertificateSerialNumber();
+ return new X509v3CertificateBuilder(
+ issuerName,
+ certificateSerialNumber,
+ validityStartDate,
+ validityEndDate,
+ subjectName,
+ SubjectPublicKeyInfo.getInstance(certificatePublicKey.getEncoded())
+ ).addExtension(Extension.basicConstraints, true, new BasicConstraints(certificateMetadata.isBasicConstrainIsCa()))
+ .addExtension(Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(parentPublicKey))
+ .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(certificatePublicKey))
+ .addExtension(Extension.keyUsage, true, certificateMetadata.asKeyUsage());
+ }
+
+ private void addSubjectAlternativeNameExtension(X509v3CertificateBuilder builder, CertificateMetadata metadata) throws CertIOException {
+ if (metadata.hasSubjectAlternativeNameExtension()) {
+ DERSequence subjectAlternativeNames = metadata.createSubjectAlternativeNames();
+ builder.addExtension(Extension.subjectAlternativeName, false, subjectAlternativeNames);
+ }
+ }
+
+ private Date getEndDate(Date startDate, int validityDays) {
+ Calendar calendar = Calendar.getInstance();
+ calendar.setTime(startDate);
+ calendar.add(Calendar.DATE, validityDays);
+ return calendar.getTime();
+ }
+
+ private static JcaX509ExtensionUtils getExtUtils() {
+ try {
+ return new JcaX509ExtensionUtils();
+ } catch (NoSuchAlgorithmException e) {
+ log.error("Getting certificate extension utils failed", e);
+ throw new RuntimeException("Getting certificate extension utils failed", e);
+ }
+ }
+
+ private X500Name stringToX500Name(String distinguishedName) {
+ if (Strings.isNullOrEmpty(distinguishedName)) {
+ throw new RuntimeException("No DN (distinguished name) must not be null or empty");
+ }
+ try {
+ return new X500Name(RFC4519Style.INSTANCE, distinguishedName);
+ } catch (IllegalArgumentException e) {
+ String message = String.format("Invalid DN (distinguished name) specified for %s certificate.", distinguishedName);
+ throw new RuntimeException(message, e);
+ }
+ }
+
+ private BigInteger generateNextCertificateSerialNumber() {
+ return BigInteger.valueOf(ID_COUNTER.incrementAndGet());
+ }
+}
+// CS-ENFORCE-SINGLE
diff --git a/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificatesIssuerFactory.java b/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificatesIssuerFactory.java
new file mode 100644
index 0000000000..f68ccf6022
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/certificate/CertificatesIssuerFactory.java
@@ -0,0 +1,68 @@
+/*
+* Copyright OpenSearch Contributors
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+*/
+package org.opensearch.test.framework.certificate;
+
+import java.security.Provider;
+import java.util.Optional;
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import static org.opensearch.test.framework.certificate.AlgorithmKit.ecdsaSha256withEcdsa;
+import static org.opensearch.test.framework.certificate.AlgorithmKit.rsaSha256withRsa;
+
+/**
+* The class defines static factory method for class {@link CertificatesIssuer}. Object of class {@link CertificatesIssuer} created by
+* various factory methods differs in terms of cryptographic algorithms used for certificates creation.
+*
+*/
+class CertificatesIssuerFactory {
+
+ private static final int KEY_SIZE = 2048;
+
+ private CertificatesIssuerFactory() {
+
+ }
+
+ private static final Provider DEFAULT_SECURITY_PROVIDER = new BouncyCastleProvider();
+
+ /**
+ * @see {@link #rsaBaseCertificateIssuer(Provider)}
+ */
+ public static CertificatesIssuer rsaBaseCertificateIssuer() {
+ return rsaBaseCertificateIssuer(null);
+ }
+
+ /**
+ * The method creates {@link CertificatesIssuer} which uses RSA algorithm for certificate creation.
+ * @param securityProvider determines cryptographic algorithm implementation, can be null.
+ * @return new instance of {@link CertificatesIssuer}
+ */
+ public static CertificatesIssuer rsaBaseCertificateIssuer(Provider securityProvider) {
+ Provider provider = Optional.ofNullable(securityProvider).orElse(DEFAULT_SECURITY_PROVIDER);
+ return new CertificatesIssuer(provider, rsaSha256withRsa(provider, KEY_SIZE));
+ }
+
+ /**
+ * {@link #rsaBaseCertificateIssuer(Provider)}
+ */
+ public static CertificatesIssuer ecdsaBaseCertificatesIssuer() {
+ return ecdsaBaseCertificatesIssuer(null);
+ }
+
+ /**
+ * It creates {@link CertificatesIssuer} which uses asymmetric cryptography algorithm which relays on elliptic curves.
+ * @param securityProvider determines cryptographic algorithm implementation, can be null.
+ * @return new instance of {@link CertificatesIssuer}
+ */
+ public static CertificatesIssuer ecdsaBaseCertificatesIssuer(Provider securityProvider) {
+ Provider provider = Optional.ofNullable(securityProvider).orElse(DEFAULT_SECURITY_PROVIDER);
+ return new CertificatesIssuer(provider, ecdsaSha256withEcdsa(securityProvider, "P-384"));
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/certificate/PemConverter.java b/src/integrationTest/java/org/opensearch/test/framework/certificate/PemConverter.java
new file mode 100644
index 0000000000..749ab232bc
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/certificate/PemConverter.java
@@ -0,0 +1,119 @@
+/*
+* Copyright OpenSearch Contributors
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+*/
+/*
+* Copyright 2021 floragunn GmbH
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+*/
+
+package org.opensearch.test.framework.certificate;
+
+import java.io.IOException;
+import java.io.StringWriter;
+import java.io.Writer;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
+
+import com.google.common.base.Strings;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.openssl.PKCS8Generator;
+import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
+import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8EncryptorBuilder;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.OutputEncryptor;
+import org.bouncycastle.util.io.pem.PemGenerationException;
+import org.bouncycastle.util.io.pem.PemObject;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+* The class provides a method useful for converting certificate and private key into PEM format
+* @see RFC 1421
+*/
+class PemConverter {
+
+ private PemConverter() {}
+
+ private static final Logger log = LogManager.getLogger(PemConverter.class);
+ private static final SecureRandom secureRandom = new SecureRandom();
+
+ /**
+ * It converts certificate represented by {@link X509CertificateHolder} object to PEM format
+ * @param certificate is a certificate to convert
+ * @return {@link String} which contains PEM encoded certificate
+ */
+ public static String toPem(X509CertificateHolder certificate) {
+ StringWriter stringWriter = new StringWriter();
+ try (JcaPEMWriter writer = new JcaPEMWriter(stringWriter)) {
+ writer.writeObject(requireNonNull(certificate, "Certificate is required."));
+ } catch (Exception e) {
+ throw new RuntimeException("Cannot write certificate in PEM format", e);
+ }
+ return stringWriter.toString();
+ }
+
+ /**
+ * It converts private key represented by class {@link PrivateKey} to PEM format.
+ * @param privateKey is a private key, cannot be null
+ * @param privateKeyPassword is a password used to encode private key, null for unencrypted private key
+ * @return {@link String} which contains PEM encoded private key
+ */
+ public static String toPem(PrivateKey privateKey, String privateKeyPassword) {
+ try (StringWriter stringWriter = new StringWriter()) {
+ savePrivateKey(stringWriter, requireNonNull(privateKey, "Private key is required."), privateKeyPassword);
+ return stringWriter.toString();
+ } catch (IOException e) {
+ throw new RuntimeException("Cannot convert private key into PEM format.", e);
+ }
+ }
+
+ private static void savePrivateKey(Writer out, PrivateKey privateKey, String privateKeyPassword) {
+ try (JcaPEMWriter writer = new JcaPEMWriter(out)) {
+ writer.writeObject(createPkcs8PrivateKeyPem(privateKey, privateKeyPassword));
+ } catch (Exception e) {
+ log.error("Error while writing private key.", e);
+ throw new RuntimeException("Error while writing private key ", e);
+ }
+ }
+
+ private static PemObject createPkcs8PrivateKeyPem(PrivateKey privateKey, String password) {
+ try {
+ OutputEncryptor outputEncryptor = password == null ? null : getPasswordEncryptor(password);
+ return new PKCS8Generator(PrivateKeyInfo.getInstance(privateKey.getEncoded()), outputEncryptor).generate();
+ } catch (PemGenerationException | OperatorCreationException e) {
+ log.error("Creating PKCS8 private key failed", e);
+ throw new RuntimeException("Creating PKCS8 private key failed", e);
+ }
+ }
+
+ private static OutputEncryptor getPasswordEncryptor(String password) throws OperatorCreationException {
+ if (!Strings.isNullOrEmpty(password)) {
+ JceOpenSSLPKCS8EncryptorBuilder encryptorBuilder = new JceOpenSSLPKCS8EncryptorBuilder(PKCS8Generator.PBE_SHA1_3DES);
+ encryptorBuilder.setRandom(secureRandom);
+ encryptorBuilder.setPassword(password.toCharArray());
+ return encryptorBuilder.build();
+ }
+ return null;
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/certificate/PublicKeyUsage.java b/src/integrationTest/java/org/opensearch/test/framework/certificate/PublicKeyUsage.java
new file mode 100644
index 0000000000..af37c66001
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/certificate/PublicKeyUsage.java
@@ -0,0 +1,75 @@
+/*
+* Copyright OpenSearch Contributors
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+*/
+package org.opensearch.test.framework.certificate;
+
+import java.util.Objects;
+
+import org.bouncycastle.asn1.x509.KeyPurposeId;
+import org.bouncycastle.asn1.x509.KeyUsage;
+
+// CS-SUPPRESS-SINGLE: RegexpSingleline Extension is used to refer to certificate extensions
+/**
+* The class is associated with certificate extensions related to key usages. These extensions are defined by
+* RFC 5280 and describes allowed usage of public kay which is embedded in
+* certificate. The class is related to the following extensions:
+*
+*
+* @see RFC 5280
+*/
+// CS-ENFORCE-SINGLE
+enum PublicKeyUsage {
+ DIGITAL_SIGNATURE(KeyUsage.digitalSignature),
+ KEY_CERT_SIGN(KeyUsage.keyCertSign),
+ CRL_SIGN(KeyUsage.cRLSign),
+ NON_REPUDIATION(KeyUsage.nonRepudiation),
+ KEY_ENCIPHERMENT(KeyUsage.keyEncipherment),
+
+ SERVER_AUTH(KeyPurposeId.id_kp_serverAuth),
+
+ CLIENT_AUTH(KeyPurposeId.id_kp_clientAuth);
+
+ private final int keyUsage;
+ private final KeyPurposeId id;
+
+ PublicKeyUsage(int keyUsage) {
+ this.keyUsage = keyUsage;
+ this.id = null;
+ }
+
+ PublicKeyUsage(KeyPurposeId id) {
+ this.id = Objects.requireNonNull(id, "Key purpose id is required.");
+ this.keyUsage = 0;
+ }
+
+ boolean isExtendedUsage() {
+ return this.id != null;
+ }
+
+ boolean isNotExtendedUsage() {
+ return this.id == null;
+ }
+
+ int asInt() {
+ if (isExtendedUsage()) {
+ throw new RuntimeException("Integer value is not available for extended key usage");
+ }
+ return keyUsage;
+ }
+
+ KeyPurposeId getKeyPurposeId() {
+ if (isExtendedUsage() == false) {
+ throw new RuntimeException("Key purpose id is not available.");
+ }
+ return id;
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/certificate/TestCertificates.java b/src/integrationTest/java/org/opensearch/test/framework/certificate/TestCertificates.java
new file mode 100644
index 0000000000..2dd1dd5eea
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/certificate/TestCertificates.java
@@ -0,0 +1,214 @@
+/*
+* Copyright 2021 floragunn GmbH
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+*/
+
+/*
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+* Modifications Copyright OpenSearch Contributors. See
+* GitHub history for details.
+*/
+
+package org.opensearch.test.framework.certificate;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.CLIENT_AUTH;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.CRL_SIGN;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.DIGITAL_SIGNATURE;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.KEY_CERT_SIGN;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.KEY_ENCIPHERMENT;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.NON_REPUDIATION;
+import static org.opensearch.test.framework.certificate.PublicKeyUsage.SERVER_AUTH;
+
+/**
+* It provides TLS certificates required in test cases. The certificates are generated during process of creation objects of the class.
+* The class exposes method which can be used to write certificates and private keys in temporally files.
+*/
+public class TestCertificates {
+
+ private static final Logger log = LogManager.getLogger(TestCertificates.class);
+
+ public static final Integer MAX_NUMBER_OF_NODE_CERTIFICATES = 3;
+
+ private static final String CA_SUBJECT = "DC=com,DC=example,O=Example Com Inc.,OU=Example Com Inc. Root CA,CN=Example Com Inc. Root CA";
+ private static final String ADMIN_DN = "CN=kirk,OU=client,O=client,L=test,C=de";
+ private static final int CERTIFICATE_VALIDITY_DAYS = 365;
+ private static final String CERTIFICATE_FILE_EXT = ".cert";
+ private static final String KEY_FILE_EXT = ".key";
+ private final CertificateData caCertificate;
+ private final CertificateData adminCertificate;
+ private final Listnull to retrieve unencrypted key.
+ * @return file which contains private key encoded in PEM format, defined
+ * by RFC 1421
+ */
+ public File getNodeKey(int node, String privateKeyPassword) {
+ CertificateData certificateData = nodeCertificates.get(node);
+ return createTempFile("node-" + node, KEY_FILE_EXT, certificateData.privateKeyInPemFormat(privateKeyPassword));
+ }
+
+ /**
+ * Certificate which proofs admin user identity. Certificate is derived from root certificate returned by
+ * method {@link #getRootCertificate()}
+ * @return file which contains certificate in PEM format, defined by RFC 1421
+ */
+ public File getAdminCertificate() {
+ return createTempFile("admin", CERTIFICATE_FILE_EXT, adminCertificate.certificateInPemFormat());
+ }
+
+ public CertificateData getAdminCertificateData() {
+ return adminCertificate;
+ }
+
+ /**
+ * It returns private key associated with admin certificate returned by {@link #getAdminCertificate()}.
+ *
+ * @param privateKeyPassword is a password used to encode private key, can be null to retrieve unencrypted key.
+ * @return file which contains private key encoded in PEM format, defined
+ * by RFC 1421
+ */
+ public File getAdminKey(String privateKeyPassword) {
+ return createTempFile("admin", KEY_FILE_EXT, adminCertificate.privateKeyInPemFormat(privateKeyPassword));
+ }
+
+ public String[] getAdminDNs() {
+ return new String[] { ADMIN_DN };
+ }
+
+ private File createTempFile(String name, String suffix, String contents) {
+ try {
+ Path path = Files.createTempFile(name, suffix);
+ Files.writeString(path, contents);
+ return path.toFile();
+ } catch (IOException ex) {
+ throw new RuntimeException("Cannot create temp file with name " + name + " and suffix " + suffix);
+ }
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/cluster/CloseableHttpClientFactory.java b/src/integrationTest/java/org/opensearch/test/framework/cluster/CloseableHttpClientFactory.java
new file mode 100644
index 0000000000..a6a0324b27
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/cluster/CloseableHttpClientFactory.java
@@ -0,0 +1,81 @@
+/*
+* Copyright OpenSearch Contributors
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+*/
+package org.opensearch.test.framework.cluster;
+
+import java.util.Objects;
+import java.util.concurrent.TimeUnit;
+
+import javax.net.ssl.SSLContext;
+
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.HttpClientConnectionManager;
+import org.apache.http.conn.routing.HttpRoutePlanner;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+
+class CloseableHttpClientFactory {
+
+ private final SSLContext sslContext;
+
+ private final RequestConfig requestConfig;
+
+ private final HttpRoutePlanner routePlanner;
+
+ private final String[] supportedCipherSuites;
+
+ public CloseableHttpClientFactory(
+ SSLContext sslContext,
+ RequestConfig requestConfig,
+ HttpRoutePlanner routePlanner,
+ String[] supportedCipherSuit
+ ) {
+ this.sslContext = Objects.requireNonNull(sslContext, "SSL context is required.");
+ this.requestConfig = requestConfig;
+ this.routePlanner = routePlanner;
+ this.supportedCipherSuites = supportedCipherSuit;
+ }
+
+ public CloseableHttpClient getHTTPClient() {
+
+ final HttpClientBuilder hcb = HttpClients.custom();
+
+ final SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
+ this.sslContext,
+ /* Uses default supported protocals */ null,
+ supportedCipherSuites,
+ NoopHostnameVerifier.INSTANCE
+ );
+
+ final HttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(
+ RegistryBuilder.null.
+ */
+ public LocalAddressRoutePlanner(InetAddress localAddress) {
+ super(DefaultSchemePortResolver.INSTANCE);
+ this.localAddress = Objects.requireNonNull(localAddress);
+ }
+
+ @Override
+ public HttpRoute determineRoute(final HttpHost host, final HttpRequest request, final HttpContext context) throws HttpException {
+ final HttpClientContext clientContext = HttpClientContext.adapt(context);
+ final RequestConfig localRequsetConfig = RequestConfig.copy(clientContext.getRequestConfig())
+ .setLocalAddress(this.localAddress)
+ .build();
+ clientContext.setRequestConfig(localRequsetConfig);
+
+ return super.determineRoute(host, request, clientContext);
+ }
+}
diff --git a/src/integrationTest/java/org/opensearch/test/framework/cluster/LocalCluster.java b/src/integrationTest/java/org/opensearch/test/framework/cluster/LocalCluster.java
new file mode 100644
index 0000000000..64207ead5b
--- /dev/null
+++ b/src/integrationTest/java/org/opensearch/test/framework/cluster/LocalCluster.java
@@ -0,0 +1,534 @@
+/*
+* Copyright 2015-2021 floragunn GmbH
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*
+*/
+
+/*
+* SPDX-License-Identifier: Apache-2.0
+*
+* The OpenSearch Contributors require contributions made to
+* this file be licensed under the Apache-2.0 license or a
+* compatible open source license.
+*
+* Modifications Copyright OpenSearch Contributors. See
+* GitHub history for details.
+*/
+
+package org.opensearch.test.framework.cluster;
+
+import java.net.InetSocketAddress;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Random;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.stream.Collectors;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.junit.rules.ExternalResource;
+
+import org.opensearch.client.Client;
+import org.opensearch.common.settings.Settings;
+import org.opensearch.node.PluginAwareNode;
+import org.opensearch.plugins.Plugin;
+import org.opensearch.security.action.configupdate.ConfigUpdateAction;
+import org.opensearch.security.action.configupdate.ConfigUpdateRequest;
+import org.opensearch.security.action.configupdate.ConfigUpdateResponse;
+import org.opensearch.security.securityconf.impl.CType;
+import org.opensearch.security.support.ConfigConstants;
+import org.opensearch.test.framework.AuditConfiguration;
+import org.opensearch.test.framework.AuthFailureListeners;
+import org.opensearch.test.framework.AuthzDomain;
+import org.opensearch.test.framework.OnBehalfOfConfig;
+import org.opensearch.test.framework.RolesMapping;
+import org.opensearch.test.framework.TestIndex;
+import org.opensearch.test.framework.TestSecurityConfig;
+import org.opensearch.test.framework.TestSecurityConfig.Role;
+import org.opensearch.test.framework.XffConfig;
+import org.opensearch.test.framework.audit.TestRuleAuditLogSink;
+import org.opensearch.test.framework.certificate.CertificateData;
+import org.opensearch.test.framework.certificate.TestCertificates;
+
+/**
+* This class allows to you start and manage a local cluster in an integration test. In contrast to the
+* OpenSearchIntegTestCase class, this class can be used in a composite way and allows the specification
+* of the security plugin configuration.
+*
+* This class can be both used as a JUnit @ClassRule (preferred) or in a try-with-resources block. The latter way should
+* be only sparingly used, as starting a cluster is not a particularly fast operation.
+*/
+public class LocalCluster extends ExternalResource implements AutoCloseable, OpenSearchClientProvider {
+
+ private static final Logger log = LogManager.getLogger(LocalCluster.class);
+
+ public static final String INIT_CONFIGURATION_DIR = "security.default_init.dir";
+
+ protected static final AtomicLong num = new AtomicLong();
+
+ private boolean sslOnly;
+
+ private final List