Skip to content

Header field cert 3 5 - #4

Open
asifabashar wants to merge 209 commits into
3.5from
header_field_cert_3_5
Open

Header field cert 3 5#4
asifabashar wants to merge 209 commits into
3.5from
header_field_cert_3_5

Conversation

@asifabashar

@asifabashar asifabashar commented Jun 12, 2026

Copy link
Copy Markdown
Owner

Description

[Describe what this change achieves]

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)
  • Why these changes are required?
  • What is the old behavior before changes and new behavior after changes?

Issues Resolved

[List any issues this PR will resolve]

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

finnegancarroll and others added 30 commits January 29, 2026 19:30
@finnegancarroll
[Bugfix] Make gRPC JWT header keys case insensitive (opensearch-proje…
e842cd2 
…ct#5929)

Signed-off-by: Finn Carroll <carrofin@amazon.com>
@cwperks
Clear CHANGELOG post 3.5 branch cut (opensearch-project#5932)
4605b03
@dependabot @cwperks
Bump at.yawk.lz4:lz4-java from 1.10.2 to 1.10.3 (opensearch-project#5938
4094a1a 
)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
@dependabot @cwperks
Bump commons-codec:commons-codec from 1.20.0 to 1.21.0 (opensearch-pr…
ab46515 
…oject#5937)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
@dependabot
Bump open_saml_shib_version from 9.1.6 to 9.2.0 (opensearch-project#5936
bd4173f 
)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@opensearch-trigger-bot @github-actions
[Backport main] [AUTO] Add release notes for 3.5.0 (opensearch-projec…
a5df470 
…t#5942)

Signed-off-by: opensearch-ci <opensearch-infra@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@opensearch-trigger-bot @opensearch-ci-bot
[AUTO] Increment version to 3.6.0-SNAPSHOT (opensearch-project#5943)
b8bc1ca 
Signed-off-by: opensearch-ci-bot <opensearch-infra@amazon.com>
Co-authored-by: opensearch-ci-bot <opensearch-infra@amazon.com>
@nibix
Refactored config REST API tests to avoid unsafe patterns causing mem…
f56424b 
…ory leaks (opensearch-project#5934)
@cwperks
Fix issue in RolesRestApiIntegrationTest with invalid DLS clause (ope…
3f85d30 
…nsearch-project#5945)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@dependabot
Bump aws-actions/configure-aws-credentials from 5 to 6 (opensearch-pr…
54fb365 
…oject#5946)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @cwperks
Bump com.google.googlejavaformat:google-java-format from 1.33.0 to 1.…
0dc513c 
…34.1 (opensearch-project#5947)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
@dependabot
Bump ch.qos.logback:logback-classic from 1.5.26 to 1.5.28 (opensearch…
86803a5 
…-project#5948)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump com.github.seancfoley:ipaddress from 5.5.1 to 5.6.1 (opensearch-…
fc00ab1 
…project#5949)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cwperks
Make security plugin aware of FIPS build param (-Pcrypto.standard=FIP…
7c3adef 
…S-140-3) (opensearch-project#5952)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@ShawnQiang1
Fix the issue of unprocessed X-Request-Id (opensearch-project#5954)
8464cf6 
Signed-off-by: Shawn Qiang <814238703@qq.com>
@dependabot
Bump org.checkerframework:checker-qual from 3.53.0 to 3.53.1 (opensea…
f944147 
…rch-project#5955)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @cwperks
Bump org.junit.jupiter:junit-jupiter-api from 5.14.2 to 5.14.3 (opens…
2f5d0a2 
…earch-project#5956)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
@dependabot @cwperks
Bump spring_version from 7.0.3 to 7.0.4 (opensearch-project#5957)
0dcc1c3 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
@andrross
Update shadow plugin usage (opensearch-project#5953)
ea75bc2 
Signed-off-by: Andrew Ross <andrross@amazon.com>
@DarshitChanpura
Hardens input validation for resource sharing APIs (opensearch-projec…
d1e2e7f 
…t#5831)

Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
@peterzhuamazon
Toggle -Pcrypto.standard=FIPS-140-3 by default on build script (secur…
708da58 
…ity) (opensearch-project#5959)
@cwperks
Fix plugin install workflow by adding -Pcrypto.standard=FIPS-140-3 (o…
a936183 
…pensearch-project#5962)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Fix saml related citest failures after gradle shadow plugin upgrade f…
3e913ed 
…rom v8 to v9 (opensearch-project#5964)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@RyanL1997
[Maintenance] Fix bc-fips dependency jarhell for maven publish (opens…
20b074e 
…earch-project#5963)

Signed-off-by: Jialiang Liang <jiallian@amazon.com>
@dependabot
Bump spring_version from 7.0.4 to 7.0.5 (opensearch-project#5967)
fb99243 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump open_saml_version from 5.1.6 to 5.2.1 (opensearch-project#5965)
161df85 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@rishabhmaurya
Add buildSecureTransportContext() to SecureTransportSettingsProvider …
4598873 
…for Arrow Flight TLS cert reload (opensearch-project#5971)

Signed-off-by: Rishabh Maurya <rishabhmaurya05@gmail.com>
@mishail
Fix copyExtraTestResources task to make it work after clean (open…
171205e 
…search-project#5973)

Signed-off-by: Mikhail Stepura <mstepura@apple.com>
@dependabot
Bump jakarta.xml.bind:jakarta.xml.bind-api from 4.0.4 to 4.0.5 (opens…
b257aee 
…earch-project#5978)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @cwperks
Bump actions/download-artifact from 7 to 8 (opensearch-project#5979)
18710a2 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
dependabot Bot and others added 28 commits June 16, 2026 12:34
@dependabot
Bump spring_framework from 7.0.7 to 7.0.8 (opensearch-project#6212)
4fa02c9 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.springframework.kafka:spring-kafka-test from 4.0.5 to 4.1.0 (o…
daca30d 
…pensearch-project#6213)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.eclipse.platform:org.eclipse.equinox.common from 3.20.300 to…
3edd0a8 
… 3.20.400 (opensearch-project#6211)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cwperks
Allow read access on system indices marked with UnrestrictedSystemInd…
3de52c0 
…exDescriptor (opensearch-project#6197)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <craig5008@gmail.com>
@Taiwo435
Convert multi-line strings to text blocks in BasicAuditlogTest (opens…
97fee3f 
…earch-project#6220)

Signed-off-by: Muzzamil Jolaade <muzzajol@amazon.com>
@cwperks @dependabot
Fix Kafka sink test for Kafka 4.3 (opensearch-project#6225)
b8be80f 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Craig Perkins <craig5008@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cwperks
Add Rishav Kumar (gh: Rishav9852Kumar) as a co-maintainer of the Secu…
70837aa 
…rity repo (opensearch-project#6223)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Fix dynamic sign-in options: remove stale default and improve validat…
256abab 
…ion (opensearch-project#6180)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@DarshitChanpura
Enforce 256 character limit on all text inputs (opensearch-project#6224)
842f9f6 
Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
@dependabot
Bump commons-logging:commons-logging from 1.3.6 to 1.4.0 (opensearch-…
7d0ee8d 
…project#6240)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump io.dropwizard.metrics:metrics-core from 4.2.38 to 4.2.39 (opense…
accc967 
…arch-project#6239)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump open_saml from 5.2.2 to 5.2.3 (opensearch-project#6237)
1e5e0ce 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cwperks
Enable bootstrap.serial_filter in integration tests (opensearch-proje…
78b0c7e 
…ct#6229)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Inline get-opensearch-version in create-bwc-build action (opensearch-…
a33bc6a 
…project#6228)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Fix API token count results (opensearch-project#6218)
0a85c75 
Signed-off-by: Craig Perkins <craig5008@gmail.com>
Signed-off-by: Craig Perkins <cwperks@amazon.com>
@sashetov
Fix ClassCastException for otherName SAN entries during inter-cluster…
76c3e2c 
… handshake (opensearch-project#6137)

Signed-off-by: sashetov <alexander@vassilevski.com>
@peterzhuamazon
Onboard new backport-pr re-usable github workflow (security) (opensea…
69772f0 
…rch-project#6250)

Signed-off-by: Peter Zhu <zhujiaxi@amazon.com>
@dependabot
Bump github/codeql-action from 4.36.0 to 4.36.2 (opensearch-project#6233
6c8f4b8 
)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump com.autonomousapps.build-health from 3.10.0 to 3.15.0 (opensearc…
62293f1 
…h-project#6238)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump open_saml_shib from 9.2.2 to 9.2.3 (opensearch-project#6235)
c4c155c 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump 1password/load-secrets-action from 4.0.0 to 4.0.1 (opensearch-pr…
88a8b48 
…oject#6234)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump kafka_version from 4.3.0 to 4.3.1 (opensearch-project#6259)
757b857 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.37 (opensearch…
3c24c45 
…-project#6260)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump com.github.spotbugs from 6.5.5 to 6.5.8 (opensearch-project#6263)
75d7615 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump gradle-wrapper from 9.5.1 to 9.6.1 (opensearch-project#6262)
b942825 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@asifabashar
header based certificate role resolution
bbc25e1
@asifabashar
client auth from header
8950998
@asifabashar
added cert based auth from cert passed in header where ssl handshake …
3fae125 
…is validated using a load balancer outside of opensearch

Signed-off-by: Asif Bashar <asif.bashar@gmail.com>
@asifabashar
asifabashar force-pushed the header_field_cert_3_5 branch from 3a726ac to 3fae125 Compare June 29, 2026 19:54
@asifabashar
added settings for header cert
b9b0c29 
Signed-off-by: Asif Bashar <asif.bashar@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.