Add Confluence Data Center support with allow_local_address and beare… by srikanthpadakanti · Pull Request #6769 · opensearch-project/data-prepper

srikanthpadakanti · 2026-04-20T21:49:06Z

Description

Two changes to support Confluence Data Center deployments:

1. Configurable address validation (allow_local_address)

The existing AddressValidation.validateInetAddress() rejects all local/private IPs, which blocks Confluence Data Center running on internal
networks. Added a boolean config allow_local_address (defaults to false) that skips site-local, loopback, and link-local checks when enabled.
Multicast and any-local addresses are still rejected regardless.

  source:
    confluence:                                                                                                                                     
      hosts:                                                                                                                                        
        - "https://confluence.internal.company.com"                                                                                                 
      allow_local_address: true

Bearer token authentication

Confluence Data Center uses Personal Access Tokens (PAT) for authentication. Added bearer_token as a third auth option alongside basic and oauth2.
Only one auth method can be configured at a time.

  source:                                                   
    confluence:
      hosts:                                                                                                                                        
        - "https://confluence.internal.company.com"
      allow_local_address: true                                                                                                                     
      authentication:                                       
        bearer_token: "your-personal-access-token"

Changes are in atlassian-commons so Jira Data Center also benefits from the same allow_local_address and bearer token support.

Issues Resolved

Resolves #6496
#6496

Check List

[ X ] New functionality includes testing.
New functionality has a documentation issue. Please link to it in this PR.
[ X ] New functionality has javadoc added
[ X ] Commits are signed with a real name per the DCO

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

…r token auth Make address validation configurable via allow_local_address (default false) so Confluence Data Center on internal networks is supported. Add bearer token authentication for Personal Access Tokens used by Data Center deployments. Resolves opensearch-project#6496 Signed-off-by: Srikanth Padakanti <srikanth_padakanti@apple.com>

srikanthpadakanti · 2026-04-21T22:59:29Z

Hi @dlvenable @kkondaka Please review this. Thanks.

dlvenable

Thanks @srikanthpadakanti for the contribution! I have a few comments and questions.

dlvenable · 2026-05-06T14:24:24Z


-    @AssertTrue(message = "Authentication config should have either basic or oauth2")
+    @JsonProperty("bearer_token")
+    private String bearerToken;


For OAuth2, we use PluginConfigVariable. This allows us to refresh the credentials from the Jira/Confluence source plugins themselves. Do you think this is relevant for bearer tokens?

Either way, this can support reading from secrets managers.

Agreed on PluginConfigVariable, Will address in a follow-up since PATs don't need refresh, but secrets manager reads are valuable. Keeping scope tight for this PR.

Otherwise if you want me to implement it now, I can change String bearerToken to PluginConfigVariable bearerToken and update all usages. What do you prefer?

dlvenable · 2026-05-06T14:24:54Z

+
+    private ConfluenceRestClient(RestTemplate restTemplate, AtlassianAuthConfig authConfig,
+                                 PluginMetrics pluginMetrics, boolean allowLocalAddress) {
+        super(restTemplate, authConfig, pluginMetrics, allowLocalAddress);


Do we need similar changes in the JiraRestClient?

Yes, since this lives in atlassian-commons the Jira client inherits it. Will wire through JiraRestClient as well

dlvenable · 2026-05-06T14:26:30Z

        boolean hasBasic = basicConfig != null;
        boolean hasOauth = oauth2Config != null;
-        return hasBasic ^ hasOauth;
+        boolean hasBearer = bearerToken != null && !bearerToken.isBlank();


I tend to think that isEmpty is the right approach here. This would ignore an explicit " ", which is an odd configuration to be sure.

Agreed, switching to isEmpty

dlvenable · 2026-05-06T14:28:49Z

    @JsonProperty("acknowledgments")
    private boolean acknowledgments = false;

+    @JsonProperty("allow_local_address")


To me, this implies that it will allow localhost names specifically. But it is localhost and private IP.

Should we have two configurations:

allow_private_network or allow_internal_address to denote private IP addresses, but not localhost

allow_local_address or allow_localhost_address to allow localhost addresses

Or maybe just update the one name?

Makes sense to separate the concerns

dlvenable · 2026-05-06T14:29:40Z

+    void testAllowLocalAddressStillRejectsAnyLocal() throws UnknownHostException {
+        InetAddress wildcardAddress = InetAddress.getByName("0.0.0.0");
+        assertThrows(BadRequestException.class, () -> AddressValidation.validateInetAddress(wildcardAddress, true));
+    }


Just to be sure, we should have some test cases that includes a public IP to be sure it is not exclusive to localhost addresses.

Will add a positive case with a routable public IP to confirm it passes through cleanly

dlvenable · 2026-05-06T14:30:58Z

+        assertThrows(RuntimeException.class, () -> ConfluenceConfigHelper.validateConfig(confluenceSourceConfig));
+
+        when(authenticationConfig.getBearerToken()).thenReturn("");
+        assertThrows(RuntimeException.class, () -> ConfluenceConfigHelper.validateConfig(confluenceSourceConfig));


This has three different test cases. I think splitting them out into three different JUnit test cases/methods is ideal.

Will break into three: null token, empty token, and blank token

dlvenable · 2026-05-06T14:33:28Z

+        when(sourceConfig.getAuthType()).thenReturn(BEARER_TOKEN);
+        when(sourceConfig.getAuthenticationConfig()).thenReturn(authenticationConfig);
+        when(authenticationConfig.getBearerToken()).thenReturn("test-token");
+        when(sourceConfig.getAccountUrl()).thenReturn("https://confluence.internal.com");


I'm not sure what internal.com is. We should probably use example.com or opensearch.org (we know the latter).

using opensearch.org

dlvenable · 2026-05-06T14:35:59Z

+
+    @Test
+    void testInterceptSetsBearerAuthHeader() throws IOException {
+        when(authConfig.getBearerToken()).thenReturn("my-token");


Generate a random value here instead of the static "my-token".

Will generate via UUID.randomUUID().toString() for better test isolation

…t values, wire JiraRestClient Signed-off-by: Srikanth Padakanti <srikanth_padakanti@apple.com>

srikanthpadakanti requested review from KarstenSchnitter, dinujoh, dlvenable, engechas, graytaylor0, kkondaka, oeyh, san81, sb2k16 and srikanthjg as code owners April 20, 2026 21:49

srikanthpadakanti force-pushed the confluence-data-center-6496-public branch from 99de791 to f257f0f Compare April 20, 2026 22:10

dlvenable requested changes May 6, 2026

View reviewed changes

dlvenable mentioned this pull request May 6, 2026

Add lookup_private_addresses option to GeoIP processor for internal I… #6770

Open

1 task

Address review feedback: rename config, fix validation, randomize tes…

e9dcdc7

…t values, wire JiraRestClient Signed-off-by: Srikanth Padakanti <srikanth_padakanti@apple.com>

srikanthpadakanti requested review from Zhangxunmt and divbok as code owners May 7, 2026 02:37

srikanthpadakanti requested a review from dlvenable May 7, 2026 02:38

Conversation

srikanthpadakanti commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Check List

Uh oh!

srikanthpadakanti commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dlvenable left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

srikanthpadakanti May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

srikanthpadakanti commented Apr 20, 2026 •

edited

Loading

srikanthpadakanti commented Apr 21, 2026 •

edited

Loading

srikanthpadakanti May 7, 2026 •

edited

Loading