Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Kibana application privileges for monitoring and ml reserved roles #40651

Merged
merged 8 commits into from
Apr 5, 2019
Merged

Add Kibana application privileges for monitoring and ml reserved roles #40651

merged 8 commits into from
Apr 5, 2019

Conversation

kobelb
Copy link
Contributor

@kobelb kobelb commented Mar 29, 2019 •
edited
Loading

To enable Feature Controls we'd like the ability to only show the Machine Learning and Monitoring applications when the user has the assigned reserved role. To do so, we're augmenting these reserved roles with the privileges which are necessary to make this determination. These roles grant access to kibana-*, so that in a multi-tenant deployment of Kibana, users will get access to these applications in the same way that they do today.

@polyfractal polyfractal added the :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC label Apr 2, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@kobelb kobelb marked this pull request as ready for review April 3, 2019 00:04
@kobelb kobelb requested a review from tvernum April 3, 2019 00:04
@bizybot bizybot self-requested a review April 4, 2019 22:44
bizybot
bizybot approved these changes Apr 4, 2019
View reviewed changes
Copy link
Contributor

@bizybot bizybot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than a small suggestion, LGTM, Thank you.

...src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java Outdated Show resolved Hide resolved
...src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java Outdated Show resolved Hide resolved
...src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java Outdated Show resolved Hide resolved
@kobelb
Copy link
Contributor Author

kobelb commented Apr 5, 2019

Other than a small suggestion, LGTM, Thank you.

Sure, you got it! Thanks @bizybot

@kobelb kobelb merged commit 513950c into elastic:master Apr 5, 2019
@kobelb kobelb deleted the fc/reserved-role-apps-3 branch April 5, 2019 14:43
kobelb added a commit that referenced this pull request Apr 5, 2019
@kobelb
Add Kibana application privileges for monitoring and ml reserved roles (
eb65624 
#40651)

* Add Kibana application privileges for monitoring and ml reserved roles

* Adding test for kibana-.kibana application explicitly

* Whoa there, fat fingered kibana and application...

* And I copied something from monitoring I shouldn't have...

* And actually doing what Yogesh recommended...
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
@jasontedor
Merge branch 'master' into build-flavor-type-leniency
cad967f 
* master: (63 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
@jasontedor
Merge branch 'master' into minimum-java-11
889cf14 
* master: (77 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
gurkankaymak pushed a commit to gurkankaymak/elasticsearch that referenced this pull request May 27, 2019
@kobelb
Add Kibana application privileges for monitoring and ml reserved roles (
9942566 
elastic#40651)

* Add Kibana application privileges for monitoring and ml reserved roles

* Adding test for kibana-.kibana application explicitly

* Whoa there, fat fingered kibana and application...

* And I copied something from monitoring I shouldn't have...

* And actually doing what Yogesh recommended...
@droberts195 droberts195 mentioned this pull request May 31, 2019
Merged
droberts195 added a commit to droberts195/stack-docs that referenced this pull request May 31, 2019
@droberts195
Add Kibana application privileges to the reserved role docs
80963f1 
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757
@droberts195 droberts195 mentioned this pull request May 31, 2019
Merged
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
@droberts195 @lcawl
Add Kibana application privileges to the reserved role docs (#354)
2971dde 
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
@droberts195 @lcawl
Add Kibana application privileges to the reserved role docs (#354)
6b5dff3 
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>
droberts195 added a commit to elastic/stack-docs that referenced this pull request Jun 5, 2019
@droberts195 @lcawl
Add Kibana application privileges to the reserved role docs (#354)
6e3affb 
Users who create roles that are similar to the reserved roles
need to know about these.

The privileges were added to the reserved roles in
elastic/elasticsearch#40651 and elastic/elasticsearch#42757

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bizybot bizybot bizybot approved these changes

@tvernum tvernum Awaiting requested review from tvernum

Assignees
No one assigned
Labels
>enhancement :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC v7.2.0 v8.0.0-alpha1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@kobelb @elasticmachine @bizybot @colings86 @jakelandis @polyfractal