[Maps] Appropriately handle data access in UI

[alexfrancoeur]

It seems we're exposing sensitive information to users that do not have access to the data. I'm testing this on a recent 6.7 Cloud staging snapshot. When defining a role that only has access to the kibana_sample_data_ecommerce index I'm able to see fields within the the kibana_sample_data_flights index. I would imagine this is sensitive information as it provides insight into the structure of the document. Below you'll find a screenshot of the role defined and the data we're showing in maps.

eCommerce / Maps space role for a user:

Flight Sample Data Map:

Separately, when landing on this view without access to the data, it looks as if it's just an empty map or there was an error loading the data. With Kibana visualizations we show a "no data" error. I feel like we somehow need to communicate that either data is not loaded or that the user does not have access to the data that's driving the map and/or layers

[elasticmachine]

Pinging @elastic/kibana-security

[elasticmachine]

Pinging @elastic/kibana-gis

[alexfrancoeur]

I'm not sure what the experience is normally for showing index patterns if you don't have access to the underlying data, but we are showing all three as well.

[nreese]

I'm not sure what the experience is normally for showing index patterns if you don't have access to the underlying data, but we are showing all three as well

@alexfrancoeur We are just using the IndexPattern service. Are the index patterns visible if you tried to create a new visualization or in the Controls index pattern select?

[alexfrancoeur]

@nreese I was just about to add a comment and remove the bug status. the Index Pattern service shows both index patterns and fields that are available within them for building visualizations. This is not unique to Maps. I'm happy to close this out and open a separate issue for better handling an "empty map".

@kobelb do you know if we're doing anything in the future to handle this? Would OLS handle this? Seems like we're showcasing sensitive information.

[nreese]

@alexfrancoeur I would recommend closing this issue or re-labeling it as an issue about the IndexPattern service.

[alexfrancoeur]

Closing this issue out, I'll open subsequent issues later