Resolves UI Breaks from Malformed Roles #131915

jeramysoucy · 2022-05-10T13:15:50Z

Resolves #124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly.

Overview

This PR adds a catch for exceptions thrown in deserialization of Elasticsearch roles during transformation into Kibana format. This provides an additional case to set the transform success flag to false and return from the operation gracefully when a malformed role is encountered, keeping the Kibana Roles and Users UI's intact.

This PR also adds an additional logger parameter to the transform functions, allowing the details of a thrown exception to be logged where previously only a generic message would appear to the Kibana user.

Add "feature_securitySolutionCases.a;;" to a user role
Apply the user role via API
Try to go to Management > Security > Roles or to Management > Security > Users
An error will be illustrated bottom right of the screen

Testing

Use the Kibana Dev Console to add a 'test' role with a malformed privilege.

PUT /_security/role/test
{
"cluster": [],
"indices": [],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_securitySolutionCases.a;;"
],
"resources": [
"*"
]
}
],
"run_as": [],
"metadata": {},
"transient_metadata": {
"enabled": true
}
}

Verify the Stack Management > Security > Users screen renders and operates without issue.
Verify the Stack Management > Security > Roles screen renders and operates without issue.
Verify the new 'test' role is displayed and can be selected.
Select the 'test' role. Verify that in the Kibana section of the Edit Role UI a message is displayed informing the use that the role is malformed.

6. Delete the 'test' role.

… to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly.

kibana-ci · 2022-05-11T16:42:32Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #43699 succeeded 9ff16d0
💔 Build #43684 failed 069b408

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

elasticmachine · 2022-05-12T05:30:58Z

Pinging @elastic/kibana-security (Team:Security)

azasypkin · 2022-05-12T11:25:22Z

ACK: will review today

azasypkin

Looks great, thank you for the exemplary PR i.e. clear and detailed description, steps to verify changes, unit tests and logs!

Note: I think we should backport this fix to 7.17 as well.

azasypkin · 2022-05-12T12:46:40Z

x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts

+      value: transformResult,
+    };
+  } catch (e) {
+    logger.error(`Error transforming Elasticsearch role: ${getDetailedErrorMessage(e)}`);


Thanks for adding logs! These are immensely helpful when we need to debug anything like this in production.

kibanamachine · 2022-05-12T13:30:31Z

💔 All backports failed

Status	Branch	Result
❌	8.2	Backport failed because of merge conflicts
❌	7.17	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 131915

Questions ?

Please refer to the Backport tool documentation

* Adds catch of exceptions from PrivilegeSerializer deserialize methods to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly. * Adds logger to role transform functions * File accidentally not saved prior to last commit (cherry picked from commit f4eb311) # Conflicts: # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts

* Adds catch of exceptions from PrivilegeSerializer deserialize methods to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly. * Adds logger to role transform functions * File accidentally not saved prior to last commit (cherry picked from commit f4eb311) # Conflicts: # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts # x-pack/plugins/security/server/routes/authorization/roles/get.ts # x-pack/plugins/security/server/routes/authorization/roles/get_all.ts

* Adds catch of exceptions from PrivilegeSerializer deserialize methods to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly. * Adds logger to role transform functions * File accidentally not saved prior to last commit

kibanamachine · 2022-05-16T13:36:18Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.

* Resolves UI Breaks from Malformed Roles (#131915) * Adds catch of exceptions from PrivilegeSerializer deserialize methods to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly. * Adds logger to role transform functions * File accidentally not saved prior to last commit (cherry picked from commit f4eb311) # Conflicts: # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts * [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix' * Fix import and linting errors. Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

* Resolves UI Breaks from Malformed Roles (#131915) * Adds catch of exceptions from PrivilegeSerializer deserialize methods to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly. * Adds logger to role transform functions * File accidentally not saved prior to last commit (cherry picked from commit f4eb311) # Conflicts: # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts # x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts # x-pack/plugins/security/server/routes/authorization/roles/get.ts # x-pack/plugins/security/server/routes/authorization/roles/get_all.ts * Fixed import and test issues.

Adds catch of exceptions from PrivilegeSerializer deserialize methods…

fc5f6c8

… to role transform function. Resolves 124808 where malformed Elasticsearch roles cause Kibana users and roles UIs to not display correctly.

jeramysoucy added release_note:fix Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v8.3.0 v8.2.1 labels May 10, 2022

jeramysoucy added 3 commits May 10, 2022 15:37

Adds logger to role transform functions

069b408

File accidentally not saved prior to last commit

9ff16d0

Merge branch 'main' into fix-ui-breaks-from-malformed-roles

07efee4

jeramysoucy added the auto-backport Deprecated - use backport:version if exact versions are needed label May 12, 2022

jeramysoucy marked this pull request as ready for review May 12, 2022 05:30

jeramysoucy requested a review from a team as a code owner May 12, 2022 05:30

azasypkin self-requested a review May 12, 2022 11:25

azasypkin added the Feature:Users/Roles/API Keys label May 12, 2022

azasypkin approved these changes May 12, 2022

View reviewed changes

jeramysoucy added the v7.17.4 label May 12, 2022

jeramysoucy merged commit f4eb311 into elastic:main May 12, 2022

jeramysoucy mentioned this pull request May 12, 2022

[8.2] Resolves UI Breaks from Malformed Roles (#131915) #132148

Merged

jeramysoucy mentioned this pull request May 12, 2022

[7.17] Resolves UI Breaks from Malformed Roles (#131915) #132149

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label May 16, 2022

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label May 16, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Resolves UI Breaks from Malformed Roles #131915

Resolves UI Breaks from Malformed Roles #131915

jeramysoucy commented May 10, 2022 •

edited

Loading

kibana-ci commented May 11, 2022

elasticmachine commented May 12, 2022

azasypkin commented May 12, 2022

azasypkin left a comment

azasypkin May 12, 2022

kibanamachine commented May 12, 2022

kibanamachine commented May 16, 2022

Resolves UI Breaks from Malformed Roles #131915

Resolves UI Breaks from Malformed Roles #131915

Conversation

jeramysoucy commented May 10, 2022 • edited Loading

Overview

Testing

kibana-ci commented May 11, 2022

💚 Build Succeeded

Metrics [docs]

History

elasticmachine commented May 12, 2022

azasypkin commented May 12, 2022

azasypkin left a comment

Choose a reason for hiding this comment

azasypkin May 12, 2022

Choose a reason for hiding this comment

kibanamachine commented May 12, 2022

💔 All backports failed

Manual backport

Questions ?

kibanamachine commented May 16, 2022

jeramysoucy commented May 10, 2022 •

edited

Loading