[Logs UI] Add missing ML capabilities checks #72606

weltenwort · 2020-07-21T11:12:08Z

Summary

This adds several missing Machine Learning capabilities checks to the UI to make sure the user doesn't run into downstream errors resulting from the lack of permissions. It also updates the messages of the permission prompt screens to refer to the new Kibana Machine Learning permissions instead of the old built-in roles.

closes #72416
closes #72590

Details

These buttons are now disabled without "All" Machine Learning permissions:

the "Recreate" button on the "Categories" result page
the "Enable" and "Recreate" buttons on the module list cards in the "Anomalies" flyout
the "Recreate" buttons in the job status callouts (for oudated jobs)

Previews

Testing

The changes affect both the "Anomalies" and the "Categories" tabs, except for the module setup list changes, which only exist in the former.

For testing the cartesian product of the permission scenarios

user has "All" ML permissions
user has "Read" ML permissions
user has no ML permissions

and the ML job presence scenarios

relevant ML jobs exist
relevant ML jobs don't exist

could be of particular interest.

apmmachine · 2020-07-21T11:16:54Z

💚 Build Succeeded

Expand to view the summary

Build stats

Build Cause: [Pull request #72606 updated]
Start Time: 2020-07-21T14:05:15.935+0000
Duration: 4 min 2 sec

elasticmachine · 2020-07-21T15:57:51Z

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

Kerry350

Code looks good 👌 Feel free to ignore, or push to a followup, my minor comments.

Testing the functionality now.

Kerry350 · 2020-07-22T10:47:52Z

x-pack/plugins/infra/public/components/logging/log_analysis_setup/create_job_button.tsx

+      {children ?? (
+        <FormattedMessage
+          id="xpack.infra.logs.analysis.createJobButtonLabel"
+          defaultMessage="Create ML jobs"


For the default text here should it be job instead of jobs?

I would say, it depends on whether we want to abstract away the fact that this module happens to only contain one job. 🤷

Kerry350 · 2020-07-22T10:50:40Z

...ck/plugins/infra/public/components/logging/log_analysis_setup/missing_privileges_messages.ts

+
+import { i18n } from '@kbn/i18n';
+
+export const missingMlResultsPrivilegesTitle = i18n.translate(


Would there be any harm in rolling missingMlResultsPrivilegesTitle and missingMlSetupPrivilegesTitle into a singular translation as they use the same text?

good point, I didn't realize that when I factored them out 👍

Kerry350 · 2020-07-22T10:52:55Z

x-pack/plugins/infra/public/components/logging/log_analysis_setup/user_management_link.tsx

-    app: 'kibana',
-    hash: '/management/security/users',
+    app: 'management',
+    pathname: '/security/users',


Kerry350 · 2020-07-22T12:40:36Z

@weltenwort Hmm, so I'm seeing some weird behaviour with the anomalies and categories tabs. It's really inconsistent, and I can't find the common thread that makes it happen, but I'll try to describe what I'm seeing. It could also be the case that I've misunderstood Kibana roles / privileges, but even if that was the case I'd expect one behaviour rather than multiple.

Context:

Against the dev-next shared cluster I've created a kerry_test_ml_all role (which is still on the cluster if that helps at all), that role is assigned to one user kerry_test_ml, and it's the only role the user has. The role assigns everything - full index privileges and space privileges - as far as I can tell there's nothing I could do to make this user more privileged.

I then log in to Kibana as that user. Within that single login, I see all of the following behaviours accessing the anomalies tab:

So there's a mixture of asking for elevated privileges, saying there's no data, and showing results.

What's really curious is the User not authorized for "/api/ml/jobs/jobs_summary" failures, these happen just hitting the ML APIs, without hitting our internal APIs at all. In the screenshot of the network panel it can be seen that they fail, and then succeed straight after, with a call for results also managing to succeed.

I don't understand the mixture of behaviours here?

Kerry350 · 2020-07-22T13:42:43Z

Logging in and out 3 or 4 times I was able to at least get consistency between my roles (I set up all, read, and none roles), still not sure how I managed to see such a mixture of behaviours in one session (also using a private window) 🤔

All works as expected, read works as expected, but I do see a difference for none between the two tabs:

weltenwort · 2020-07-22T13:48:58Z

Thanks for checking all the permutations so thoroughly! I couldn't quite reproduce the "Anomalies" tab situation, though. 🤔 This is what it looks like for me for a user with "None" as the "Machine Learning" permissions:

Kerry350

(After talking on Slack / Zoom I had one part of my none role misconfigured).

Approving 🎉

kibanamachine · 2020-07-22T16:25:14Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: a417a7a

Build metrics

async chunks size

id	value	diff	baseline
infra	3.6MB	+3.8KB	3.6MB

History

💚 Build #63292 succeeded 964f54f
💔 Build #63238 failed 80ee0b7

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

This adds several missing Machine Learning capabilities checks to the UI to make sure the user doesn't run into downstream errors resulting from the lack of permissions. It also updates the messages of the permission prompt screens to refer to the new Kibana Machine Learning permissions instead of the old built-in roles.

Backports the following commits to 7.x: - [Logs UI] Add missing ML capabilities checks (#72606)

Backports the following commits to 7.9: - [Logs UI] Add missing ML capabilities checks (#72606)

weltenwort added 6 commits July 21, 2020 11:57

Disable setup buttons when lacking capabilities

07b082d

Remove mention of deprecated roles from message

4f3c6f2

Fix link to user management page

18910de

factor out missing privileges messages for re-use

4ec24e5

Add tooltip to disabled setup buttons

80ee0b7

Update missing read permission labels

74f9249

weltenwort added this to the Logs UI 7.9 milestone Jul 21, 2020

weltenwort self-assigned this Jul 21, 2020

Factor out capability-guarded job creation button

964f54f

weltenwort marked this pull request as ready for review July 21, 2020 15:57

weltenwort requested a review from a team as a code owner July 21, 2020 15:57

Kerry350 self-requested a review July 22, 2020 10:00

Kerry350 reviewed Jul 22, 2020

View reviewed changes

Merge branch 'master' into logs-ui-add-flyout-ml-permissions-check

50a39b6

Kerry350 approved these changes Jul 22, 2020

View reviewed changes

Combine identical title translation strings

a417a7a

weltenwort merged commit ba55ca9 into elastic:master Jul 22, 2020

weltenwort deleted the logs-ui-add-flyout-ml-permissions-check branch July 22, 2020 16:32

This was referenced Jul 22, 2020

[7.x] [Logs UI] Add missing ML capabilities checks (#72606) #72905

Merged

[7.9] [Logs UI] Add missing ML capabilities checks (#72606) #72906

Merged

weltenwort added a commit that referenced this pull request Jul 23, 2020

[7.x] [Logs UI] Add missing ML capabilities checks (#72606) (#72905)

4bc7c59

Backports the following commits to 7.x: - [Logs UI] Add missing ML capabilities checks (#72606)

weltenwort added a commit that referenced this pull request Jul 23, 2020

[7.9] [Logs UI] Add missing ML capabilities checks (#72606) (#72906)

2b69da0

Backports the following commits to 7.9: - [Logs UI] Add missing ML capabilities checks (#72606)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Logs UI] Add missing ML capabilities checks #72606

[Logs UI] Add missing ML capabilities checks #72606

weltenwort commented Jul 21, 2020 •

edited

Loading

apmmachine commented Jul 21, 2020 •

edited

Loading

Build stats

elasticmachine commented Jul 21, 2020

Kerry350 left a comment

Kerry350 Jul 22, 2020

weltenwort Jul 22, 2020

Kerry350 Jul 22, 2020

weltenwort Jul 22, 2020

Kerry350 Jul 22, 2020

Kerry350 commented Jul 22, 2020 •

edited

Loading

Kerry350 commented Jul 22, 2020

weltenwort commented Jul 22, 2020 •

edited

Loading

Kerry350 left a comment

kibanamachine commented Jul 22, 2020


		import { i18n } from '@kbn/i18n';

		export const missingMlResultsPrivilegesTitle = i18n.translate(

[Logs UI] Add missing ML capabilities checks #72606

[Logs UI] Add missing ML capabilities checks #72606

Conversation

weltenwort commented Jul 21, 2020 • edited Loading

Summary

Details

Previews

Testing

apmmachine commented Jul 21, 2020 • edited Loading

💚 Build Succeeded

Build stats

elasticmachine commented Jul 21, 2020

Kerry350 left a comment

Choose a reason for hiding this comment

Kerry350 Jul 22, 2020

Choose a reason for hiding this comment

weltenwort Jul 22, 2020

Choose a reason for hiding this comment

Kerry350 Jul 22, 2020

Choose a reason for hiding this comment

weltenwort Jul 22, 2020

Choose a reason for hiding this comment

Kerry350 Jul 22, 2020

Choose a reason for hiding this comment

Kerry350 commented Jul 22, 2020 • edited Loading

Kerry350 commented Jul 22, 2020

weltenwort commented Jul 22, 2020 • edited Loading

Kerry350 left a comment

Choose a reason for hiding this comment

kibanamachine commented Jul 22, 2020

💚 Build Succeeded

Build metrics

async chunks size

History

weltenwort commented Jul 21, 2020 •

edited

Loading

apmmachine commented Jul 21, 2020 •

edited

Loading

Kerry350 commented Jul 22, 2020 •

edited

Loading

weltenwort commented Jul 22, 2020 •

edited

Loading