getPatternList error with read-only users in a particular tenant

[asteriscos]

Wazuh	Rev	Browser
4.9.0	xyzw	Chrome, Firefox, Safari, etc

Description
Some requests to the endpoint api/saved_objects/_find?type=index-pattern&fields=title&fields=fields&per_page=9999 fail with the error:

no permissions for [indices:data/read/search] and User [name=testuser, backend_roles=[], requestedTenant=null]: security_exception: [security_exception] Reason: no permissions for [indices:data/read/search] and User [name=testuser, backend_roles=[], requestedTenant=null]

This happens to users that have read-only permissions to a specific tenant, like in the following configuration:

Details

In opensearch_dashboards.yml enable multi-tenancy:

opensearch_security.multitenancy.enabled: true

Create a new read-only user with permissions in a particular tenant

Load a dashboard (or any view with visualizations) and check the browser dev-tools for security exceptions:

[Desvelao]

I could replicate the problem.

I noticed the error related to getting the index pattern list through an API request, returns the http code 403 while the global tenant was selected despite the user has no permission on this tenant.

I switched the tenant to the configured that the user should have permissions and I got the same response in the realted API requests.

Other requests seems not to return that error

Then, I refreshed the page and the related API request had 200 http code.

I am researching where the tenant information is saved. I guess this could be encoded in the security_authenticat cookie, but I could not find how this is encoded and what information is included.

[guidomodarelli]

I am researching where the tenant information is saved. I guess this could be encoded in the security_authentication cookie, but I could not find how this is encoded and what information is included.

security_authentication:
Reference: https://github.com/hapijs/iron/blob/master/lib/index.js#L236

{
  username: 'user-ro',
  credentials: {
    authHeaderValue: 'Basic dXNlci1ybzomVXFZSiZCJkhGM0pkWkt6NzR5c3hjJFdmUiRmc1BjOA=='
  },
  authType: 'basicauth',
  isAnonymousAuth: false,
  expiryTime: 1732046561826,
  tenant: 'test_tenant'
}

Issue in fetching data sources: StatusCodeError: Authorization Exception
    at respond (/home/node/kbn/node_modules/elasticsearch/src/lib/transport.js:349:15)
    at checkRespForFailure (/home/node/kbn/node_modules/elasticsearch/src/lib/transport.js:306:7)
    at HttpConnector.<anonymous> (/home/node/kbn/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)
    at IncomingMessage.wrapper (/home/node/kbn/node_modules/lodash/lodash.js:4991:19)
    at IncomingMessage.emit (node:events:529:35)
    at IncomingMessage.emit (node:domain:489:12)
    at endReadableNT (node:internal/streams/readable:1400:12)
    at processTicksAndRejections (node:internal/process/task_queues:82:21) {
  status: 403,
  displayName: 'AuthorizationException',
  path: '/_plugins/_query/_datasources',
  query: {},
  body: '{\n' +
    '  "status": 403,\n' +
    '  "error": {\n' +
    '    "type": "OpenSearchSecurityException",\n' +
    '    "reason": "There was internal problem at backend",\n' +
    '    "details": "no permissions for [cluster:admin/opensearch/ql/datasources/read] and User [name\\u003duser-ro, backend_roles\\u003d[], requestedTenant\\u003dtest_tenant]"\n' +
    '  }\n' +
    '}',
  statusCode: 403,
  response: '{\n' +
    '  "status": 403,\n' +
    '  "error": {\n' +
    '    "type": "OpenSearchSecurityException",\n' +
    '    "reason": "There was internal problem at backend",\n' +
    '    "details": "no permissions for [cluster:admin/opensearch/ql/datasources/read] and User [name\\u003duser-ro, backend_roles\\u003d[], requestedTenant\\u003dtest_tenant]"\n' +
    '  }\n' +
    '}',
  toString: [Function (anonymous)],
  toJSON: [Function (anonymous)]
}

server    log   [19:02:42.442] [error][data][opensearch] [security_exception]: no permissions for [indices:data/read/search] and User [name=user-ro, backend_roles=[], requestedTenant=null]

A 403 error is captured even though the browser shows that all requests were successful with a statusCode of 200.

Reference: https://github.com/wazuh/wazuh-dashboard/blob/4e34a7a5141d089f6c341a535be5a7ba2737d965/src/core/server/http/router/response_adapter.ts#L95

Peek.2024-11-19.16-46.mp4