Add Resolve Index API to the "read" permission for an index (#87052) (#…

…87169) This commit allows the index "read" permission to also allow using the resolve index Action. Resolves #86977
elastic · May 26, 2022 · b403c0e · b403c0e
1 parent c333dc8
commit b403c0e
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/docs/changelog/87052.yaml b/docs/changelog/87052.yaml
@@ -0,0 +1,6 @@
+pr: 87052
+summary: Add Resolve Index API to the "read" permission for an index
+area: Indices APIs
+type: bug
+issues:
+ - 86977
diff --git a/...e/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java b/...e/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java
@@ -68,7 +68,7 @@ public final class IndexPrivilege extends Privilege {
     private static final Logger logger = LogManager.getLogger(IndexPrivilege.class);
 
     private static final Automaton ALL_AUTOMATON = patterns("indices:*", "internal:transport/proxy/indices:*");
-    private static final Automaton READ_AUTOMATON = patterns("indices:data/read/*");
+    private static final Automaton READ_AUTOMATON = patterns("indices:data/read/*", ResolveIndexAction.NAME);
     private static final Automaton READ_CROSS_CLUSTER_AUTOMATON = patterns(
         "internal:transport/proxy/indices:data/read/*",
         ClusterSearchShardsAction.NAME

diff --git a/.../plugin/src/yamlRestTest/resources/rest-api-spec/test/security/authz/60_resolve_index.yml b/.../plugin/src/yamlRestTest/resources/rest-api-spec/test/security/authz/60_resolve_index.yml
@@ -25,7 +25,7 @@ setup:
         body:  >
           {
             "indices": [
-              { "names": ["matches_none"], "privileges": ["read"] }
+              { "names": ["matches_none"], "privileges": ["monitor"] }
             ]
           }