Logging legacy fallback deprecation warning on login #20493
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
legrego
reviewed
Jul 5, 2018
There was a problem hiding this comment.
[edit] not sure why, but GH marked this comment as outdated, but I think it's still relevant.
Looking good, just a few comments/questions for you. Unit tests are passing, but I am seeing 26 failing rbac api tests. Here's a snippet from one of the failures:
│ proc [kibana] log [19:54:17.935] [info][authentication] Authentication attempt failed: [illegal_argument_exception] unknown application privilege [read]
│ proc [ftr] └- ✖ fail: "apis RBAC saved_objects update kibana rbac dashboard only user unknown id should return 403"
│ proc [ftr] │ Error: expected 403 "Forbidden", got 400 "Bad Request"
│ proc [ftr] │ at Test._assertStatus (node_modules/supertest/lib/test.js:266:12)
│ proc [ftr] │ at Test._assertFunction (node_modules/supertest/lib/test.js:281:11)
│ proc [ftr] │ at Test.assert (node_modules/supertest/lib/test.js:171:18)
│ proc [ftr] │ at assert (node_modules/supertest/lib/test.js:131:12)
│ proc [ftr] │ at node_modules/supertest/lib/test.js:128:5
│ proc [ftr] │ at Test.Request.callback (node_modules/superagent/lib/node/index.js:718:3)
│ proc [ftr] │ at parser (node_modules/superagent/lib/node/index.js:906:18)
│ proc [ftr] │ at Stream.res.on (node_modules/superagent/lib/node/parsers/json.js:19:7)
│ proc [ftr] │ at Unzip.unzip.on (node_modules/superagent/lib/node/unzip.js:55:12)
│ proc [ftr] │ at endReadableNT (_stream_readable.js:1064:12)
│ proc [ftr] │ at _combinedTickCallback (internal/process/next_tick.js:138:11)
│ proc [ftr] │ at process._tickCallback (internal/process/next_tick.js:180:9)
|
|
||
| const actions = actionsFactory(config); | ||
|
|
||
| server.expose('authorization', { |
There was a problem hiding this comment.
What do you think about deep-freezing this? Now that this is exposed server-wide as a singleton, I think it'd be a very good idea to prevent any part of this from being inadvertently or maliciously modified by other code.
|
|
||
| return { | ||
| getSavedObjectAction(type, action) { | ||
| return `action:saved_objects/${type}/${action}`; |
There was a problem hiding this comment.
Do we need validation here to assert that both type and action are provided?
| @@ -38,19 +32,19 @@ export function checkPrivilegesWithRequestFactory(server) { | |||
| } | |||
| }); | |||
|
|
|||
| const hasPrivileges = privilegeCheck.application[application][DEFAULT_RESOURCE]; | |||
| const privilegeCheckPrivileges = privilegeCheck.application[application][DEFAULT_RESOURCE]; | |||
There was a problem hiding this comment.
nit: naming here is confusing to me. If you're planning on addressing naming in a different PR, then ignore this for now.
I'm not sure if I like it any better, but for the sake of starting a discussion, what about calling checkApplicationPrivileges something like checkApplicationActions?
I know we are using the has_privileges API here, but in reality, we are only checking if the user is authorized to perform a particular action, regardless of which permission grants them that action.
Continuing with this example, then this variable could be named something like actionCheckResults (or privilegeCheckResults if we don't change the other name?)
If we decide on a rename, then this comment cascades to other functions/variables/files, but the sake of brevity, I won't call them out in this review
There was a problem hiding this comment.
These are the "new" names as recommended by: #19723 (comment) if we would like to rename this again, I'd prefer to address it in another PR.
| const msg = 'Relying on index privileges is deprecated and will be removed in Kibana 7.0'; | ||
| server.log(['warning', 'deprecated', 'security'], msg); | ||
|
|
||
| if (!applicationPrivilegesCheck.privileges[actions.login] && await hasPrivilegesOnKibanaIndex()) { |
There was a problem hiding this comment.
I'm not sure if it's worth it or not, but now that we don't have to log the deprecation warning on a per-request basis, we could potentially do the entire privilege check in a single round-trip. Something like:
const privilegeCheck = await callWithRequest(request, 'shield.hasPrivileges', {
body: {
index: [{
names: [kibanaIndex],
privileges: ['create', 'delete', 'read', 'view_index_metadata']
}],
applications: [{
application,
resources: [DEFAULT_RESOURCE],
privileges
}]
}
});A couple of thoughts on this approach:
- We wouldn't be able to rely on ES's
has_all_requested, but it should also be fairly trivial to derive that ourselves based on the response. - Non-legacy users will incur an additional overhead while ES checks the index privileges, which we will never use for them. This is likely negligible though?
There was a problem hiding this comment.
I like it... I'll make it so.
x-pack/plugins/security/index.js
Outdated
|
|
||
| // exposes server.plugins.security.authorization | ||
| initAuthorization(server); |
There was a problem hiding this comment.
nit: what about calling this something a little more descriptive, like initAuthorizationService? This more closely matches what you describe in init.test.js
💚 Build Succeeded |
💚 Build Succeeded |
legrego
approved these changes
Jul 6, 2018
|
|
||
| import { isObject } from 'lodash'; | ||
|
|
||
| export function deepFreeze(object) { |
There was a problem hiding this comment.
At some point, we may want to consolidate this with the OSS Version, but no need to block this PR on that.
There was a problem hiding this comment.
Agreed, code-sharing is still a pain between OSS and x-pack, so I was postponing having to pull this into a @kbn package.
|
|
||
| return async function checkPrivileges(privileges) { | ||
| const allApplicationPrivileges = uniq([actions.version, actions.login, ...privileges]); | ||
| const hasPrivilegesResponse = await callWithRequest(request, 'shield.hasPrivileges', { |
| // we only return missing privileges that they're specifically checking for | ||
| missing: Object.keys(applicationPrivilegesResponse) | ||
| .filter(privilege => privileges.includes(privilege)) | ||
| .filter(privilege => !applicationPrivilegesResponse[privilege]) |
There was a problem hiding this comment.
nit: These filter calls could probably be combined without really sacrificing readability
kobelb
added a commit
that referenced
this pull request
Jul 24, 2018
* partial implementation for OLS Phase 1 * Allow Saved Objects Client to be wrapped * Add placeholder "kibana.namespace" configuration property * revert changes to saved objects client * Remove circular dependency * Removing namespace setting, we're using xpack.security.rbac.application * Adding config.getDefault * Expose SavedObjectsClientProvider on the server for easy plugin consumption * migrate x-pack changes into kibana * Beginning to use the ES APIs to insert/check privileges (#18645) * Beginning to use the ES APIs to insert/check privileges * Removing todo comment, I think we're good with the current check * Adding ability to edit kibana application privileges * Introducing DEFAULT_RESOURCE constant * Removing unused arguments when performing saved objects auth check * Performing bulkCreate auth more efficiently * Throwing error in SavedObjectClient.find if type isn't provided * Fixing Reporting and removing errant console.log * Introducing a separate hasPrivileges "service" * Adding tests and fleshing out the has privileges "service" * Fixing error message * You can now edit whatever roles you want * We're gonna throw the find error in another PR * Changing conflicting version detection to work when user has no application privileges * Throwing correct error when user is forbidden * Removing unused interceptor * Adding warning if they're editing a role with application privileges we can't edit * Fixing filter... * Beginning to only update privileges when they need to be * More tests * One more test... * Restricting the rbac application name that can be chosen * Removing DEFAULT_RESOURCE check * Supporting 1024 characters for the role name * Renaming some variables, fixing issue with role w/ no kibana privileges * Throwing decorated general error when appropriate * Fixing test description * Dedent does nothing... * Renaming some functions * Adding built-in types and alphabetizing (#19306) * Filtering out non-default resource Kibana privileges (#19321) * Removing unused file * Adding kibana_rbac_dashboard_only_user to dashboard only mode roles (#19511) * Adding create default roles test (#19505) * RBAC - SecurityAuditLogger (#19571) * Manually porting over the AuditLogger for use within the security audit logger * HasPrivileges now returns the user from the request * Has privileges returns username from privilegeCheck * Adding first eventType to the security audit logger * Adding authorization success message * Logging arguments when authorization success * Fixing test description * Logging args during audit failures * RBAC Integration Tests (#19647) * Porting over the saved objects tests, a bunch are failing, I believe because security is preventing the requests * Running saved objects tests with rbac and xsrf disabled * Adding users * BulkGet now tests under 3 users * Adding create tests * Adding delete tests * Adding find tests * Adding get tests * Adding bulkGet forbidden tests * Adding not a kibana user tests * Update tests * Renaming the actions/privileges to be closer to the functions on the saved object client itself * Cleaning up tests and removing without index tests I'm considering the without index tests to be out of scope for the RBAC API testing, and we already have unit coverage for these and integration coverage via the OSS Saved Objects API tests. * Fixing misspelling * Fixing "conflicts" after merging master * Removing some white-space differences * Deleting files that got left behind in a merge * Adding the RBAC API Integration Tests * SavedObjectClient.find filtering (#19708) * Adding ability to specify filters when calling the repository * Implementing find filtering * Revert "Adding ability to specify filters when calling the repository" This reverts commit 9da30a1. * Adding integration tests for find filtering * Adding forbidden auth logging * Adding asserts to make sure some audit log isn't used * Adding more audit log specific tests * Necessarly is not a work, unfortunately * Fixing test * More descriptive name than "result" * Better unauthorized find message? * Adding getTypes tests * Trying to isolate cause of rbac test failures * Adding .toLowerCase() to work around capitalization issue * No longer exposing the auditLogger, we don't need it like that right now * Removing some unused code * Removing defaultSettings from test that doesn't utilize them * Fixing misspelling * Don't need an explicit login privilege when we have them all * Removing unused code, fixing misspelling, adding comment * Putting a file back * No longer creating the roles on start-up (#19799) * Removing kibana_rbac_dashboard_only_user from dashboard only role defaults * Fixing small issue with editing Kibana privileges * [RBAC Phase 1] - Update application privileges when XPack license changes (#19839) * Adding start to supporting basic license and switching to plat/gold * Initialize application privilages on XPack license change * restore mirror_status_and_initialize * additional tests and peer review updates * Introducing watchStatusAndLicenseToInitialize * Adding some tests * One more test * Even better tests * Removing unused mirrorStatusAndInitialize * Throwing an error if the wrong status function is called * RBAC Legacy Fallback (#19818) * Basic implementation, rather sloppy * Cleaning stuff up a bit * Beginning to write tests, going to refactor how we build the privileges * Making the buildPrivilegesMap no longer return application name as the main key * Using real privileges since we need to use them for the legacy fallback * Adding more tests * Fixing spelling * Fixing test description * Fixing comment description * Adding similar line breaks in the has privilege calls * No more settings * No more rbac enabled setting, we just do RBAC * Using describe to cleanup the test cases * Logging deprecations when using the legacy fallback * Cleaning up a bit... * Using the privilegeMap for the legacy fallback tests * Now with even less duplication * Removing stray `rbacEnabled` from angularjs * Fixing checkLicenses tests since we added RBAC * [Flaky Test] - wait for page load to complete (#19895) @kobelb this seems unrelated to our RBAC Phase 1 work, but I was able to consistently reproduce this on my machine. * [Flaky Test] Fixes flaky role test (#19899) Here's a fix for the latest flaky test @kobelb * Now with even easier repository access * Sample was including login/version privileges, which was occasionally (#19915) causing issues that were really hard to replicate * Dynamic types (#19925) No more hard-coded types! This will make it so that plugins that register their own mappings just transparently work. * start to address feedback * Fix RBAC Phase 1 merge from master (#20226) This updates RBAC Phase 1 to work against the latest master. Specifically: 1. Removes `xpack_main`'s `registerLicenseChangeCallback`, which we introduced in `security-app-privs`, in favor of `onLicenseInfoChange`, which was recently added to master 2. Updated `x-pack/plugins/security/server/lib/watch_status_and_license_to_initialize.js` to be compliant with rxjs v6 * Retrying initialize 20 times with a scaling backoff (#20297) * Retrying initialize 20 times with a scaling backoff * Logging error when we are registering the privileges * Alternate legacy fallback (#20322) * Beginning to use alternate callWithRequest fallback * Only use legacy fallback when user has "some" privileges on index * Logging useLegacyFallback when there's an authorization failure * Adding tests, logging failure during find no types fallback * Switching to using an enum instead of success/useLegacyFallback * Using _execute to share some of the structure * Moving comment to where it belongs * No longer audit logging when we use the legacy fallback * Setting the status to red on the first error then continually (#20343) initializing * Renaming get*Privilege to get*Action * Adding "instance" to alert about other application privileges * Revising some of the naming for the edit roles screen * One more edit role variable renamed * hasPrivileges is now checkPrivileges * Revising check_license tests * Adding 2 more privileges tests * Moving the other _find method to be near his friend * Spelling "returning" correctly, whoops * Adding Privileges tests * tests for Elasticsearch's privileges APIs * Switching the hard-coded resource from 'default' to * * Throw error before we execute a POST privilege call that won't work * Resolving issue when initially registering privileges * Logging legacy fallback deprecation warning on login (#20493) * Logging legacy fallback deprecation on login * Consolidation the privileges/authorization folder * Exposing rudimentary authorization service and fixing authenticate tests * Moving authorization services configuration to initAuthorization * Adding "actions" service exposed by the authorization * Fixing misspelling * Removing invalid and unused exports * Adding note about only adding privileges * Calling it initAuthorizationService * Throwing explicit validation error in actions.getSavedObjectAction * Deep freezing authorization service * Adding deepFreeze tests * Checking privileges in one call and cleaning up tests * Deriving application from Kibana index (#20614) * Specifying the application on the "authorization service" * Moving watchStatusAndLicenseToInitialize to be below initAuthorizationService * Using short-hand propery assignment * Validate ES has_privileges response before trusting it (#20682) * validate elasticsearch has_privileges response before trusting it * address feedback * Removing unused setting * Public Role APIs (#20732) * Beginning to work on external role management APIs * Refactoring GET tests and adding more permutations * Adding test for excluding other resources * Adding get role tests * Splitting out the endpoints, or else it's gonna get overwhelming * Splitting out the post and delete actions * Beginning to work on POST and the tests * Posting the updated role * Adding update tests * Modifying the UI to use the new public APIs * Removing internal roles API * Moving the rbac api integration setup tests to use the public role apis * Testing field_security and query * Adding create role tests * We can't update the transient_metadata... * Removing debugger * Update and delete tests * Returning a 204 when POSTing a Role. * Switching POST to PUT and roles to role * We don't need the rbacApplication client-side anymore * Adding delete route tests * Using not found instead of not acceptable, as that's more likely * Only allowing us to PUT known Kibana privileges * Removing transient_metadata * Removing one letter variable names * Using PUT instead of POST when saving roles * Fixing broken tests * Adding setting to allow the user to turn off the legacy fallback (#20766) * Pulling the version from the kibana server * Deleting unused file * Add API integration tests for roles with index and app privileges (#21033) * Rbac phase1 functional UI tests (#20949) * rbac functional tests * changes to the test file * RBAC_functional test * incorporating review feedback * slight modification to the addPriv() to cover all tests * removed the @ in secure roles and perm file in the describe block and made it look more relevant * Fixing role management API from users * Set a timeout when we try/catch a find, so it doesn't pause a long time * Changing the way we detect if a user is reserved for the ftr * Skipping flaky test
kobelb
added a commit
to kobelb/kibana
that referenced
this pull request
Jul 24, 2018
* partial implementation for OLS Phase 1 * Allow Saved Objects Client to be wrapped * Add placeholder "kibana.namespace" configuration property * revert changes to saved objects client * Remove circular dependency * Removing namespace setting, we're using xpack.security.rbac.application * Adding config.getDefault * Expose SavedObjectsClientProvider on the server for easy plugin consumption * migrate x-pack changes into kibana * Beginning to use the ES APIs to insert/check privileges (elastic#18645) * Beginning to use the ES APIs to insert/check privileges * Removing todo comment, I think we're good with the current check * Adding ability to edit kibana application privileges * Introducing DEFAULT_RESOURCE constant * Removing unused arguments when performing saved objects auth check * Performing bulkCreate auth more efficiently * Throwing error in SavedObjectClient.find if type isn't provided * Fixing Reporting and removing errant console.log * Introducing a separate hasPrivileges "service" * Adding tests and fleshing out the has privileges "service" * Fixing error message * You can now edit whatever roles you want * We're gonna throw the find error in another PR * Changing conflicting version detection to work when user has no application privileges * Throwing correct error when user is forbidden * Removing unused interceptor * Adding warning if they're editing a role with application privileges we can't edit * Fixing filter... * Beginning to only update privileges when they need to be * More tests * One more test... * Restricting the rbac application name that can be chosen * Removing DEFAULT_RESOURCE check * Supporting 1024 characters for the role name * Renaming some variables, fixing issue with role w/ no kibana privileges * Throwing decorated general error when appropriate * Fixing test description * Dedent does nothing... * Renaming some functions * Adding built-in types and alphabetizing (elastic#19306) * Filtering out non-default resource Kibana privileges (elastic#19321) * Removing unused file * Adding kibana_rbac_dashboard_only_user to dashboard only mode roles (elastic#19511) * Adding create default roles test (elastic#19505) * RBAC - SecurityAuditLogger (elastic#19571) * Manually porting over the AuditLogger for use within the security audit logger * HasPrivileges now returns the user from the request * Has privileges returns username from privilegeCheck * Adding first eventType to the security audit logger * Adding authorization success message * Logging arguments when authorization success * Fixing test description * Logging args during audit failures * RBAC Integration Tests (elastic#19647) * Porting over the saved objects tests, a bunch are failing, I believe because security is preventing the requests * Running saved objects tests with rbac and xsrf disabled * Adding users * BulkGet now tests under 3 users * Adding create tests * Adding delete tests * Adding find tests * Adding get tests * Adding bulkGet forbidden tests * Adding not a kibana user tests * Update tests * Renaming the actions/privileges to be closer to the functions on the saved object client itself * Cleaning up tests and removing without index tests I'm considering the without index tests to be out of scope for the RBAC API testing, and we already have unit coverage for these and integration coverage via the OSS Saved Objects API tests. * Fixing misspelling * Fixing "conflicts" after merging master * Removing some white-space differences * Deleting files that got left behind in a merge * Adding the RBAC API Integration Tests * SavedObjectClient.find filtering (elastic#19708) * Adding ability to specify filters when calling the repository * Implementing find filtering * Revert "Adding ability to specify filters when calling the repository" This reverts commit 9da30a1. * Adding integration tests for find filtering * Adding forbidden auth logging * Adding asserts to make sure some audit log isn't used * Adding more audit log specific tests * Necessarly is not a work, unfortunately * Fixing test * More descriptive name than "result" * Better unauthorized find message? * Adding getTypes tests * Trying to isolate cause of rbac test failures * Adding .toLowerCase() to work around capitalization issue * No longer exposing the auditLogger, we don't need it like that right now * Removing some unused code * Removing defaultSettings from test that doesn't utilize them * Fixing misspelling * Don't need an explicit login privilege when we have them all * Removing unused code, fixing misspelling, adding comment * Putting a file back * No longer creating the roles on start-up (elastic#19799) * Removing kibana_rbac_dashboard_only_user from dashboard only role defaults * Fixing small issue with editing Kibana privileges * [RBAC Phase 1] - Update application privileges when XPack license changes (elastic#19839) * Adding start to supporting basic license and switching to plat/gold * Initialize application privilages on XPack license change * restore mirror_status_and_initialize * additional tests and peer review updates * Introducing watchStatusAndLicenseToInitialize * Adding some tests * One more test * Even better tests * Removing unused mirrorStatusAndInitialize * Throwing an error if the wrong status function is called * RBAC Legacy Fallback (elastic#19818) * Basic implementation, rather sloppy * Cleaning stuff up a bit * Beginning to write tests, going to refactor how we build the privileges * Making the buildPrivilegesMap no longer return application name as the main key * Using real privileges since we need to use them for the legacy fallback * Adding more tests * Fixing spelling * Fixing test description * Fixing comment description * Adding similar line breaks in the has privilege calls * No more settings * No more rbac enabled setting, we just do RBAC * Using describe to cleanup the test cases * Logging deprecations when using the legacy fallback * Cleaning up a bit... * Using the privilegeMap for the legacy fallback tests * Now with even less duplication * Removing stray `rbacEnabled` from angularjs * Fixing checkLicenses tests since we added RBAC * [Flaky Test] - wait for page load to complete (elastic#19895) @kobelb this seems unrelated to our RBAC Phase 1 work, but I was able to consistently reproduce this on my machine. * [Flaky Test] Fixes flaky role test (elastic#19899) Here's a fix for the latest flaky test @kobelb * Now with even easier repository access * Sample was including login/version privileges, which was occasionally (elastic#19915) causing issues that were really hard to replicate * Dynamic types (elastic#19925) No more hard-coded types! This will make it so that plugins that register their own mappings just transparently work. * start to address feedback * Fix RBAC Phase 1 merge from master (elastic#20226) This updates RBAC Phase 1 to work against the latest master. Specifically: 1. Removes `xpack_main`'s `registerLicenseChangeCallback`, which we introduced in `security-app-privs`, in favor of `onLicenseInfoChange`, which was recently added to master 2. Updated `x-pack/plugins/security/server/lib/watch_status_and_license_to_initialize.js` to be compliant with rxjs v6 * Retrying initialize 20 times with a scaling backoff (elastic#20297) * Retrying initialize 20 times with a scaling backoff * Logging error when we are registering the privileges * Alternate legacy fallback (elastic#20322) * Beginning to use alternate callWithRequest fallback * Only use legacy fallback when user has "some" privileges on index * Logging useLegacyFallback when there's an authorization failure * Adding tests, logging failure during find no types fallback * Switching to using an enum instead of success/useLegacyFallback * Using _execute to share some of the structure * Moving comment to where it belongs * No longer audit logging when we use the legacy fallback * Setting the status to red on the first error then continually (elastic#20343) initializing * Renaming get*Privilege to get*Action * Adding "instance" to alert about other application privileges * Revising some of the naming for the edit roles screen * One more edit role variable renamed * hasPrivileges is now checkPrivileges * Revising check_license tests * Adding 2 more privileges tests * Moving the other _find method to be near his friend * Spelling "returning" correctly, whoops * Adding Privileges tests * tests for Elasticsearch's privileges APIs * Switching the hard-coded resource from 'default' to * * Throw error before we execute a POST privilege call that won't work * Resolving issue when initially registering privileges * Logging legacy fallback deprecation warning on login (elastic#20493) * Logging legacy fallback deprecation on login * Consolidation the privileges/authorization folder * Exposing rudimentary authorization service and fixing authenticate tests * Moving authorization services configuration to initAuthorization * Adding "actions" service exposed by the authorization * Fixing misspelling * Removing invalid and unused exports * Adding note about only adding privileges * Calling it initAuthorizationService * Throwing explicit validation error in actions.getSavedObjectAction * Deep freezing authorization service * Adding deepFreeze tests * Checking privileges in one call and cleaning up tests * Deriving application from Kibana index (elastic#20614) * Specifying the application on the "authorization service" * Moving watchStatusAndLicenseToInitialize to be below initAuthorizationService * Using short-hand propery assignment * Validate ES has_privileges response before trusting it (elastic#20682) * validate elasticsearch has_privileges response before trusting it * address feedback * Removing unused setting * Public Role APIs (elastic#20732) * Beginning to work on external role management APIs * Refactoring GET tests and adding more permutations * Adding test for excluding other resources * Adding get role tests * Splitting out the endpoints, or else it's gonna get overwhelming * Splitting out the post and delete actions * Beginning to work on POST and the tests * Posting the updated role * Adding update tests * Modifying the UI to use the new public APIs * Removing internal roles API * Moving the rbac api integration setup tests to use the public role apis * Testing field_security and query * Adding create role tests * We can't update the transient_metadata... * Removing debugger * Update and delete tests * Returning a 204 when POSTing a Role. * Switching POST to PUT and roles to role * We don't need the rbacApplication client-side anymore * Adding delete route tests * Using not found instead of not acceptable, as that's more likely * Only allowing us to PUT known Kibana privileges * Removing transient_metadata * Removing one letter variable names * Using PUT instead of POST when saving roles * Fixing broken tests * Adding setting to allow the user to turn off the legacy fallback (elastic#20766) * Pulling the version from the kibana server * Deleting unused file * Add API integration tests for roles with index and app privileges (elastic#21033) * Rbac phase1 functional UI tests (elastic#20949) * rbac functional tests * changes to the test file * RBAC_functional test * incorporating review feedback * slight modification to the addPriv() to cover all tests * removed the @ in secure roles and perm file in the describe block and made it look more relevant * Fixing role management API from users * Set a timeout when we try/catch a find, so it doesn't pause a long time * Changing the way we detect if a user is reserved for the ftr * Skipping flaky test
kobelb
added a commit
that referenced
this pull request
Jul 24, 2018
* partial implementation for OLS Phase 1 * Allow Saved Objects Client to be wrapped * Add placeholder "kibana.namespace" configuration property * revert changes to saved objects client * Remove circular dependency * Removing namespace setting, we're using xpack.security.rbac.application * Adding config.getDefault * Expose SavedObjectsClientProvider on the server for easy plugin consumption * migrate x-pack changes into kibana * Beginning to use the ES APIs to insert/check privileges (#18645) * Beginning to use the ES APIs to insert/check privileges * Removing todo comment, I think we're good with the current check * Adding ability to edit kibana application privileges * Introducing DEFAULT_RESOURCE constant * Removing unused arguments when performing saved objects auth check * Performing bulkCreate auth more efficiently * Throwing error in SavedObjectClient.find if type isn't provided * Fixing Reporting and removing errant console.log * Introducing a separate hasPrivileges "service" * Adding tests and fleshing out the has privileges "service" * Fixing error message * You can now edit whatever roles you want * We're gonna throw the find error in another PR * Changing conflicting version detection to work when user has no application privileges * Throwing correct error when user is forbidden * Removing unused interceptor * Adding warning if they're editing a role with application privileges we can't edit * Fixing filter... * Beginning to only update privileges when they need to be * More tests * One more test... * Restricting the rbac application name that can be chosen * Removing DEFAULT_RESOURCE check * Supporting 1024 characters for the role name * Renaming some variables, fixing issue with role w/ no kibana privileges * Throwing decorated general error when appropriate * Fixing test description * Dedent does nothing... * Renaming some functions * Adding built-in types and alphabetizing (#19306) * Filtering out non-default resource Kibana privileges (#19321) * Removing unused file * Adding kibana_rbac_dashboard_only_user to dashboard only mode roles (#19511) * Adding create default roles test (#19505) * RBAC - SecurityAuditLogger (#19571) * Manually porting over the AuditLogger for use within the security audit logger * HasPrivileges now returns the user from the request * Has privileges returns username from privilegeCheck * Adding first eventType to the security audit logger * Adding authorization success message * Logging arguments when authorization success * Fixing test description * Logging args during audit failures * RBAC Integration Tests (#19647) * Porting over the saved objects tests, a bunch are failing, I believe because security is preventing the requests * Running saved objects tests with rbac and xsrf disabled * Adding users * BulkGet now tests under 3 users * Adding create tests * Adding delete tests * Adding find tests * Adding get tests * Adding bulkGet forbidden tests * Adding not a kibana user tests * Update tests * Renaming the actions/privileges to be closer to the functions on the saved object client itself * Cleaning up tests and removing without index tests I'm considering the without index tests to be out of scope for the RBAC API testing, and we already have unit coverage for these and integration coverage via the OSS Saved Objects API tests. * Fixing misspelling * Fixing "conflicts" after merging master * Removing some white-space differences * Deleting files that got left behind in a merge * Adding the RBAC API Integration Tests * SavedObjectClient.find filtering (#19708) * Adding ability to specify filters when calling the repository * Implementing find filtering * Revert "Adding ability to specify filters when calling the repository" This reverts commit 9da30a1. * Adding integration tests for find filtering * Adding forbidden auth logging * Adding asserts to make sure some audit log isn't used * Adding more audit log specific tests * Necessarly is not a work, unfortunately * Fixing test * More descriptive name than "result" * Better unauthorized find message? * Adding getTypes tests * Trying to isolate cause of rbac test failures * Adding .toLowerCase() to work around capitalization issue * No longer exposing the auditLogger, we don't need it like that right now * Removing some unused code * Removing defaultSettings from test that doesn't utilize them * Fixing misspelling * Don't need an explicit login privilege when we have them all * Removing unused code, fixing misspelling, adding comment * Putting a file back * No longer creating the roles on start-up (#19799) * Removing kibana_rbac_dashboard_only_user from dashboard only role defaults * Fixing small issue with editing Kibana privileges * [RBAC Phase 1] - Update application privileges when XPack license changes (#19839) * Adding start to supporting basic license and switching to plat/gold * Initialize application privilages on XPack license change * restore mirror_status_and_initialize * additional tests and peer review updates * Introducing watchStatusAndLicenseToInitialize * Adding some tests * One more test * Even better tests * Removing unused mirrorStatusAndInitialize * Throwing an error if the wrong status function is called * RBAC Legacy Fallback (#19818) * Basic implementation, rather sloppy * Cleaning stuff up a bit * Beginning to write tests, going to refactor how we build the privileges * Making the buildPrivilegesMap no longer return application name as the main key * Using real privileges since we need to use them for the legacy fallback * Adding more tests * Fixing spelling * Fixing test description * Fixing comment description * Adding similar line breaks in the has privilege calls * No more settings * No more rbac enabled setting, we just do RBAC * Using describe to cleanup the test cases * Logging deprecations when using the legacy fallback * Cleaning up a bit... * Using the privilegeMap for the legacy fallback tests * Now with even less duplication * Removing stray `rbacEnabled` from angularjs * Fixing checkLicenses tests since we added RBAC * [Flaky Test] - wait for page load to complete (#19895) @kobelb this seems unrelated to our RBAC Phase 1 work, but I was able to consistently reproduce this on my machine. * [Flaky Test] Fixes flaky role test (#19899) Here's a fix for the latest flaky test @kobelb * Now with even easier repository access * Sample was including login/version privileges, which was occasionally (#19915) causing issues that were really hard to replicate * Dynamic types (#19925) No more hard-coded types! This will make it so that plugins that register their own mappings just transparently work. * start to address feedback * Fix RBAC Phase 1 merge from master (#20226) This updates RBAC Phase 1 to work against the latest master. Specifically: 1. Removes `xpack_main`'s `registerLicenseChangeCallback`, which we introduced in `security-app-privs`, in favor of `onLicenseInfoChange`, which was recently added to master 2. Updated `x-pack/plugins/security/server/lib/watch_status_and_license_to_initialize.js` to be compliant with rxjs v6 * Retrying initialize 20 times with a scaling backoff (#20297) * Retrying initialize 20 times with a scaling backoff * Logging error when we are registering the privileges * Alternate legacy fallback (#20322) * Beginning to use alternate callWithRequest fallback * Only use legacy fallback when user has "some" privileges on index * Logging useLegacyFallback when there's an authorization failure * Adding tests, logging failure during find no types fallback * Switching to using an enum instead of success/useLegacyFallback * Using _execute to share some of the structure * Moving comment to where it belongs * No longer audit logging when we use the legacy fallback * Setting the status to red on the first error then continually (#20343) initializing * Renaming get*Privilege to get*Action * Adding "instance" to alert about other application privileges * Revising some of the naming for the edit roles screen * One more edit role variable renamed * hasPrivileges is now checkPrivileges * Revising check_license tests * Adding 2 more privileges tests * Moving the other _find method to be near his friend * Spelling "returning" correctly, whoops * Adding Privileges tests * tests for Elasticsearch's privileges APIs * Switching the hard-coded resource from 'default' to * * Throw error before we execute a POST privilege call that won't work * Resolving issue when initially registering privileges * Logging legacy fallback deprecation warning on login (#20493) * Logging legacy fallback deprecation on login * Consolidation the privileges/authorization folder * Exposing rudimentary authorization service and fixing authenticate tests * Moving authorization services configuration to initAuthorization * Adding "actions" service exposed by the authorization * Fixing misspelling * Removing invalid and unused exports * Adding note about only adding privileges * Calling it initAuthorizationService * Throwing explicit validation error in actions.getSavedObjectAction * Deep freezing authorization service * Adding deepFreeze tests * Checking privileges in one call and cleaning up tests * Deriving application from Kibana index (#20614) * Specifying the application on the "authorization service" * Moving watchStatusAndLicenseToInitialize to be below initAuthorizationService * Using short-hand propery assignment * Validate ES has_privileges response before trusting it (#20682) * validate elasticsearch has_privileges response before trusting it * address feedback * Removing unused setting * Public Role APIs (#20732) * Beginning to work on external role management APIs * Refactoring GET tests and adding more permutations * Adding test for excluding other resources * Adding get role tests * Splitting out the endpoints, or else it's gonna get overwhelming * Splitting out the post and delete actions * Beginning to work on POST and the tests * Posting the updated role * Adding update tests * Modifying the UI to use the new public APIs * Removing internal roles API * Moving the rbac api integration setup tests to use the public role apis * Testing field_security and query * Adding create role tests * We can't update the transient_metadata... * Removing debugger * Update and delete tests * Returning a 204 when POSTing a Role. * Switching POST to PUT and roles to role * We don't need the rbacApplication client-side anymore * Adding delete route tests * Using not found instead of not acceptable, as that's more likely * Only allowing us to PUT known Kibana privileges * Removing transient_metadata * Removing one letter variable names * Using PUT instead of POST when saving roles * Fixing broken tests * Adding setting to allow the user to turn off the legacy fallback (#20766) * Pulling the version from the kibana server * Deleting unused file * Add API integration tests for roles with index and app privileges (#21033) * Rbac phase1 functional UI tests (#20949) * rbac functional tests * changes to the test file * RBAC_functional test * incorporating review feedback * slight modification to the addPriv() to cover all tests * removed the @ in secure roles and perm file in the describe block and made it look more relevant * Fixing role management API from users * Set a timeout when we try/catch a find, so it doesn't pause a long time * Changing the way we detect if a user is reserved for the ftr * Skipping flaky test
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR also introduces the "authorization service" that the security plugin exposes for consumption on the login route, and also the actions that are required to check the privileges.
The
checkPrivilegesservice also used to include, and disclose via themissingvariable, the login privilege, which doesn't make sense anymore given us checking the privilege automatically, so this logic has been revisited.