Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expose ability to deny ('except') access to fields via FLS #26472

Merged
merged 12 commits into from
Apr 16, 2019
Merged

Expose ability to deny ('except') access to fields via FLS #26472

merged 12 commits into from
Apr 16, 2019

Conversation

legrego
Copy link
Member

@legrego legrego commented Nov 30, 2018 •
edited
Loading

Summary

This adds a "Denied Fields" input control to the Index Privileges section of the Role Management screen. This allows users to specify fields which should be denied access via FLS.

This does not implement any new security controls, but rather exposes the existing field_security.except functionality of the ES Roles API.

Fixes #17951

Proposed UI

image

image

i18n test

image

TODO

  • Design review
  • Testing

"Release note: Deny access to specific fields using Field-Level Security. This was always available via the Elasticsearch APIs, but was missing from Kibana's Role Management UI"

@legrego legrego added WIP Work in progress Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! Feature:Users/Roles/API Keys labels Nov 30, 2018
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security

@legrego
Copy link
Member Author

legrego commented Nov 30, 2018

cc @cchaos / @AlonaNadler - no rush on this, I just wanted to make you aware of the proposed UI change, if you have any feedback.

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@cchaos
Copy link
Contributor

cchaos commented Dec 3, 2018

My only worry is that those fields may be unnecessarily squished now by adding a fourth field to that row. May want to consider moving the form to a flyout and displaying a summary in the page.

@AlonaNadler
Copy link

AlonaNadler commented Dec 3, 2018 •
edited
Loading

@legrego is this a new ES capability or a way to ease the UI for FLS?
Denied fields is similar to restricting fields?
What happens when I have a conflict? e.g. grant fields for field A and denied field A ?
Does it provide the ability to grant permission to all the fields except for field A or the opposite restrict all fields except field A

@legrego
Copy link
Member Author

legrego commented Dec 3, 2018

@cchaos I agree it is a bit squished right now. Moving to a flyout is doable, but I'm worried what that might look like for users without DLS/FLS enabled. If DLS/FLS is not enabled, then then all users will see is the Indices and Privileges dropdowns. They won't have Granted fields, Denied fields, or the Grant read privileges to selected documents switch/textarea.

We could conditionally do the flyout only if DLS/FLS is enabled, but then the documentation/screenshots for this screen might look inconsistent for some users who don't have the same feature set enabled.

@AlonaNadler this isn't new functionality - it's existed in ES for quite a while, but the Kibana UI was never updated to support it. I'm not sure when ES first introduced this, but the issue for the Kibana UI has been opened since February 2018.

@cchaos
Copy link
Contributor

cchaos commented Dec 4, 2018

@legrego So the optional fields in that line only show for a particular group of people?

How about, then, if we add another toggle above the current one that is something like "Grant granular privileges to fields" and when toggled on will show those two fields below.

@legrego
Copy link
Member Author

legrego commented Dec 4, 2018

@legrego So the optional fields in that line only show for a particular group of people?

Yep, they are only available with a Platinum license.

How about, then, if we add another toggle above the current one that is something like "Grant granular privileges to fields" and when toggled on will show those two fields below.

I like this approach. I'll give it a shot and post a screenshot so we can all see what it looks like.

@legrego legrego requested a review from a team as a code owner April 4, 2019 12:19
@legrego
Copy link
Member Author

legrego commented Apr 4, 2019

I updated the screenshots above to reflect @cchaos's suggestions. The FLS fields are now hidden behind a toggle, consistent with the DLS fields.

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elasticmachine
Copy link
Contributor

💔 Build Failed

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@elasticmachine
Copy link
Contributor

💔 Build Failed

@legrego legrego removed the WIP Work in progress label Apr 16, 2019
@legrego legrego changed the title [WIP] - Expose ability to deny ('except') access to fields via FLS Expose ability to deny ('except') access to fields via FLS Apr 16, 2019
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@legrego legrego requested a review from kobelb April 16, 2019 15:18
@legrego legrego added the review label Apr 16, 2019
@legrego legrego merged commit 9bc7bc3 into elastic:master Apr 16, 2019
@legrego legrego deleted the security/fls-except-fields branch April 16, 2019 18:56
@legrego legrego removed the review label Apr 16, 2019
@legrego legrego mentioned this pull request Apr 16, 2019
Merged
legrego added a commit to legrego/kibana that referenced this pull request Apr 16, 2019
@legrego
Expose ability to deny ('except') access to fields via FLS (elastic#2…
860ebad 
…6472)

* expose ability to deny ('except')  access to fields via FLS

* expose ability to deny ('except')  access to fields via FLS

* Moves FLS fields behind a switch to be consistent with DLS fields

* remove unused import

* fix security page object

* remove unused code

* remove unused translations
legrego added a commit that referenced this pull request Apr 16, 2019
@legrego
[7.x] Expose ability to deny ('except') access to fields via FLS (#26472
4f574e1 
) (#35180)

Backports the following commits to 7.x:
 - Expose ability to deny ('except')  access to fields via FLS  (#26472)
walterra pushed a commit to walterra/kibana that referenced this pull request Apr 23, 2019
@legrego @walterra
Expose ability to deny ('except') access to fields via FLS (elastic#2…
1e91ab6 
…6472)

* expose ability to deny ('except')  access to fields via FLS

* expose ability to deny ('except')  access to fields via FLS

* Moves FLS fields behind a switch to be consistent with DLS fields

* remove unused import

* fix security page object

* remove unused code

* remove unused translations
@legrego legrego mentioned this pull request Aug 26, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kobelb kobelb kobelb approved these changes

Assignees
No one assigned
Labels
Feature:Users/Roles/API Keys release_note:enhancement Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.2.0 v8.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support for "except" fields in role management UI
5 participants
@legrego @elasticmachine @cchaos @AlonaNadler @kobelb