Add support for deprecated roles #57209

legrego · 2020-02-10T16:03:06Z

Summary

Updates the User, Role, and Role Mappings management pages to warn about the use of deprecated roles.

Resolves #25722

Dashboard Only Mode Roles

Deprecates the advanced setting:

User Grid Page

Edit User Page

Role Grid Page

View Deprecated Role

Role Mappings Grid Page

Edit Role Mapping Page

elasticmachine · 2020-02-12T12:58:38Z

Pinging @elastic/kibana-security (Team:Security)

legrego · 2020-02-11T16:16:37Z

x-pack/plugins/security/common/model/role.ts

 /**
 * Returns whether given role is editable through the UI or not.
 *
 * @param role the Role as returned by roles API
 */
-export function isReadOnlyRole(role: Partial<Role>): boolean {
-  return isReservedRole(role) || (role._transform_error?.length ?? 0) > 0;
+export function isRoleReadOnly(role: Partial<Role>): boolean {


note Just a rename to be more consistent with the other functions in this module

legrego · 2020-02-11T16:17:15Z

x-pack/plugins/security/public/account_management/account_management_page.tsx

@@ -14,11 +14,11 @@ import { PersonalInfo } from './personal_info';

 interface Props {
  authc: AuthenticationServiceSetup;
-  apiClient: PublicMethodsOf<UserAPIClient>;


note: just a rename to make the client instance clearer, since this component now requires two API clients

legrego · 2020-02-12T12:48:19Z

src/core/public/doc_links/doc_links_service.ts

@@ -120,6 +120,7 @@ export class DocLinksService {
        },
        management: {
          kibanaSearchSettings: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/advanced-options.html#kibana-search-settings`,
+          dashboardSettings: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/advanced-options.html#kibana-dashboard-settings`,


Added to support the Deprecated badge for the xpackDashboardMode:roles Advanced Setting added in:

https://github.com/legrego/kibana/blob/58a25faaad88409fcda649dbb204c37d4b0a360b/x-pack/legacy/plugins/dashboard_mode/index.js#L36-L43

legrego · 2020-02-12T12:52:43Z

.../public/management/role_mappings/edit_role_mapping/mapping_info_panel/mapping_info_panel.tsx

-                defaultMessage="Enable mapping"
-              />
-            }
+            label={i18n.translate(


note This just resolves an EUI warning where EuiSwitch's label must be a string when showLabel={false}.

pgayvallet

LGTM for platform changes

legrego · 2020-02-13T21:15:13Z

@elastic/kibana-security this is ready for review

kobelb · 2020-02-14T19:36:52Z

ACK: reviewing

x-pack/plugins/security/common/model/role.ts

x-pack/plugins/security/public/management/role_combo_box/role_combo_box.tsx

...s/security/public/management/role_mappings/edit_role_mapping/role_selector/role_selector.tsx

...security/public/management/role_mappings/role_mappings_grid/role_mappings_grid_page.test.tsx

x-pack/plugins/security/public/management/roles/roles_grid/roles_grid_page.tsx

x-pack/plugins/security/public/management/users/edit_user/edit_user_page.tsx

x-pack/plugins/security/public/management/users/users_grid/users_grid_page.tsx

lizozom

Snapshot changes.
LGTM

…ort-deprecated-roles

legrego · 2020-02-25T12:44:41Z

@elasticmachine merge upstream

legrego · 2020-02-27T19:26:44Z

@elasticmachine merge upstream

legrego · 2020-02-27T21:22:51Z

@elasticmachine merge upstream

legrego · 2020-02-28T12:28:32Z

@elasticmachine merge upstream

legrego · 2020-02-28T14:37:07Z

@kobelb this is ready for another pass. Flaky test result appears unrelated to any changes here.

…ort-deprecated-roles

gchaps · 2020-03-02T21:13:16Z

Here are some suggestions to tighten up the text a bit:

Tooltip
The kibana_user role is deprecated. Use kibana_admin instead.

Roles
This user is assigned a deprecated role. Please migrate to a supported role.

Feature privileges
This role is deprecated. Configure a custom role to grant access to the Dashboard feature.

Mapping
This mapping is assigned a deprecated role. Please migrate to a supported role.

…ort-deprecated-roles

legrego · 2020-03-03T12:08:19Z

Thanks @gchaps!

I'd like to make the copy for the "Tooltip" and "Feature privileges" suggestions match, as they're currently generated using a shared mechanism.

Would you be ok replacing

This role is deprecated. Configure a custom role to grant access to the Dashboard feature.

with

The kibana_dashboard_only_user role is deprecated. Configure a custom role to grant access to the Dashboard feature.
?

More generically, the message looks like this:

The {roleName} role is deprecated. {reason}.

Where {roleName} is the name of the deprecated role, and {reason} is the second half of the explanation, which is the part provided by Elasticsearch.

…o/kibana into security/support-deprecated-roles

gchaps · 2020-03-03T15:58:55Z

@legrego good idea to make the text match. I edited the tooltip to match our marketing guidelines--we prefer to use Dashboard without "feature" or "app". Also, it makes the text shorter.

The kibana_dashboard_only_user role is deprecated. Configure a custom role to grant access to Dashboard.

…ort-deprecated-roles

kibanamachine · 2020-03-03T18:13:40Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 82540f0

History

💔 Build #30330 failed 5b96cb9
💛 Build #29690 was flaky 7ac1293
💔 Build #29554 failed a91b341
💔 Build #29509 failed fa1b3c1
💚 Build #28792 succeeded 7b1fcb0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Add support for deprecated roles * address PR feedback * remove unused import * copy edits * fix snapshots Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

legrego · 2020-03-03T19:31:46Z

Opened corresponding Elasticsearch PR to update deprecation reasons: elastic/elasticsearch#53074

* Add support for deprecated roles * address PR feedback * remove unused import * copy edits * fix snapshots Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

legrego force-pushed the security/support-deprecated-roles branch from f32c39c to e5141b7 Compare February 10, 2020 20:02

Add support for deprecated roles

58a25fa

legrego force-pushed the security/support-deprecated-roles branch from e5141b7 to 58a25fa Compare February 11, 2020 16:04

legrego mentioned this pull request Feb 11, 2020

Deprecate kibana_user and kibana_dashboard_only_user roles #45045

Closed

4 tasks

legrego added Feature:Security/Authorization Platform Security - Authorization release_note:enhancement Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.7.0 v8.0.0 labels Feb 12, 2020

legrego marked this pull request as ready for review February 12, 2020 12:58

legrego requested review from a team as code owners February 12, 2020 12:58

legrego commented Feb 12, 2020

View reviewed changes

pgayvallet approved these changes Feb 12, 2020

View reviewed changes

kobelb reviewed Feb 14, 2020

View reviewed changes

lizozom approved these changes Feb 16, 2020

View reviewed changes

legrego added 3 commits February 24, 2020 13:14

address PR feedback

7d3a613

Merge branch 'master' of github.com:elastic/kibana into security/supp…

00083bb

…ort-deprecated-roles

remove unused import

63f3a17

mshustov approved these changes Feb 25, 2020

View reviewed changes

Merge branch 'master' into security/support-deprecated-roles

7b1fcb0

legrego requested a review from kobelb February 25, 2020 20:00

Merge branch 'master' into security/support-deprecated-roles

fa1b3c1

Merge branch 'master' into security/support-deprecated-roles

a91b341

Merge branch 'master' into security/support-deprecated-roles

7ac1293

kobelb approved these changes Mar 2, 2020

View reviewed changes

legrego mentioned this pull request Mar 2, 2020

[Docs] Clarify kibana_user role usage and deprecation in documentation as it relates to feature controls #58245

Closed

Merge branch 'master' of github.com:elastic/kibana into security/supp…

dd30852

…ort-deprecated-roles

legrego added 2 commits March 3, 2020 07:03

copy edits

4af8470

Merge branch 'master' of github.com:elastic/kibana into security/supp…

1972a9e

…ort-deprecated-roles

Merge branch 'security/support-deprecated-roles' of github.com:legreg…

5b96cb9

…o/kibana into security/support-deprecated-roles

legrego added 2 commits March 3, 2020 11:19

fix snapshots

349b7f2

Merge branch 'master' of github.com:elastic/kibana into security/supp…

82540f0

…ort-deprecated-roles

legrego merged commit 74030c9 into elastic:master Mar 3, 2020

legrego deleted the security/support-deprecated-roles branch March 3, 2020 18:23

legrego mentioned this pull request Mar 3, 2020

[7.x] Add support for deprecated roles (#57209) #59197

Merged

legrego mentioned this pull request Mar 3, 2020

Security - Update role deprecation reasons elastic/elasticsearch#53074

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for deprecated roles #57209

Add support for deprecated roles #57209

legrego commented Feb 10, 2020 •

edited

elasticmachine commented Feb 12, 2020

legrego Feb 11, 2020

legrego Feb 11, 2020

legrego Feb 12, 2020

legrego Feb 12, 2020

pgayvallet left a comment

legrego commented Feb 13, 2020

kobelb commented Feb 14, 2020

lizozom left a comment

legrego commented Feb 25, 2020

legrego commented Feb 27, 2020

legrego commented Feb 27, 2020

legrego commented Feb 28, 2020

legrego commented Feb 28, 2020

gchaps commented Mar 2, 2020

legrego commented Mar 3, 2020

gchaps commented Mar 3, 2020

kibanamachine commented Mar 3, 2020

legrego commented Mar 3, 2020

Add support for deprecated roles #57209

Add support for deprecated roles #57209

Conversation

legrego commented Feb 10, 2020 • edited

Summary

Dashboard Only Mode Roles

User Grid Page

Edit User Page

Role Grid Page

View Deprecated Role

Role Mappings Grid Page

Edit Role Mapping Page

elasticmachine commented Feb 12, 2020

legrego Feb 11, 2020

Choose a reason for hiding this comment

legrego Feb 11, 2020

Choose a reason for hiding this comment

legrego Feb 12, 2020

Choose a reason for hiding this comment

legrego Feb 12, 2020

Choose a reason for hiding this comment

pgayvallet left a comment

Choose a reason for hiding this comment

legrego commented Feb 13, 2020

kobelb commented Feb 14, 2020

lizozom left a comment

Choose a reason for hiding this comment

legrego commented Feb 25, 2020

legrego commented Feb 27, 2020

legrego commented Feb 27, 2020

legrego commented Feb 28, 2020

legrego commented Feb 28, 2020

gchaps commented Mar 2, 2020

legrego commented Mar 3, 2020

gchaps commented Mar 3, 2020

kibanamachine commented Mar 3, 2020

💚 Build Succeeded

History

legrego commented Mar 3, 2020

legrego commented Feb 10, 2020 •

edited