-
Notifications
You must be signed in to change notification settings - Fork 24.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce Application Privileges with support for Kibana RBAC (#32309)
This commit introduces "Application Privileges" to the X-Pack security model. Application Privileges are managed within Elasticsearch, and can be tested with the _has_privileges API, but do not grant access to any actions or resources within Elasticsearch. Their purpose is to allow applications outside of Elasticsearch to represent and store their own privileges model within Elasticsearch roles. Access to manage application privileges is handled in a new way that grants permission to specific application names only. This lays the foundation for more OLS on cluster privileges, which is implemented by allowing a cluster permission to inspect not just the action being executed, but also the request to which the action is applied. To support this, a "conditional cluster privilege" is introduced, which is like the existing cluster privilege, except that it has a Predicate over the request as well as over the action name. Specifically, this adds - GET/PUT/DELETE actions for defining application level privileges - application privileges in role definitions - application privileges in the has_privileges API - changes to the cluster permission class to support checking of request objects - a new "global" element on role definition to provide cluster object level security (only for manage application privileges) - changes to `kibana_user`, `kibana_dashboard_only_user` and `kibana_system` roles to use and manage application privileges Closes #29820 Closes #31559
- Loading branch information
Showing
93 changed files
with
7,190 additions
and
676 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
.../org/elasticsearch/xpack/core/security/action/privilege/ApplicationPrivilegesRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.core.security.action.privilege; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| /** | ||
| * Interface implemented by all Requests that manage application privileges | ||
| */ | ||
| public interface ApplicationPrivilegesRequest { | ||
|
|
||
| Collection<String> getApplicationNames(); | ||
| } |
33 changes: 33 additions & 0 deletions
33
...n/java/org/elasticsearch/xpack/core/security/action/privilege/DeletePrivilegesAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
| package org.elasticsearch.xpack.core.security.action.privilege; | ||
|
|
||
| import org.elasticsearch.action.Action; | ||
| import org.elasticsearch.client.ElasticsearchClient; | ||
|
|
||
| /** | ||
| * Action for deleting application privileges. | ||
| */ | ||
| public final class DeletePrivilegesAction | ||
| extends Action<DeletePrivilegesRequest, DeletePrivilegesResponse, DeletePrivilegesRequestBuilder> { | ||
|
|
||
| public static final DeletePrivilegesAction INSTANCE = new DeletePrivilegesAction(); | ||
| public static final String NAME = "cluster:admin/xpack/security/privilege/delete"; | ||
|
|
||
| private DeletePrivilegesAction() { | ||
| super(NAME); | ||
| } | ||
|
|
||
| @Override | ||
| public DeletePrivilegesResponse newResponse() { | ||
| return new DeletePrivilegesResponse(); | ||
| } | ||
|
|
||
| @Override | ||
| public DeletePrivilegesRequestBuilder newRequestBuilder(ElasticsearchClient client) { | ||
| return new DeletePrivilegesRequestBuilder(client, INSTANCE); | ||
| } | ||
| } |
101 changes: 101 additions & 0 deletions
101
.../java/org/elasticsearch/xpack/core/security/action/privilege/DeletePrivilegesRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
| package org.elasticsearch.xpack.core.security.action.privilege; | ||
|
|
||
| import org.elasticsearch.action.ActionRequest; | ||
| import org.elasticsearch.action.ActionRequestValidationException; | ||
| import org.elasticsearch.action.support.WriteRequest; | ||
| import org.elasticsearch.common.Strings; | ||
| import org.elasticsearch.common.io.stream.StreamInput; | ||
| import org.elasticsearch.common.io.stream.StreamOutput; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Arrays; | ||
| import java.util.Collection; | ||
| import java.util.Collections; | ||
|
|
||
| import static org.elasticsearch.action.ValidateActions.addValidationError; | ||
|
|
||
| /** | ||
| * A request to delete an application privilege. | ||
| */ | ||
| public final class DeletePrivilegesRequest extends ActionRequest | ||
| implements ApplicationPrivilegesRequest, WriteRequest<DeletePrivilegesRequest> { | ||
|
|
||
| private String application; | ||
| private String[] privileges; | ||
| private RefreshPolicy refreshPolicy = RefreshPolicy.IMMEDIATE; | ||
|
|
||
| public DeletePrivilegesRequest() { | ||
| this(null, Strings.EMPTY_ARRAY); | ||
| } | ||
|
|
||
| public DeletePrivilegesRequest(String application, String[] privileges) { | ||
| this.application = application; | ||
| this.privileges = privileges; | ||
| } | ||
|
|
||
| @Override | ||
| public DeletePrivilegesRequest setRefreshPolicy(RefreshPolicy refreshPolicy) { | ||
| this.refreshPolicy = refreshPolicy; | ||
| return this; | ||
| } | ||
|
|
||
| @Override | ||
| public RefreshPolicy getRefreshPolicy() { | ||
| return refreshPolicy; | ||
| } | ||
|
|
||
| @Override | ||
| public ActionRequestValidationException validate() { | ||
| ActionRequestValidationException validationException = null; | ||
| if (Strings.isNullOrEmpty(application)) { | ||
| validationException = addValidationError("application name is missing", validationException); | ||
| } | ||
| if (privileges == null || privileges.length == 0 || Arrays.stream(privileges).allMatch(Strings::isNullOrEmpty)) { | ||
| validationException = addValidationError("privileges are missing", validationException); | ||
| } | ||
| return validationException; | ||
| } | ||
|
|
||
| public void application(String application) { | ||
| this.application = application; | ||
| } | ||
|
|
||
| public String application() { | ||
| return application; | ||
| } | ||
|
|
||
| @Override | ||
| public Collection<String> getApplicationNames() { | ||
| return Collections.singleton(application); | ||
| } | ||
|
|
||
| public String[] privileges() { | ||
| return this.privileges; | ||
| } | ||
|
|
||
| public void privileges(String[] privileges) { | ||
| this.privileges = privileges; | ||
| } | ||
|
|
||
| @Override | ||
| public void readFrom(StreamInput in) throws IOException { | ||
| super.readFrom(in); | ||
| application = in.readString(); | ||
| privileges = in.readStringArray(); | ||
| refreshPolicy = RefreshPolicy.readFrom(in); | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| super.writeTo(out); | ||
| out.writeString(application); | ||
| out.writeStringArray(privileges); | ||
| refreshPolicy.writeTo(out); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.