[Connector API] Fix bug with with wrong target index for access control sync

[jedrazb]

Bug overview

• When executing access_control sync, the connector.index_name should point to a special index, prefixed with .search-acl-filter- that is intended to hold access control data
  • This special index takes form .search-acl-filter-{index-name}, where index-name references the currently attached index.
  • See how this is handled "correctly" in Kibana and connector framework
• Current bug causes access control data to be written to the target index that holds source docs, when starting access control syncs with Connector API

Changes

• Prefix index name correctly when creating new access control sync document

Validation

• unit tests
• yaml tests
• verified locally

[elasticsearchmachine]

Hi @jedrazb, I've created a changelog YAML for you.

[elasticsearchmachine]

Pinging @elastic/ent-search-eng (Team:Enterprise Search)

[artem-shelkovnikov]

Just to make sure I understand it - the problem happens if in Kibana somebody is scheduling an access control sync manually?

[jedrazb]

Just to make sure I understand it - the problem happens if in Kibana somebody is scheduling an access control sync manually?

@artem-shelkovnikov as of now Kibana doesn't make use of Connector API to create on-demand syncs. Everything works as expected (Kibana UI, scheduled AC syncs, etc. ) except for Connector API POST _connector/_sync_job endpoint for access control syncs. This bug only affected Connector API.

We need to fix this bug before integrating Kibana with this endpoint.

[elasticsearchmachine]

💔 Backport failed

Status	Branch	Result
❌	8.13	Commit could not be cherrypicked due to conflicts
❌	8.14	Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 109097

[jedrazb]

💔 Some backports could not be created

Status	Branch	Result
✅	8.14
❌	8.13	Conflict resolution was aborted by the user

Manual backport

To create the backport manually run:

backport --pr 109097

Questions ?

Please refer to the Backport tool documentation

[jedrazb]

Not backporting to 8.13 since no more 8.13.x patch releases seem to be planned