Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Making security a first class citizen of Kibana Core examples #186574

Closed
TinaHeiligers opened this issue Jun 20, 2024 · 5 comments
Closed

Making security a first class citizen of Kibana Core examples #186574

TinaHeiligers opened this issue Jun 20, 2024 · 5 comments
Labels
Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc

Comments

@TinaHeiligers
Copy link
Contributor

TinaHeiligers commented Jun 20, 2024 •
edited
Loading

Related to #174578
Create example migrations from security plugin APIs to core.security APIs.

Find and migrate a plugin's getCurrentUser
a) on the server side via start contract,
b) on the server side close to a HTTP handler where using it from the request context would have been better,
c) on the client side, and
d) If getCurrentUser is the only dependency on the security plugin, remove the dependency.
@botelastic botelastic bot added the needs-team Issues missing a team label label Jun 20, 2024
@TinaHeiligers
Copy link
Contributor Author

TinaHeiligers commented Jun 20, 2024 •
edited
Loading

Reporting uses getCurrentUser and licensing from the Security Plugin.
I'll migrate getCurrentUser as part of On-Week (June 2024).
We have to wait for licensing to be exposed from Core before completely migrating off of (and removing) the security Plugin.

@tsullivan will search for a client-side use case as part of On-Week June 2024.

@TinaHeiligers TinaHeiligers added the Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc label Jun 20, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-core (Team:Core)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Jun 20, 2024
@TinaHeiligers TinaHeiligers added the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Jun 20, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security)

@TinaHeiligers TinaHeiligers removed the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Jun 20, 2024
@tsullivan
Copy link
Member

tsullivan commented Jun 24, 2024 •
edited
Loading

I have found a few plugins throughout Kibana that call security.authc.getCurrentUser from browser-side code.

  • src/plugins/data_views/public:
    • Has a "getter" type called UserIdGetter. This is needed in the Data Views API client, which sends a user-hash field in request headers.
  • src/plugins/image_embeddable:
    • The Image Editor Flyout has a feature to allow the user to delete a file, based on whether the current user ID is stored in the file metadata.
  • x-pack/plugins/cases/public:
    • A useCurrentUser hook to build a query filter that gets the recent cases belonging to the current user
  • x-pack/plugins/cloud_integrations/cloud_links/public:
    • The current user is checked whether they are a cloud user before adding Cloud links to the security nav controls.
  • x-pack/plugins/data_visualizer/public:
    • used to generate text for a Filebeat configuration
    • used to generate a browser session seed for a FieldStats request

Some additional areas that security.authc is used in browser-side code:

  • x-pack/plugins/enterprise_search/public Already consumes getCurrentUser from core.security
  • x-pack/plugins/fleet/public Doesn't consume getCurrentUser
  • x-pack/plugins/maps/public
  • x-pack/plugins/observability_solution/apm/public
  • x-pack/plugins/observability_solution/observability_ai_assistant_app/public
  • x-pack/plugins/stack_connectors/public Doesn't consume getCurrentUser

I'd like to focus on an area or areas where updating the code to use core.security APIs will allow me to remove the security dependency from a plugin.

@tsullivan tsullivan mentioned this issue Jun 24, 2024
Merged
1 task
@TinaHeiligers TinaHeiligers mentioned this issue Jun 25, 2024
Merged
1 task
This was referenced Jun 25, 2024
Merged
Merged
Merged
Merged
Merged
Merged
tsullivan added a commit that referenced this issue Jun 25, 2024
@tsullivan
[Maps] Use client-side authc.getCurrentUser from core.security (#186915)
e7c867f 
Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Maps plugin uses the
`authc.getCurrentUser` in the `es_search_source` utility.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
tsullivan added a commit that referenced this issue Jun 25, 2024
@tsullivan
[Data Visualizer] Use client-side authc.getCurrentUser from core.secu…
966b082 
…rity (#186918)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Data Visualizer plugin uses the
`authc.getCurrentUser` method as a means to use create FileBeat
configuration example content.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
This was referenced Jun 25, 2024
Merged
Merged
@tsullivan tsullivan mentioned this issue Jun 26, 2024
Merged
1 task
tsullivan added a commit that referenced this issue Jun 26, 2024
@tsullivan
[Files] Use server-side authc.getCurrentUser from core.security (#186922
72090ee 
)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Files plugin uses the
`authc.getCurrentUser` method to attribute the current user to files
that are created in the system.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
tsullivan added a commit that referenced this issue Jun 26, 2024
@tsullivan
[Image Embeddable] Use client-side authc.getCurrentUser from core.sec…
15a495a 
…urity (#186917)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Image Embeddable plugin uses the
`authc.getCurrentUser` method as a means to allow the user to delete
image files that are attributed to them.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
This was referenced Jun 26, 2024
Merged
Merged
Merged
Merged
tsullivan added a commit that referenced this issue Jun 28, 2024
@tsullivan
[Elastic Assistant] Use server-side authc.getCurrentUser from core.se…
18adcec 
…curity (#186928)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Elastic Assistant plugin uses the
`authc.getCurrentUser` indirectly in several data clients in
`x-pack/plugins/elastic_assistant/server/routes/request_context_factory.ts`.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
TinaHeiligers added a commit that referenced this issue Jun 28, 2024
@TinaHeiligers @kibanamachine
update imports for types moved to core security service packages (#18…
a7fe7cb 
…7121)

## Summary

Part of #186574

Updates imports for types available from the core-security packages.

Co-authored-by: Kibana Machine <[email protected]>
This was referenced Jun 28, 2024
Merged
Merged
Closed
Closed
Merged
Closed
Merged
TinaHeiligers added a commit that referenced this issue Jun 28, 2024
@TinaHeiligers @kibanamachine @tsullivan
migrate getCurrentUser calls in reporting to core security service (#…
bebb273 
…186913)

## Summary

Part of #186574

Background: This PR is an example of a plugin migrating away from
depending on the Security plugin, which is a high-priority effort for
the last release before 9.0. The Reporting plugin uses
`authc.getCurrentUser` from the security plugin's start contract on the
server side.

This PR migrates `authc.getCurrentUser` from the security plugin start
contract to the core security service.

### Checklist

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Tim Sullivan <[email protected]>
@TinaHeiligers TinaHeiligers mentioned this issue Jun 30, 2024
Open
TinaHeiligers added a commit that referenced this issue Jun 30, 2024
@TinaHeiligers @kibanamachine
Migrate authc dependency from security plugin to core security service (
4eb07b1 
#187124)

## Summary

Part of #186574

Background: This PR is an example of a plugin migrating away from
depending on the Security plugin, which is a high-priority effort for
the last release before 9.0. The Cases plugin uses authc.getCurrentUser
from the security plugin's start contract on the server side.

This PR migrates authc.getCurrentUser from the security plugin start
contract to the core security service.

Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <[email protected]>
@afharo afharo mentioned this issue Jul 1, 2024
Merged
2 tasks
tsullivan added a commit that referenced this issue Jul 2, 2024
@tsullivan
[Alerting Plugin] Migrate authc.getCurrentUser usage to core.security (…
01cce98 
…#187020)

Part of #186574

## Summary

This PR migrates the Alerting Plugin's server-side code that consumes
`authc.getCurrentUser` to use coreContext.security.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
tsullivan added a commit that referenced this issue Jul 2, 2024
@tsullivan @kibanamachine
[Cloud Defend Plugin] Migrate authc.getCurrentUser usage to core.secu…
17de403 
…rity (#187023)

Part of #186574

## Summary

This PR migrates the Cloud Defend Plugin's route handler that consumes
`authc.getCurrentUser` to use `coreContext.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
@TinaHeiligers TinaHeiligers mentioned this issue Jul 2, 2024
Merged
tsullivan added a commit that referenced this issue Jul 2, 2024
@tsullivan @kibanamachine
[Lists Plugin] Migrate authc.getCurrentUser usage to coreContext.secu… (
9cc4c41 
#187179)

Part of #186574

## Summary

This PR migrates the Lists Plugin's `ListsRequestHandlerContext`, which
consumes `authc.getCurrentUser`, to use `coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
tsullivan added a commit that referenced this issue Jul 2, 2024
@tsullivan
[Actions Plugin] Use server-side authc.getCurrentUser from core.secur…
dc12ac8 
…ity (#186924)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0. The Actions plugin uses the
`authc.getCurrentUser` method to attribute the current user to persisted
actions that are created in the system.

### Checklist

Delete any items that are not applicable to this PR.

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
TinaHeiligers added a commit that referenced this issue Jul 2, 2024
@TinaHeiligers @elasticmachine
Exposes authenticate user mock from core-security-server-mocks (#187318)
525d24e 
Needed for #187306 and [probably
more to come](#186574).
Expose authenticated user mock and type from core-security server &
browser mocks.
Exposing the mock from Core avoids dependencies on the Security Plugin
remaining just for mocks.
It also helps avoid creating duplicates specifically for tests.

---------

Co-authored-by: Elastic Machine <[email protected]>
@TinaHeiligers TinaHeiligers mentioned this issue Jul 2, 2024
Closed
tsullivan added a commit that referenced this issue Jul 3, 2024
@tsullivan
[Serverless Search Plugin] Migrate browser-side authc.getCurrentUser …
69c1533 
…usage to coreStart.security (#187189)

Part of #186574

## Summary

This PR migrates the method to access a Serverless Search view model
field, which consumes `authc.getCurrentUser`, to use
`coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
tsullivan added a commit that referenced this issue Jul 3, 2024
@tsullivan
[APM Plugin - Browser] Migrate authc.getCurrentUser usage to coreStar…
78fa3c3 
…t.security (#187192)

Part of #186574

## Summary

This PR migrates the method to access an APM Plugin view model field,
which consumes `authc.getCurrentUser`, to use `coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
tsullivan added a commit that referenced this issue Jul 3, 2024
@tsullivan @kibanamachine
[Logstash Plugin] Migrate authc.getCurrentUser usage to coreContext.s…
482f2a9 
…ecurity (#187180)

Part of #186574

## Summary

This PR migrates the Logstash Plugin's route handler for saving a
pipeline, which consumes `authc.getCurrentUser`, to use
`coreContext.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
tsullivan added a commit that referenced this issue Jul 9, 2024
@tsullivan @kibanamachine
[ESO Plugin] Migrate authc.getCurrentUser usage to coreStart.security (…
de495d7 
…#187024)

Part of #186574

## Summary

This PR migrates the Encrypted Saved Object Plugin's route handler that
consumes `authc.getCurrentUser` to use `coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
tsullivan added a commit that referenced this issue Jul 9, 2024
@tsullivan
[Security Solution] Use authc.getCurrentUser from core.security (#187004
17eb2c8 
)

Part of #186574

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
@SiddharthMantri SiddharthMantri mentioned this issue Aug 1, 2024
Merged
SiddharthMantri added a commit that referenced this issue Aug 30, 2024
@SiddharthMantri @elasticmachine @kibanamachine
Migrate Enterprise search plugin authc dependencies from security plu…
74a551e 
…gin to core security service (#189713)

## Summary

Part of #186574
Closes #189714

Background: This PR is an example of a plugin migrating away from
depending on the Security plugin, which is a high-priority effort for
the last release before 9.0. The Enterprise search plugin uses
authc.apiKeys.create from the security plugin's start contract on the
server side.

For more context, the PR which exposes the API keys service from core is
here: #186910

This PR migrates the usage from the security plugin start contract to
the core security service.

---------

Co-authored-by: Elastic Machine <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
@TinaHeiligers
Copy link
Contributor Author

Closing as an ongoing issue to be handled during the implementations

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tsullivan @TinaHeiligers @elasticmachine