-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add "Space management" feature #51759
Comments
Pinging @elastic/kibana-security (Team:Security) |
A couple of thoughts/notes for future me, or whoever picks this up: To enable the feature control toggles, Spaces management currently requires access to In order to introduce a "Space management" feature, we will probably need to relax this restriction, or enhance that API endpoint to only return a subset of features based on the current user's privileges. An alternative is to prevent features from being toggled/viewed unless the user has access to all features. If we take this route, then the user will only be able to customize the space description and avatar. This means that a user effectively needs "space all" in order to manage the space to its full capacity, which perhaps reduces the usefulness of having a separate feature. When creating a role that can manage spaces, we will have the following scenarios:
BWC: This new feature will need to be excluded from the existing space base privileges, because we don't want to grant this to existing users with "space: all". However, we still need to grant access to users with "Global all". |
I am very interested in this solution, because I want certain users to be able to manage Spaces within Kibana management, but do not have any other possibilities within Kibana management. The role "kibana_admin" has to much authorizations for this group of users. |
Thanks @erwin-willemsen, we appreciate the feedback. For your situation, would you want your users to be able to manage all spaces (including the ability to create new spaces), or should they only be able to manage a subset of spaces (presumably spaces which already exist)? |
Dear Larry,
I would like for my users (a specific group) to be able to manage all spaces, including the ability to create new spaces and delete deprecated ones, but nothing else within Kibana - Management.
Kind regards/Met vriendelijke groet,
Erwin Willemsen
consultant
<mailto:[email protected]>+31 (0) 6 11 85 53 50
[http://images.enable-u.com/images/logo%20Enable%20U.png]
From: Larry Gregory <[email protected]>
Sent: dinsdag 8 september 2020 12:44
To: elastic/kibana <[email protected]>
Cc: Erwin Willemsen <[email protected]>; Mention <[email protected]>
Subject: Re: [elastic/kibana] Add "Space management" feature (#51759)
I am very interested in this solution, because I want certain users to be able to manage Spaces within Kibana management, but do not have any other possibilities within Kibana management. The role "kibana_admin" has to much authorizations for this group of users.
Thanks @erwin-willemsen<https://github.com/erwin-willemsen>, we appreciate the feedback. For your situation, would you want your users to be able to manage all spaces (including the ability to create new spaces), or should they only be able to manage a subset of spaces (presumably spaces which already exist)?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub<#51759 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ANLEQOS3YGLDTKYZPG6NWHDSEYDGVANCNFSM4JR3XF7A>.
==
This message is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you have received it by mistake, please let us know by e-mail reply and delete it from your system; you may not copy this message or disclose its contents to anyone. The integrity and security of this message cannot be guaranteed on the Internet.
Enable-U, Asterweg 19D11, 1031 HL Amsterdam, www.enable-u.com<http://www.enable-u.com/>
|
Currently, the ability to manage spaces is only granted with the "All" base privileges, and must be granted at all spaces. This isn't obvious, and it also is limiting because you can't create a role which can only manage spaces or manage a subset of spaces.
The text was updated successfully, but these errors were encountered: