Unauthorized route migration for routes owned by kibana-core #198333

kibanamachine · 2024-10-30T13:09:11Z

Authz API migration for unauthorized routes

This PR migrates unauthorized routes owned by your team to a new security configuration.
Please refer to the documentation for more information: Authorization API

Before migration:

router.get({
  path: '/api/path',
  ...
}, handler);

After migration:

router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);

What to do next?

Review the changes in this PR.
Elaborate on the reasoning to opt-out of authorization.
Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible.
You might need to update your tests to reflect the new security configuration:

If you have snapshot tests that include the route definition.

Any questions?

If you have any questions or need help with API authorization, please reach out to the @elastic/kibana-security team.

elasticmachine · 2024-10-30T13:09:15Z

Pinging @elastic/kibana-core (Team:Core)

elasticmachine · 2024-10-30T15:13:09Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 28a784e

Failed CI Steps

FTR Configs #79

Test Failures

[job] [logs] FTR Configs #79 / machine learning - anomaly detection anomaly explorer with influencers with farequote based multi metric job Anomaly Charts as embeddable attaches an embeddable to a case

Metrics [docs]

✅ unchanged

src/plugins/saved_objects_management/server/routes/bulk_delete.ts

I confused authorization and authentication.

…a-core

kibanamachine · 2024-11-12T12:22:21Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11797149509

…#198333) ### Authz API migration for unauthorized routes This PR migrates unauthorized routes owned by your team to a new security configuration. Please refer to the documentation for more information: [Authorization API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization) ### **Before migration:** ```ts router.get({ path: '/api/path', ... }, handler); ``` ### **After migration:** ```ts router.get({ path: '/api/path', security: { authz: { enabled: false, reason: 'This route is opted out from authorization because ...', }, }, ... }, handler); ``` ### What to do next? 1. Review the changes in this PR. 2. Elaborate on the reasoning to opt-out of authorization. 3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible. 2. You might need to update your tests to reflect the new security configuration: - If you have snapshot tests that include the route definition. ## Any questions? If you have any questions or need help with API authorization, please reach out to the `@elastic/kibana-security` team. Co-authored-by: Jean-Louis Leysens <[email protected]> (cherry picked from commit 763b5de)

kibanamachine · 2024-11-12T12:27:44Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…#198333) ### Authz API migration for unauthorized routes This PR migrates unauthorized routes owned by your team to a new security configuration. Please refer to the documentation for more information: [Authorization API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization) ### **Before migration:** ```ts router.get({ path: '/api/path', ... }, handler); ``` ### **After migration:** ```ts router.get({ path: '/api/path', security: { authz: { enabled: false, reason: 'This route is opted out from authorization because ...', }, }, ... }, handler); ``` ### What to do next? 1. Review the changes in this PR. 2. Elaborate on the reasoning to opt-out of authorization. 3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible. 2. You might need to update your tests to reflect the new security configuration: - If you have snapshot tests that include the route definition. ## Any questions? If you have any questions or need help with API authorization, please reach out to the `@elastic/kibana-security` team. Co-authored-by: Jean-Louis Leysens <[email protected]>

kibanamachine · 2024-11-13T12:49:00Z