[Reporting] Kibana Application Privileges for Reporting

docs/settings/reporting-settings.asciidoc

@@ -275,8 +275,19 @@ For information about {kib} memory limits, see <<production, using {kib} in a pr
   every {kib} instance that has a unique <<kibana-index, `kibana.index`>> 
   setting. Defaults to `.reporting`.
 
+| `xpack.reporting.roles.enabled`
+  | deprecated:[7.13.0,This setting must be set to `false` in 8.0] Specifies whether to grant users
+  access to reporting features by assigning them a special role, specified by `xpack.reporting.roles.allow`. 
+  Granting access to users this way is deprecated: please set this to `false` and use
+  {kibana-ref}/kibana-privileges.html[{kib} privileges] instead.
+  Defaults to `true`. +
+
 | `xpack.reporting.roles.allow`
-  | Specifies the roles in addition to superusers that can use reporting.
+  | deprecated:[7.13.0,This setting will be removed in 8.0] Specifies the roles
+  in addition to superusers that can generate reports, using the Elasticsearch
+  role management API. Requires `xpack.reporting.roles.enabled` to be `true`.
+  Granting access to users this way is deprecated: please use
+  {kibana-ref}/kibana-privileges.html[{kib} privileges] instead.
   Defaults to `[ "reporting_user" ]`. +
 
 |===

docs/user/reporting/index.asciidoc

@@ -31,10 +31,15 @@ for different operating systems.
 [[reporting-required-privileges]]
 == Roles and privileges
 
-To generate a report, you must have the `reporting_user` role. You also need
-the appropriate {kib} privileges to access the objects that you
-want to report on and the {es} indices.  See <<secure-reporting, Reporting and security>>
-for an example.
+When security is enabled, access to reporting features is controlled by security privileges. In versions 7.12 and below, you can do this
+by assigning users the `reporting_user` role in Elasticsearch. In 7.13 and above, you can configure Reporting to use
+<<kibana-privileges, {kib} privileges>> instead. It is recommended that Reporting is configured to
+use Kibana privileges by setting `xpack.reporting.roles.enabled` to `false` in kibana.yml. By using Kibana privileges, you can define
+custom roles that grant Reporting privileges as sub-features of Kibana applications in Role Management.
+
+Users also need the appropriate {kib} privileges to access the objects that you
+want to report on and the {es} indices.  See <<secure-reporting, Reporting and
+security>> for an example.
 
 [float]
 [[manually-generate-reports]]

docs/user/security/reporting.asciidoc

@@ -16,17 +16,19 @@ For more information, see
 ////
 
 [[reporting-app-users]]
-To enable users to generate reports, you must assign them the built-in `reporting_user`
-role.  Users will also need the appropriate <<kibana-privileges, {kib} privileges>> to access the objects
-to report on and the {es} indices.
+Access to reporting features is controlled by security privileges. In versions 7.12 and below, you can do this
+by assigning users the `reporting_user` role in Elasticsearch. In 7.13 and above, you can configure Reporting to use
+<<kibana-privileges, {kib} privileges>> instead. It is recommended that Reporting is configured to
+use Kibana privileges by setting `xpack.reporting.roles.enabled` to `false` in kibana.yml. By using Kibana privileges, you can define
+custom roles that grant Reporting privileges as sub-features of Kibana applications in Role Management.
 
 [float]
 [[reporting-roles-management-ui]]
 === If you are using the `native` realm
 
 To assign roles, use the *Roles* UI or <<reporting-roles-user-api, user API>>.
-This example shows how to use *Roles* page to create a user who has a custom role and the
-`reporting_user` role.
+This example shows how to use *Roles* page to create a user who has a custom role 
+that grants reporting feature privileges in Kibana applications.
 
 . Open the main menu, then click *Stack Management > Roles*.
 
@@ -42,7 +44,13 @@ For more information, see {ref}/security-privileges.html[Security privileges].
 [role="screenshot"]
 image::user/security/images/reporting-privileges-example.png["Reporting privileges"]
 
-. Add space privileges.
+. Add space privileges that include permission to use Reporting for the necessary Kibana applications.
++
+To allow users to CSV create reports in Discover, or PDF reports in Canvas,
+Visualize editor and Dashboard, click the "Add Kibana privilege" button expand
+the menu for each application, and grant the role the privileges to generate
+reports by choosing "All" privileges for all features, or "Customize" to grant
+the role the privilege to generate reports for only certain applications.
 +
 Reporting users typically save searches, create
 visualizations, and build dashboards. They require a space
@@ -51,48 +59,48 @@ that provides read and write privileges in
 
 . Save your new role.
 
-. Open the main menu, then click *Stack Management > Users*, add a new user, and assign the user the built-in
-`reporting_user` role and your new custom role, `custom_reporting_user`.
-
-[float]
-==== With a custom index
-
-If you are using Reporting with a custom index,
-the `xpack.reporting.index` setting should begin 
-with `.reporting-*`. The default {kib} system user has
-`all` privileges against the `.reporting-*` pattern of indices.
-
-[source,js]
-xpack.reporting.index: '.reporting-custom-index'
-
-If you use a different pattern for the `xpack.reporting.index` setting,
-you must create a custom role with appropriate access to the index, similar
-to the following:
-
-. Open the main menu, then click *Stack Management > Roles*.
-. Click *Create role*, then name the role `custom-reporting-user`.
-. Specify the custom index and assign it the `all` index privilege.
-. Open the main menu, then click *Stack Management > Users* and create a new user with
-the `kibana_system` role and the `custom-reporting-user` role.
-. Configure {kib} to use the new account:
-[source,js]
-elasticsearch.username: 'custom_kibana_system'
+. Open the main menu, then click *Stack Management > Users*, add a new user, and assign the user 
+your new custom role, `custom_reporting_user`.
 
 [float]
 [[reporting-roles-user-api]]
 ==== With the user API
-This example uses the {ref}/security-api-put-user.html[user API] to create a user who has the
-`reporting_user` role and the `kibana_admin` role:
+This example uses the {ref}/security-api-put-role.html[role API] to create a role that
+grants the privilege to generate reports in Canvas, Discover, Visualize Editor, and Dashboard.
+This role is meant to be granted to users in combination with other roles that grant access
+read to the necessary data in Elasticsearch, and at least "read" access in the applications
+where they'll generate reports.
 
 [source, sh]
 ---------------------------------------------------------------
-POST /_security/user/reporter
+POST /_security/role/reporter
 {
-  "password" : "x-pack-test-password",
-  "roles" : ["kibana_admin", "reporting_user"],
-  "full_name" : "Reporting User"
+  metadata: {},
+  elasticsearch: { cluster: [], indices: [], run_as: [] },
+  kibana: [
+    {
+      base: [],
+      feature: {
+        dashboard: [
+          'generate_screenshot_report', <1>
+          'download_csv_dashboard_panel' <2>
+        ],
+        discover: ['generate_csv_report'], <3>
+        canvas: ['generate_screenshot_report'], <4>
+        visualize: ['generate_screenshot_report'], <5>
+      },
+      spaces: ['*'],
+    }
+  ]
 }
 ---------------------------------------------------------------
+// CONSOLE
+
+<1> Grants access to generate PNG and PDF reports in the Dashboard application
+<2> Grants access to download CSV files from saved search panels in the Dashboard application
+<3> Grants access to generate CSV reports from saved searches in Discover
+<4> Grants access to generate PDF reports in Canvas
+<5> Grants access to generate PNG and PDF reports in the Visualize editor
 
 [float]
 === If you are using an external identity provider
@@ -160,3 +168,28 @@ includes a watch that submits requests as the built-in `elastic` user:
 
 For more information about configuring watches, see
 {ref}/how-watcher-works.html[How {watcher} works].
+
+[float]
+==== When using a custom index
+
+If you are using Reporting with a custom index,
+the `xpack.reporting.index` setting should begin 
+with `.reporting-*`. The default {kib} system user has
+`all` privileges against the `.reporting-*` pattern of indices.
+
+[source,js]
+xpack.reporting.index: '.reporting-custom-index'
+
+If you use a different pattern for the `xpack.reporting.index` setting,
+you must create a custom role with appropriate access to the index, similar
+to the following:
+
+. Open the main menu, then click *Stack Management > Roles*.
+. Click *Create role*, then name the role `custom-reporting-user`.
+. Specify the custom index and assign it the `all` index privilege.
+. Open the main menu, then click *Stack Management > Users* and create a new user with
+the `kibana_system` role and the `custom-reporting-user` role.
+. Configure {kib} to use the new account:
+[source,js]
+elasticsearch.username: 'custom_kibana_system'
+

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -267,6 +267,7 @@ kibana_vars=(
     xpack.reporting.queue.pollIntervalErrorMultiplier
     xpack.reporting.queue.timeout
     xpack.reporting.roles.allow
+    xpack.reporting.roles.enabled
     xpack.rollup.enabled
     xpack.searchprofiler.enabled
     xpack.security.audit.enabled

x-pack/plugins/canvas/kibana.json

@@ -18,6 +18,7 @@
     ],
     "optionalPlugins": [
       "home",
+      "reporting",
       "usageCollection"
     ],
     "requiredBundles": [

x-pack/plugins/canvas/public/components/workpad_header/share_menu/__stories__/share_menu.stories.tsx

@@ -12,6 +12,7 @@ import { ShareMenu } from '../share_menu.component';
 
 storiesOf('components/WorkpadHeader/ShareMenu', module).add('default', () => (
   <ShareMenu
+    includeReporting={true}
     onCopy={action('onCopy')}
     onExport={action('onExport')}
     getExportUrl={(type: string) => {

x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.component.tsx

@@ -28,6 +28,8 @@ export type OnCloseFn = (type: CloseTypes) => void;
 export type GetExportUrlFn = (type: ExportUrlTypes, layout: LayoutType) => string;
 
 export interface Props {
+  /** Flag to include the Reporting option only if Reporting is enabled */
+  includeReporting: boolean;
   /** Handler to invoke when an export URL is copied to the clipboard. */
   onCopy: OnCopyFn;
   /** Handler to invoke when an end product is exported. */
@@ -39,7 +41,12 @@ export interface Props {
 /**
  * The Menu for Exporting a Workpad from Canvas.
  */
-export const ShareMenu: FunctionComponent<Props> = ({ onCopy, onExport, getExportUrl }) => {
+export const ShareMenu: FunctionComponent<Props> = ({
+  includeReporting,
+  onCopy,
+  onExport,
+  getExportUrl,
+}) => {
   const [showFlyout, setShowFlyout] = useState(false);
 
   const onClose = () => {
@@ -73,16 +80,18 @@ export const ShareMenu: FunctionComponent<Props> = ({ onCopy, onExport, getExpor
           closePopover();
         },
       },
-      {
-        name: strings.getShareDownloadPDFTitle(),
-        icon: 'document',
-        panel: {
-          id: 1,
-          title: strings.getShareDownloadPDFTitle(),
-          content: getPDFPanel(closePopover),
-        },
-        'data-test-subj': 'sharePanel-PDFReports',
-      },
+      includeReporting
+        ? {
+            name: strings.getShareDownloadPDFTitle(),
+            icon: 'document',
+            panel: {
+              id: 1,
+              title: strings.getShareDownloadPDFTitle(),
+              content: getPDFPanel(closePopover),
+            },
+            'data-test-subj': 'sharePanel-PDFReports',
+          }
+        : false,
       {
         name: strings.getShareWebsiteTitle(),
         icon: <EuiIcon type="globe" size="m" />,
@@ -91,7 +100,7 @@ export const ShareMenu: FunctionComponent<Props> = ({ onCopy, onExport, getExpor
           closePopover();
         },
       },
-    ],
+    ].filter(Boolean),
   });
 
   const shareControl = (togglePopover: React.MouseEventHandler<any>) => (
@@ -123,6 +132,7 @@ export const ShareMenu: FunctionComponent<Props> = ({ onCopy, onExport, getExpor
 };
 
 ShareMenu.propTypes = {
+  includeReporting: PropTypes.bool.isRequired,
   onCopy: PropTypes.func.isRequired,
   onExport: PropTypes.func.isRequired,
   getExportUrl: PropTypes.func.isRequired,

x-pack/plugins/canvas/public/components/workpad_header/share_menu/share_menu.ts

@@ -46,6 +46,7 @@ export const ShareMenu = compose<ComponentProps, {}>(
   withServices,
   withProps(
     ({ workpad, pageCount, services }: Props & WithServicesProps): ComponentProps => ({
+      includeReporting: services.reporting.includeReporting(),
       getExportUrl: (type, layout) => {
         if (type === 'pdf') {
           const pdfUrl = getPdfUrl(

x-pack/plugins/canvas/public/plugin.tsx

@@ -7,6 +7,7 @@
 
 import { BehaviorSubject } from 'rxjs';
 import { ChartsPluginSetup, ChartsPluginStart } from 'src/plugins/charts/public';
+import { ReportingStart } from '../../reporting/public';
 import {
   CoreSetup,
   CoreStart,
@@ -49,6 +50,7 @@ export interface CanvasSetupDeps {
 export interface CanvasStartDeps {
   embeddable: EmbeddableStart;
   expressions: ExpressionsStart;
+  reporting?: ReportingStart;
   inspector: InspectorStart;
   uiActions: UiActionsStart;
   charts: ChartsPluginStart;

x-pack/plugins/canvas/public/services/context.tsx

@@ -54,6 +54,7 @@ export const ServicesProvider: FC<{
     notify: specifiedProviders.notify.getService(),
     platform: specifiedProviders.platform.getService(),
     navLink: specifiedProviders.navLink.getService(),
+    reporting: specifiedProviders.reporting.getService(),
     labs: specifiedProviders.labs.getService(),
   };
   return <context.Provider value={value}>{children}</context.Provider>;

x-pack/plugins/canvas/public/services/index.ts

@@ -14,6 +14,7 @@ import { navLinkServiceFactory } from './nav_link';
 import { embeddablesServiceFactory } from './embeddables';
 import { expressionsServiceFactory } from './expressions';
 import { labsServiceFactory } from './labs';
+import { reportingServiceFactory } from './reporting';
 
 export { NotifyService } from './notify';
 export { PlatformService } from './platform';
@@ -79,6 +80,7 @@ export const services = {
   notify: new CanvasServiceProvider(notifyServiceFactory),
   platform: new CanvasServiceProvider(platformServiceFactory),
   navLink: new CanvasServiceProvider(navLinkServiceFactory),
+  reporting: new CanvasServiceProvider(reportingServiceFactory),
   labs: new CanvasServiceProvider(labsServiceFactory),
 };
 
@@ -90,6 +92,7 @@ export interface CanvasServices {
   notify: ServiceFromProvider<typeof services.notify>;
   platform: ServiceFromProvider<typeof services.platform>;
   navLink: ServiceFromProvider<typeof services.navLink>;
+  reporting: ServiceFromProvider<typeof services.reporting>;
   labs: ServiceFromProvider<typeof services.labs>;
 }
 
@@ -117,4 +120,5 @@ export const {
   platform: platformService,
   navLink: navLinkService,
   expressions: expressionsService,
+  reporting: reportingService,
 } = services;

x-pack/plugins/canvas/public/services/reporting.ts

@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CanvasServiceFactory } from './';
+
+export interface ReportingService {
+  includeReporting: () => boolean;
+}
+
+export const reportingServiceFactory: CanvasServiceFactory<ReportingService> = (
+  _coreSetup,
+  coreStart,
+  setupPlugins,
+  startPlugins
+): ReportingService => {
+  const { reporting } = startPlugins;
+  if (!reporting) {
+    // Reporting is not enabled
+    return { includeReporting: () => false };
+  }
+
+  if (reporting.usesUiCapabilities()) {
+    // Canvas has declared Reporting as a subfeature with the `generatePdf` UI Capability
+    return {
+      includeReporting: () => coreStart.application.capabilities.canvas?.generatePdf === true,
+    };
+  }
+
+  // Reporting is enabled as an Elasticsearch feature (Legacy/Deprecated)
+  return { includeReporting: () => true };
+};

x-pack/plugins/canvas/public/services/stubs/index.ts

@@ -8,6 +8,7 @@
 import { CanvasServices, services } from '../';
 import { embeddablesService } from './embeddables';
 import { expressionsService } from './expressions';
+import { reportingService } from './reporting';
 import { navLinkService } from './nav_link';
 import { notifyService } from './notify';
 import { labsService } from './labs';
@@ -16,6 +17,7 @@ import { platformService } from './platform';
 export const stubs: CanvasServices = {
   embeddables: embeddablesService,
   expressions: expressionsService,
+  reporting: reportingService,
   navLink: navLinkService,
   notify: notifyService,
   platform: platformService,