Fix and unskip functional test

[jportner]

Resolves #96001.

[spalger]

Thank you @jportner, I'll merge upstream once https://kibana-ci.elastic.co/job/elasticsearch+snapshots+verify/2536/ is done and we can test this against the new snapshot

[legrego]

Thanks @jportner!

@sqren the deprecation notice for the apm_user role doesn't indicate what is replacing the apm_user role. Do we have any guidance to share with our users yet, or is that still being worked on?

[spalger]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: d7389ae
• Storybooks Preview

Metrics [docs]

✅ unchanged

History

• 💔 Build #116682 failed ae42135

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[kibanamachine]

💚 Backport successful

✅ 7.x / #96076

This backport PR will be merged automatically after passing CI.

[sorenlouv]

@sqren the deprecation notice for the apm_user role doesn't indicate what is replacing the apm_user role. Do we have any guidance to share with our users yet, or is that still being worked on?

You are correct. Eventually we want to replace the apm_user role with the upcoming stack-wide roles. I think they are scheduled for 7.13.

[legrego]

You are correct. Eventually we want to replace the apm_user role with the upcoming stack-wide roles. I think they are scheduled for 7.13.

I don't think these roles serve the same purpose. The stack-wide roles will grant some level of access to essentially all features, whereas your apm_user role grants access to just APM.

What if a user just wants APM access, and doesn't want to grant access to the other features enabled by these stack-wide roles?

[sorenlouv]

What if a user just wants APM access, and doesn't want to grant access to the other features enabled by these stack-wide roles?

Then they can create a custom role. We don't want to have built-in roles for this in the future.

[sorenlouv]

Today it's quite cumbersome to create custom roles. The user has to hunt down all the permissions needed for a specific solution.
In the future I hope the security ui will help the user with this, so the user can simply select "APM" and it will auto-populate the needed indices etc. So essentially creating a custom role should be as easy as using a built-in role.

[legrego]

Today it's quite cumbersome to create custom roles. The user has to hunt down all the permissions needed for a specific solution.
In the future I hope the security ui will help the user with this, so the user can simply select "APM" and it will auto-populate the needed indices etc. So essentially creating a custom role should be as easy as using a built-in role.

I agree 100%, and I think we've captured this already within #80634.

There is a similar initiative planned [at some point in the future] to handle this in a more holistic way -- something that won't just change the Kibana UI, but would potentially change the way we think about these privileges from a stack-wide perspective.

[sorenlouv]

There is a similar initiative planned [at some point in the future] to handle this in a more holistic way -- something that won't just change the Kibana UI, but would potentially change the way we think about these privileges from a stack-wide perspective.

Sounds exciting. Keep me posted!