[FEATURE] Set the global, private, or a custom tenant as a default through OpenSearch Dashboards Security Plugin

[shanilpa]

Context

Is your feature request related to a problem?
Currently a default tenant (global or private) can be set through YML configuration files. Configuring through these files is a complex and somewhat frustrating experience for admin users. In order to enhance the UX for configuring tenancy it would be nice to offer admin users a dynamic way to set a default tenant between the global and private tenant through the OpenSearch Dashboards Security Plugin.

Other context notes

• By default the global tenant is the default tenant for all users if not specifically configured by the admin.
• Saved objects created in private tenants can not be accessed by other users.
• Saved objects created in the global tenant are accessible to all users.
• The global tenant can not be disabled
• Custom tenants can not be set as a default as some roles maybe mapped to that tenant but not all.

Users / Personas

• Admin - This is a user that has access to the security plugin and can configure tenancy. They can also use tenancy like a non-admin user would.
• Non-admin - These are users that do not have access to the security plugin, they can not configure tenancy but can use the feature if it is enabled and their admin has granted them appropriate permissions to do so.

What solution would you like?

NB: These are design mockups. Some copy is placeholder and not all interactions are polished.
Mockups may differ from the final launched feature.

1. Set the global tenant as default from configure

• Admin users can set a global, private, or custom tenant as the default tenant
• When non-admin users login to Dashboards they will load into this default tenant. In the case that a custom tenant is set as a default and a user does not have permissions they will default to global tenant, followed by the private tenant in that order.

Global.Default.Configure.mp4

2. Set the global tenant from the manage table as a quick action

• Admin users can select a tenant (private, global, or custom) from the manage table and set it as a default.
• Friction is introduced via modal so they can consider their decision

Global.Default.Table.mp4

Additional Details

These UX improvements are based on work/tasks outlined in this issue and this RFC for making tenancy dynamically configurable.

[jimishs]

Thanks for starting this @shanilpa

"By default the private tenant is the default tenant for all users if not specifically configured by the admin."
Recently we made the change to make global tenant as the default, as requested by many users. Are we considering to change this again?

[jimishs]

What is the usecase for "Admin users can enable "enforce default tenant" which disregards a tenancy cookie and loads them into the default tenant instead."

Once admins select a default tenant, we should enforce this automatically. Adding a second level of options is confusing. Can you elaborate on why this option may be necessary?

[stephen-crawford]

[Triage] Assigning to @shanilpa since he is still working on the development. Thank you for this great start!

[abhivka7]

Thanks for starting this @shanilpa

"By default the private tenant is the default tenant for all users if not specifically configured by the admin." Recently we made the change to make global tenant as the default, as requested by many users. Are we considering to change this again?

Correct @jimishs . Global is the Default Tenant now.

[kgcreative]

related: #74

[shanilpa]

This feature has launched: opensearch-project/security#2607