[BUG] There should be a seperate configuration option to enable restapi: permissions

[peternied]

What is the bug?
When #2411 was added to the security codebase, it expands the way that customers can manage their OpenSearch cluster - yay! However, for existing customers this expands the exposure on their security cluster beyond what it was in previous releases.

This functionality should be opt-in via a setting in the security configuration and default to 'disabled' to prevent this exposure.

Do you have any additional context?
The security configuration has to be modified on the disk on a bootstrapping node or using the 'super admin' certificate workflow making the configuration a safe place for this default value.

[stephen-crawford]

[Triage] This seems like a good call. Tagging as good first issue. @cwperks could you add a little bit of a getting started for a first time contributor.

[peternied]

FYI @willyborankin @reta

[cwperks]

New Settings are generally set in ConfigConstants (See example: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/support/ConfigConstants.java#L250).

From the plugin architecture of OpenSearch, plugins can extend OpenSearch to add additional settings to be placed in opensearch.yml and those settings are defined in getSettings() of the plugin. For the security plugin, that is here: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java#L886-L1069

Settings defined in getSettings() typically provide a default and for this issue that would be false (meaning disabled).

The last part is to use that settings around here: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java#L120-L124 (and maybe other places to) to evaluate the permission if the setting is enabled. Note that Settings are not presently available in that class, but you should be able to add them in the class' constructor.

[aruzhannurman]

I would like to work on this bug

[stephen-crawford]

Hi @aruzhannurman, thank you for volunteering. I went ahead and assigned this to you. Let me know if you have any questions or need any help.

[willyborankin]

@scrawfor99 and @aruzhannurman oops I did it already, sorry didn't add a comment my bad here is PR: #2605

[stephen-crawford]

Hi @willyborankin, no worries. Thank you for following up. I will reassign this to you. I appreciate you following up so quickly so that @aruzhannurman does not end up duplicating work.