Rest admin permissions #2411

willyborankin · 2023-01-20T10:49:12Z

Description

The aim of this PR is to introduce authorization mechanism for endpoints not only for the super admin
but for users with certain permissions.
Endpoints are:

nodesdn
allowlist
actiongroup
user / internalusers
roles
rolesmapping
tenants

Each endpoint has its own permission:
- restapi:admin/actiongroups - full access to action groups
- restapi:admin/allowlist - full access to allow list
- restapi:admin/internalusers - full access to internal users
- restapi:admin/nodesdn - full access to nodes DN
- restapi:admin/roles - full access to roles
- restapi:admin/rolesmapping - full access to roles mapping
- restapi:admin/ssl/certs/info - full access to SSL certs info
- restapi:admin/ssl/certs/reload - full access to SSL certs reload
- restapi:admin/tenants - full access to tenants

The role with such permissions it is possible to create via static configuration,
all attempts to create roles, roles mapping or action group with such permissions are forbidden except super admin and the user with the certain permission.

Issues Resolved

#1878

Is this a backport? If so, please add backport PR # and/or commits #
So far not but I think it is possible.

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

unit testing done

Check List

New functionality includes testing
New functionality has been documented
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

peternied

Just starting to review, thanks for the contribution!

peternied · 2023-01-20T21:42:12Z

src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java

+        }
+        if (adminDNs.isAdmin(userAndRemoteAddress.getLeft())) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Not SSL admin for {}", endpoint);


Seems like they are admin if this block is hit, typo?

Ahh sure must be Super Admin

peternied

Thorough job! Thank you for also expanding out the test coverage for non-admin cert super user cases.

I've called out some code I'd like to see changed and some areas I've got questions. Thanks!

src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java

src/main/java/org/opensearch/security/dlic/rest/support/Utils.java

src/main/java/org/opensearch/security/dlic/rest/api/SecuritySSLCertsAction.java

src/test/java/org/opensearch/security/dlic/rest/api/AbstractRestApiUnitTest.java

src/main/java/org/opensearch/security/securityconf/SecurityRoles.java

src/test/java/org/opensearch/security/dlic/rest/api/ActionGroupsApiTest.java

stephen-crawford · 2023-01-23T14:48:01Z

src/main/java/org/opensearch/security/dlic/rest/api/PatchableResourceApiAction.java

-                                      AdminDNs adminDNs, ConfigurationRepository cl, ClusterService cs,
-                                      PrincipalExtractor principalExtractor, PrivilegesEvaluator evaluator, ThreadPool threadPool,
-                                      AuditLog auditLog) {
+    protected PatchableResourceApiAction(Settings settings, Path configPath, RestController controller, Client client,


For my own understanding, is there a reason we need this to be protected vs. public?

Yes no reasons. Will move protected and use public

src/main/java/org/opensearch/security/dlic/rest/api/PatchableResourceApiAction.java

src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java

stephen-crawford · 2023-01-23T16:39:55Z

src/main/java/org/opensearch/security/securityconf/ConfigModelV6.java

+            return roles.stream()
+                    .map(r -> {
+                        final WildcardMatcher m = WildcardMatcher.from(r.clusterPerms);
+                        return m == WildcardMatcher.ANY ? WildcardMatcher.NONE : m;


Is this return ternary condition backwards? Isn't this saying "if wildcardmatcher.matches(any) return "NONE" else return "m"" and don't you want it to be the other way around?

I may be misinterpreting this statement.

This way Im trying to avoid of such configuration:

all_access: reserved: true hidden: false static: true description: "Allow full access to all indices and all cluster APIs" cluster_permissions: - "*"

so any user without restapi:admin/* permission does not have access to the endpoint. TBH I do not like it maybe better solution exists?

Gotcha, that makes sense given what you are trying to do. Perhaps you could leave a short comment mentioning this?

Sure will add.

Also, could you add a test to verify this behavior, which explicitly tests *, restapi:admin/*, restapi:admin/<some-specific-action>, and <any-other-random-action>

admin gets assigned to all_access by default here: https://github.com/opensearch-project/security/blob/main/config/roles_mapping.yml#L13-L17

This will mean that admin does not get the restapi:* permissions by default, right? If not, then the role would need to be updated or a new role created using the API, securityadmin or by creating a brand new security index in a new cluster.

If admin currently has the ability to use the REST APIs, then after this change the admin should still be able to modify the securityconfig via API by default. I'm not positive of the behavior, but will follow-up after testing.

@willyborankin What do you think about this? all_access that gives all API access and a new role that has permissions cluster:* and indices:*.

all_access: reserved: true hidden: false static: true description: "Allow full access to all APIs" cluster_permissions: - "*" all_cluster_and_indices: reserved: true hidden: false static: true description: "Allow full access to all indices and all cluster APIs" cluster_permissions: - "cluster:*" - "indices:*"

src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java

src/test/java/org/opensearch/security/dlic/rest/api/SslCertsApiTest.java

stephen-crawford · 2023-01-23T16:48:50Z

src/test/java/org/opensearch/security/ssl/SecuritySSLReloadCertsActionTests.java

-        Assert.assertEquals("Unauthorized", reloadCertsResponse.getStatusReason());
-    }
-
-
    @Test


Should these tests be moved into the new SSL test class you made?

Like with Actions tests need to be cleaned to make it more readable and better to support. I haven't touched them yet just to avoid of breaking everything.

That makes sense. Your contribution is greatly appreciated.

DarshitChanpura

Thank you @willyborankin for this detailed contribution! One generic request, could you please add javadoc for classes/methods you introduced.

DarshitChanpura · 2023-01-23T18:44:26Z

src/main/java/org/opensearch/security/dlic/rest/api/AbstractApiAction.java

+	protected boolean hasPermissionsToCreate(final SecurityDynamicConfiguration<?> dynamicConfigFactory,
+											 final Object content,
+											 final String resourceName) throws IOException {
+		return true;


Following defaults of Boolean, this should return false by default and the implementers can override to return true if needed.

src/main/java/org/opensearch/security/dlic/rest/api/PatchableResourceApiAction.java

DarshitChanpura · 2023-01-23T20:50:37Z

src/main/java/org/opensearch/security/securityconf/ConfigModelV6.java

+            return roles.stream()
+                    .map(r -> {
+                        final WildcardMatcher m = WildcardMatcher.from(r.clusterPerms);
+                        return m == WildcardMatcher.ANY ? WildcardMatcher.NONE : m;


Also, could you add a test to verify this behavior, which explicitly tests *, restapi:admin/*, restapi:admin/<some-specific-action>, and <any-other-random-action>

DarshitChanpura · 2023-01-23T21:10:21Z

src/test/java/org/opensearch/security/dlic/rest/api/RolesApiTest.java

+                ENDPOINT + "/roles",
+                createPatchRestAdminPermissionsPayload("remove"),
+                restApiHeader);
+        System.out.println("RESPONSE: " + response.getBody());


nit: can remove this sysout?

Sure leftovers :-)

cwperks

@willyborankin Thank you for the PR! I took a first pass and I've got a few questions around the PR, but overall I think this is a good base to continue working from. My biggest concern here is the change to isSuperAdmin() and that it looks like the default admin permissions may change to not allow the admin to use the API until explicitly granted. Let us know if you have any questions.

cwperks · 2023-01-24T14:14:00Z

src/main/java/org/opensearch/security/dlic/rest/api/SecuritySSLCertsAction.java

+    }
+
+    /**
+     * GET request to fetch transport certificate details


nit: Can the json be formatted in this comment similar to how it was in SecuritySSLCertsInfoAction?

cwperks · 2023-01-24T14:32:01Z

src/main/java/org/opensearch/security/securityconf/ConfigModelV6.java

+            return roles.stream()
+                    .map(r -> {
+                        final WildcardMatcher m = WildcardMatcher.from(r.clusterPerms);
+                        return m == WildcardMatcher.ANY ? WildcardMatcher.NONE : m;


admin gets assigned to all_access by default here: https://github.com/opensearch-project/security/blob/main/config/roles_mapping.yml#L13-L17

This will mean that admin does not get the restapi:* permissions by default, right? If not, then the role would need to be updated or a new role created using the API, securityadmin or by creating a brand new security index in a new cluster.

If admin currently has the ability to use the REST APIs, then after this change the admin should still be able to modify the securityconfig via API by default. I'm not positive of the behavior, but will follow-up after testing.

@willyborankin What do you think about this? all_access that gives all API access and a new role that has permissions cluster:* and indices:*.

all_access: reserved: true hidden: false static: true description: "Allow full access to all APIs" cluster_permissions: - "*" all_cluster_and_indices: reserved: true hidden: false static: true description: "Allow full access to all indices and all cluster APIs" cluster_permissions: - "cluster:*" - "indices:*"

cwperks · 2023-01-24T14:39:22Z

src/main/java/org/opensearch/security/dlic/rest/api/AbstractApiAction.java

@@ -558,8 +569,7 @@ public String getName() {
 	protected abstract Endpoint getEndpoint();

 	protected boolean isSuperAdmin() {
-		User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER);


The implementation for this function should not change. Super admin is reserved in the security plugin to indicate that a user is using client cert authentication and the principal of the cert matches a configured admin_dn in opensearch.yml.

and it isn't change. I just move this check here: https://github.com/willyborankin/security/blob/5110fb1fb7a673177641a6803cbc16ea56b24ec4/src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java#L98. I think it is better to keep this code in one place instead of:

if (adminDNs.isAdmin(user.getName()) && ....)

otherwise tests wont pass for existing behave

@cwperks Regarding admin and current roles. True I missed it!. I think split up roles is a good idea otherwise the end user can easily shoot their foot and cluster could be compromised. An alternative solution would be just forbid to create any role, roles mappings and action group for such permissions and config them ones before cluster up and running but I'm not sure that this is a good idea. Just to be on the same page you idea is to introduce:

all_cluster_and_indices: reserved: true hidden: false static: true description: "Allow full access to all indices and all cluster APIs" cluster_permissions: - "cluster:*" - "indices:*"

and assign admin by default to it right?

I believe the default configuration gives admin the permission to perform:

nodesdn allowlist actiongroup user / internalusers roles rolesmapping tenants

but not

reloadcerts

Only the superadmin (connected via client cert) can perform reloadcerts now.

After this change I would still expect the admin to perform the same actions without additional config.

Thank you for addressing all of the PR comments right away, this change looks good to me. Thank you for the contribution!

cwperks · 2023-01-24T14:43:53Z

src/main/java/org/opensearch/security/dlic/rest/api/RestApiAdminPrivilegesEvaluator.java

+        if (adminDNs.isAdmin(userAndRemoteAddress.getLeft())) {
+            if (logger.isDebugEnabled()) {
+                logger.debug(
+                        "Security admin permissions required for endpoint {} but {} is not an admin",


This log message is the opposite of what it should be. The original block in RestApiPrivilegesEvaluator was:

if (!adminDNs.isAdminDN(sslInfo.getPrincipal())) { logger.warn("Security admin permissions required but {} is not an admin", sslInfo.getPrincipal()); return "Security admin permissions required but " + sslInfo.getPrincipal() + " is not an admin"; }

if the user is connecting with admin dn then they are said to be super admin and have privileges to perform all actions in the cluster.

ok will change np.

Ahhh sorry misread the comment. The code in the master:

User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER); return adminDNs.isAdmin(user);

I only added a debug message. The purpose of isSuperAdmin() stays the same. RestApiAdminPrivilegesEvaluator just adds additional check for the permission nothing more since the logged in user can has such permissions to change e.g. hidden or reserved fields. Maybe the name for the class RestApiAdminPrivilegesEvaluator needs to be changed for better understanding what it does. WDYT?

cwperks · 2023-01-24T14:53:53Z

src/main/java/org/opensearch/security/dlic/rest/api/RolesApiAction.java

@@ -77,4 +79,22 @@ protected CType getConfigName() {
        return CType.ROLES;
 	}

+	@Override
+	protected boolean hasPermissionsToCreate(final SecurityDynamicConfiguration<?> dynamicConfiguration, final Object content, final String resourceName) throws IOException {
+		if (restApiAdminPrivilegesEvaluator.containsRestApiAdminPermissions(content)) {


If the user is assigned restapi:admin/* what is the purpose of the isSuperAdmin() check? I saw that the implementation of isSuperAdmin was also changed in this PR, but it has a specific meaning in the security plugin.

Curious, why not follow a similar pattern to cluster permissions where in ConfigModelV7 and ConfigModelV6 there is a WildcardMatcher that tests the given action to see if it matches permissions that the user is assigned.

See https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java#L544-L546

Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Signed-off-by: Andrey Pleskach <ples@aiven.io>

Signed-off-by: Andrey Pleskach <ples@aiven.io>

peternied

All my feedback has been addressed, thanks!

cwperks · 2023-02-09T15:57:58Z

FYI @willyborankin, I just stumbled upon a feature of the security plugin I was unfamiliar with before today. There is a config setting called plugins.security.restapi.roles_enabled. i.e. plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] - https://github.com/opensearch-project/security/blob/main/tools/install_demo_configuration.sh#L378

This config setting gives users of that role access to the security APIs as well.

DarshitChanpura

Thank you for this contribution @willyborankin!

DarshitChanpura · 2023-02-09T17:19:34Z

src/test/java/org/opensearch/security/securityconf/SecurityRolesPermissionsTest.java

+        metaNode.set("_meta", meta("tenants"));
+        return SecurityDynamicConfiguration.fromNode(metaNode, CType.TENANTS, 2, 0, 0);
+    }
+


this is awesome.. Thank you!

willyborankin · 2023-02-10T10:20:48Z

FYI @willyborankin, I just stumbled upon a feature of the security plugin I was unfamiliar with before today. There is a config setting called plugins.security.restapi.roles_enabled. i.e. plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] - https://github.com/opensearch-project/security/blob/main/tools/install_demo_configuration.sh#L378

This config setting gives users of that role access to the security APIs as well.

@cwperks Terribly sorry, was planning to add my comments today. I was on vacation previous week and this one was in the different city to meet my team :-). Only had time to push my changes.

opensearch-trigger-bot · 2023-02-21T18:55:32Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-2411-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d676716e83d1ab387e9e6a0c0f3284e39ed967f5
# Push it to GitHub
git push --set-upstream origin backport/backport-2411-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-2411-to-2.x.

cwperks · 2023-02-21T19:07:38Z

@willyborankin @reta Apologies for not adding the backport label earlier. There is a code freeze for 2.6 EOD today and I have been going through PRs to ensure the backport label was added for PRs that should be backported. If this featured should be shipped in one of the 2.x releases can someone look into creating a manual backport?

willyborankin · 2023-02-21T19:23:26Z

Sure will do tomorrow.

Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io>

Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io> Co-authored-by: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>

…project#2466)" This reverts commit 076715d.

…project#2466)" This reverts commit 076715d. Signed-off-by: Andrey Pleskach <ples@aiven.io>

This reverts commit 076715d. Signed-off-by: Andrey Pleskach <ples@aiven.io>

Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>

opensearch-trigger-bot · 2023-05-30T13:38:34Z

The backport to 2.8 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.8 2.8
# Navigate to the new working tree
cd .worktrees/backport-2.8
# Create a new branch
git switch --create backport/backport-2411-to-2.8
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d676716e83d1ab387e9e6a0c0f3284e39ed967f5
# Push it to GitHub
git push --set-upstream origin backport/backport-2411-to-2.8
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.8

Then, create a pull request where the base branch is 2.8 and the compare/head branch is backport/backport-2411-to-2.8.

Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io> (cherry picked from commit d676716)

* role.yml changes for lron feature (#2789) (#2792) Signed-off-by: zhichao-aws <zhichaog@amazon.com> (cherry picked from commit a580dfc) Co-authored-by: zhichao-aws <zhichaog@amazon.com> * add ml model group system index (#2790) (#2797) Signed-off-by: Yaliang Wu <ylwu@amazon.com> (cherry picked from commit 1bb2ef1) Co-authored-by: Yaliang Wu <ylwu@amazon.com> * Rest admin permissions (#2411) Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io> (cherry picked from commit d676716) * Fixes CI errors Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes HTTP5 imports Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes password related changes in tests Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Update ActionGroupsApiTest.java Remove unused import * Incorporates jar hell fix Signed-off-by: Darshit Chanpura <dchanp@amazon.com> --------- Signed-off-by: Darshit Chanpura <dchanp@amazon.com> Co-authored-by: opensearch-trigger-bot[bot] <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com> Co-authored-by: zhichao-aws <zhichaog@amazon.com> Co-authored-by: Yaliang Wu <ylwu@amazon.com> Co-authored-by: Andrey Pleskach <ples@aiven.io> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>

* Rest admin permissions (#2411) Permissions for REST admin user Added granular permissions for all REST API actions in OpenSearch to be individually assigned. Permissions are: - 'restapi:admin/actiongroups' - allow full access to actiongroups - 'restapi:admin/allowlist' - allow full access to allowlist - 'restapi:admin/internalusers'- allow full access to internalusers - 'restapi:admin/nodesdn'- allow full access to nodesdn - 'restapi:admin/roles' - allow full access to roles - 'restapi:admin/rolesmapping' - allow full access to roles mappings - 'restapi:admin/ssl/certs/info' - allow full access to certs info - 'restapi:admin/ssl/certs/reload' - allow full access to certs reload - 'restapi:admin/tenants' - allow full access to tenants Adds tests for these permissions. Signed-off-by: Andrey Pleskach <ples@aiven.io> (cherry picked from commit d676716) * Fixes CI errors Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes HTTP5 imports Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes password related changes in tests Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Update ActionGroupsApiTest.java Remove unused import * Incorporates jar hell fix Signed-off-by: Darshit Chanpura <dchanp@amazon.com> --------- Signed-off-by: Darshit Chanpura <dchanp@amazon.com> Co-authored-by: Andrey Pleskach <ples@aiven.io> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>

willyborankin requested a review from a team January 20, 2023 10:49

willyborankin force-pushed the rest-admin-permissions branch 3 times, most recently from 6963323 to 0bb277f Compare January 20, 2023 18:14

peternied reviewed Jan 20, 2023

View reviewed changes

peternied requested changes Jan 20, 2023

View reviewed changes

stephen-crawford reviewed Jan 23, 2023

View reviewed changes

willyborankin force-pushed the rest-admin-permissions branch from 0bb277f to 5110fb1 Compare January 23, 2023 18:46

willyborankin requested a review from peternied January 23, 2023 18:47

reta mentioned this pull request Jan 23, 2023

[FEATURE] Allow to disable SSL/TLS communication #2414

Closed

DarshitChanpura reviewed Jan 23, 2023

View reviewed changes

cwperks reviewed Jan 24, 2023

View reviewed changes

willyborankin added 2 commits February 6, 2023 16:50

Tests for support of permissions for REST admin user

b336e27

Signed-off-by: Andrey Pleskach <ples@aiven.io>

willyborankin force-pushed the rest-admin-permissions branch from 5110fb1 to b336e27 Compare February 6, 2023 15:51

peternied approved these changes Feb 6, 2023

View reviewed changes

RyanL1997 approved these changes Feb 9, 2023

View reviewed changes

cwperks approved these changes Feb 9, 2023

View reviewed changes

DarshitChanpura approved these changes Feb 9, 2023

View reviewed changes

DarshitChanpura merged commit d676716 into opensearch-project:main Feb 9, 2023

cwperks added the backport 2.x backport to 2.x branch label Feb 21, 2023

stephen-crawford mentioned this pull request Feb 21, 2023

Add release notes for 2.6.0.0 #2456

Merged

3 tasks

defesteban mentioned this pull request Mar 14, 2023

[DOC] Using OpenSearch plugins.security.ssl.http.enabled set to false is an unsupported configuration opensearch-project/documentation-website#913

Closed

4 tasks

Rishikesh1159 added a commit to Rishikesh1159/security that referenced this pull request Mar 15, 2023

Revert "Rest admin permissions (opensearch-project#2411) (opensearch-…

13beb3d

…project#2466)" This reverts commit 076715d.

peternied mentioned this pull request Mar 20, 2023

[BUG] There should be a seperate configuration option to enable restapi: permissions #2571

Closed

This was referenced Apr 1, 2023

[Security Review] Rest admin permissions #2632

Closed

Remove Rest admin permissions feature from 2.x branch #2633

Closed

willyborankin added a commit to willyborankin/security that referenced this pull request Apr 3, 2023

Revert "Rest admin permissions (opensearch-project#2411) (opensearch-…

b392df1

…project#2466)" This reverts commit 076715d.

willyborankin added a commit to willyborankin/security that referenced this pull request Apr 3, 2023

Revert "Rest admin permissions (opensearch-project#2411) (opensearch-…

6d001db

…project#2466)" This reverts commit 076715d.

willyborankin added a commit to willyborankin/security that referenced this pull request Apr 3, 2023

Revert "Rest admin permissions (opensearch-project#2411) (opensearch-…

bd17756

…project#2466)" This reverts commit 076715d. Signed-off-by: Andrey Pleskach <ples@aiven.io>

peternied pushed a commit that referenced this pull request Apr 4, 2023

Revert "Rest admin permissions (#2411) (#2466)" (#2636)

80961bd

This reverts commit 076715d. Signed-off-by: Andrey Pleskach <ples@aiven.io>

willyborankin mentioned this pull request Apr 21, 2023

[FEATURE] Support Security Config Updates on the REST API #2577

Closed

DarshitChanpura mentioned this pull request May 16, 2023

Adds the newly created admin api permissions to the static dropdown list opensearch-project/security-dashboards-plugin#1426

Merged

3 tasks

DarshitChanpura added the backport 2.8 Backport to 2.8 branch label May 30, 2023

DarshitChanpura mentioned this pull request May 30, 2023

[Backport 2.8] Rest admin permissions (#2411) #2807

Merged

3 tasks

DarshitChanpura mentioned this pull request Jun 6, 2023

[DOC] Add doc about new set of permissions introduced in security plugin opensearch-project/documentation-website#4256

Closed

4 tasks

This was referenced Aug 21, 2023

[BUG] Several actions cannot be delegated to users and must be run as an admin user #1878

Closed

[FEATURE] Improve admin permissions #2838

Closed

cwperks mentioned this pull request Apr 16, 2024

[BUG] Update role succeeds when the payload includes a restapi:admin/* permission and plugins.security.restapi.admin.enabled is set to false. #4258

Closed

Rest admin permissions #2411

Rest admin permissions #2411

Conversation

willyborankin commented Jan 20, 2023 • edited Loading

Description

Issues Resolved

Testing

Check List

peternied left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

peternied left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

willyborankin Jan 23, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

willyborankin Jan 23, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DarshitChanpura left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cwperks left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

peternied left a comment

Choose a reason for hiding this comment

cwperks commented Feb 9, 2023

DarshitChanpura left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

willyborankin commented Feb 10, 2023 • edited Loading

opensearch-trigger-bot bot commented Feb 21, 2023

cwperks commented Feb 21, 2023

willyborankin commented Feb 21, 2023

opensearch-trigger-bot bot commented May 30, 2023

willyborankin commented Jan 20, 2023 •

edited

Loading

willyborankin Jan 23, 2023 •

edited

Loading

willyborankin Jan 23, 2023 •

edited

Loading

cwperks left a comment •

edited

Loading

willyborankin commented Feb 10, 2023 •

edited

Loading