Skip to content

Commit 0e78691

Browse files
author
Hendrik Muhs
authored
[7.5][Transform] introduce new roles and deprecate old ones (#47780) (#47819)
deprecate data_frame_transforms_{user,admin} roles and introduce transform_{user,admin} roles as replacement
1 parent fbbe04b commit 0e78691

File tree

12 files changed

+217
-108
lines changed

12 files changed

+217
-108
lines changed

‎client/rest-high-level/src/main/java/org/elasticsearch/client/security/user/privileges/Role.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@
2424
import org.elasticsearch.common.Strings;
2525
import org.elasticsearch.common.collect.Tuple;
2626
import org.elasticsearch.common.xcontent.ConstructingObjectParser;
27-
import org.elasticsearch.common.xcontent.XContentParser;
2827
import org.elasticsearch.common.xcontent.ObjectParser.ValueType;
28+
import org.elasticsearch.common.xcontent.XContentParser;
2929

3030
import java.util.Arrays;
3131
import java.util.Collection;
@@ -299,12 +299,14 @@ public static class ClusterPrivilegeName {
299299
public static final String NONE = "none";
300300
public static final String ALL = "all";
301301
public static final String MONITOR = "monitor";
302-
public static final String MONITOR_DATA_FRAME_TRANSFORMS = "monitor_data_frame_transforms";
302+
public static final String MONITOR_TRANSFORM_DEPRECATED = "monitor_data_frame_transforms";
303+
public static final String MONITOR_TRANSFORM = "monitor_transform";
303304
public static final String MONITOR_ML = "monitor_ml";
304305
public static final String MONITOR_WATCHER = "monitor_watcher";
305306
public static final String MONITOR_ROLLUP = "monitor_rollup";
306307
public static final String MANAGE = "manage";
307-
public static final String MANAGE_DATA_FRAME_TRANSFORMS = "manage_data_frame_transforms";
308+
public static final String MANAGE_TRANSFORM_DEPRECATED = "manage_data_frame_transforms";
309+
public static final String MANAGE_TRANSFORM = "manage_transform";
308310
public static final String MANAGE_ML = "manage_ml";
309311
public static final String MANAGE_WATCHER = "manage_watcher";
310312
public static final String MANAGE_ROLLUP = "manage_rollup";
@@ -320,8 +322,8 @@ public static class ClusterPrivilegeName {
320322
public static final String READ_CCR = "read_ccr";
321323
public static final String MANAGE_ILM = "manage_ilm";
322324
public static final String READ_ILM = "read_ilm";
323-
public static final String[] ALL_ARRAY = new String[] { NONE, ALL, MONITOR, MONITOR_DATA_FRAME_TRANSFORMS, MONITOR_ML,
324-
MONITOR_WATCHER, MONITOR_ROLLUP, MANAGE, MANAGE_DATA_FRAME_TRANSFORMS,
325+
public static final String[] ALL_ARRAY = new String[] { NONE, ALL, MONITOR, MONITOR_TRANSFORM_DEPRECATED, MONITOR_TRANSFORM,
326+
MONITOR_ML, MONITOR_WATCHER, MONITOR_ROLLUP, MANAGE, MANAGE_TRANSFORM_DEPRECATED, MANAGE_TRANSFORM,
325327
MANAGE_ML, MANAGE_WATCHER, MANAGE_ROLLUP, MANAGE_INDEX_TEMPLATES, MANAGE_INGEST_PIPELINES, TRANSPORT_CLIENT,
326328
MANAGE_SECURITY, MANAGE_SAML, MANAGE_OIDC, MANAGE_TOKEN, MANAGE_PIPELINE, MANAGE_CCR, READ_CCR, MANAGE_ILM, READ_ILM};
327329
}

‎client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.elasticsearch.client.RequestOptions;
2929
import org.elasticsearch.client.RestHighLevelClient;
3030
import org.elasticsearch.client.security.AuthenticateResponse;
31+
import org.elasticsearch.client.security.AuthenticateResponse.RealmInfo;
3132
import org.elasticsearch.client.security.ChangePasswordRequest;
3233
import org.elasticsearch.client.security.ClearRealmCacheRequest;
3334
import org.elasticsearch.client.security.ClearRealmCacheResponse;
@@ -79,7 +80,6 @@
7980
import org.elasticsearch.client.security.PutUserResponse;
8081
import org.elasticsearch.client.security.RefreshPolicy;
8182
import org.elasticsearch.client.security.TemplateRoleName;
82-
import org.elasticsearch.client.security.AuthenticateResponse.RealmInfo;
8383
import org.elasticsearch.client.security.support.ApiKey;
8484
import org.elasticsearch.client.security.support.CertificateInfo;
8585
import org.elasticsearch.client.security.support.expressiondsl.RoleMapperExpression;
@@ -99,8 +99,6 @@
9999
import org.elasticsearch.common.util.set.Sets;
100100
import org.hamcrest.Matchers;
101101

102-
import javax.crypto.SecretKeyFactory;
103-
import javax.crypto.spec.PBEKeySpec;
104102
import java.io.IOException;
105103
import java.io.InputStream;
106104
import java.nio.file.Files;
@@ -120,6 +118,9 @@
120118
import java.util.concurrent.CountDownLatch;
121119
import java.util.concurrent.TimeUnit;
122120

121+
import javax.crypto.SecretKeyFactory;
122+
import javax.crypto.spec.PBEKeySpec;
123+
123124
import static org.hamcrest.Matchers.contains;
124125
import static org.hamcrest.Matchers.containsInAnyOrder;
125126
import static org.hamcrest.Matchers.containsString;
@@ -679,8 +680,8 @@ public void testGetRoles() throws Exception {
679680

680681
List<Role> roles = response.getRoles();
681682
assertNotNull(response);
682-
// 27 system roles plus the three we created
683-
assertThat(roles.size(), equalTo(30));
683+
// 29 system roles plus the three we created
684+
assertThat(roles.size(), equalTo(32));
684685
}
685686

686687
{

‎x-pack/docs/en/rest-api/security/get-builtin-privileges.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,13 @@ A successful call returns an object with "cluster" and "index" fields.
8080
"manage_security",
8181
"manage_slm",
8282
"manage_token",
83+
"manage_transform",
8384
"manage_watcher",
8485
"monitor",
8586
"monitor_data_frame_transforms",
8687
"monitor_ml",
8788
"monitor_rollup",
89+
"monitor_transform",
8890
"monitor_watcher",
8991
"none",
9092
"read_ccr",

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public class ClusterPrivilegeResolver {
5050
private static final Set<String> MANAGE_TOKEN_PATTERN = Collections.singleton("cluster:admin/xpack/security/token/*");
5151
private static final Set<String> MANAGE_API_KEY_PATTERN = Collections.singleton("cluster:admin/xpack/security/api_key/*");
5252
private static final Set<String> MONITOR_PATTERN = Collections.singleton("cluster:monitor/*");
53-
private static final Set<String> MONITOR_DATA_FRAME_PATTERN = Collections.unmodifiableSet(
53+
private static final Set<String> MONITOR_TRANSFORM_PATTERN = Collections.unmodifiableSet(
5454
Sets.newHashSet("cluster:monitor/data_frame/*", "cluster:monitor/transform/*"));
5555
private static final Set<String> MONITOR_ML_PATTERN = Collections.singleton("cluster:monitor/xpack/ml/*");
5656
private static final Set<String> MONITOR_WATCHER_PATTERN = Collections.singleton("cluster:monitor/xpack/watcher/*");
@@ -59,7 +59,7 @@ public class ClusterPrivilegeResolver {
5959
Sets.newHashSet("cluster:*", "indices:admin/template/*"));
6060
private static final Set<String> MANAGE_ML_PATTERN = Collections.unmodifiableSet(
6161
Sets.newHashSet("cluster:admin/xpack/ml/*", "cluster:monitor/xpack/ml/*"));
62-
private static final Set<String> MANAGE_DATA_FRAME_PATTERN = Collections.unmodifiableSet(
62+
private static final Set<String> MANAGE_TRANSFORM_PATTERN = Collections.unmodifiableSet(
6363
Sets.newHashSet("cluster:admin/data_frame/*", "cluster:monitor/data_frame/*",
6464
"cluster:monitor/transform/*", "cluster:admin/transform/*"));
6565
private static final Set<String> MANAGE_WATCHER_PATTERN = Collections.unmodifiableSet(
@@ -89,14 +89,18 @@ public class ClusterPrivilegeResolver {
8989
public static final NamedClusterPrivilege ALL = new ActionClusterPrivilege("all", ALL_CLUSTER_PATTERN);
9090
public static final NamedClusterPrivilege MONITOR = new ActionClusterPrivilege("monitor", MONITOR_PATTERN);
9191
public static final NamedClusterPrivilege MONITOR_ML = new ActionClusterPrivilege("monitor_ml", MONITOR_ML_PATTERN);
92-
public static final NamedClusterPrivilege MONITOR_DATA_FRAME =
93-
new ActionClusterPrivilege("monitor_data_frame_transforms", MONITOR_DATA_FRAME_PATTERN);
92+
public static final NamedClusterPrivilege MONITOR_TRANSFORM_DEPRECATED =
93+
new ActionClusterPrivilege("monitor_data_frame_transforms", MONITOR_TRANSFORM_PATTERN);
94+
public static final NamedClusterPrivilege MONITOR_TRANSFORM =
95+
new ActionClusterPrivilege("monitor_transform", MONITOR_TRANSFORM_PATTERN);
9496
public static final NamedClusterPrivilege MONITOR_WATCHER = new ActionClusterPrivilege("monitor_watcher", MONITOR_WATCHER_PATTERN);
9597
public static final NamedClusterPrivilege MONITOR_ROLLUP = new ActionClusterPrivilege("monitor_rollup", MONITOR_ROLLUP_PATTERN);
9698
public static final NamedClusterPrivilege MANAGE = new ActionClusterPrivilege("manage", ALL_CLUSTER_PATTERN, ALL_SECURITY_PATTERN);
9799
public static final NamedClusterPrivilege MANAGE_ML = new ActionClusterPrivilege("manage_ml", MANAGE_ML_PATTERN);
98-
public static final NamedClusterPrivilege MANAGE_DATA_FRAME =
99-
new ActionClusterPrivilege("manage_data_frame_transforms", MANAGE_DATA_FRAME_PATTERN);
100+
public static final NamedClusterPrivilege MANAGE_TRANSFORM_DEPRECATED =
101+
new ActionClusterPrivilege("manage_data_frame_transforms", MANAGE_TRANSFORM_PATTERN);
102+
public static final NamedClusterPrivilege MANAGE_TRANSFORM =
103+
new ActionClusterPrivilege("manage_transform", MANAGE_TRANSFORM_PATTERN);
100104
public static final NamedClusterPrivilege MANAGE_TOKEN = new ActionClusterPrivilege("manage_token", MANAGE_TOKEN_PATTERN);
101105
public static final NamedClusterPrivilege MANAGE_WATCHER = new ActionClusterPrivilege("manage_watcher", MANAGE_WATCHER_PATTERN);
102106
public static final NamedClusterPrivilege MANAGE_ROLLUP = new ActionClusterPrivilege("manage_rollup", MANAGE_ROLLUP_PATTERN);
@@ -131,12 +135,14 @@ public class ClusterPrivilegeResolver {
131135
ALL,
132136
MONITOR,
133137
MONITOR_ML,
134-
MONITOR_DATA_FRAME,
138+
MONITOR_TRANSFORM_DEPRECATED,
139+
MONITOR_TRANSFORM,
135140
MONITOR_WATCHER,
136141
MONITOR_ROLLUP,
137142
MANAGE,
138143
MANAGE_ML,
139-
MANAGE_DATA_FRAME,
144+
MANAGE_TRANSFORM_DEPRECATED,
145+
MANAGE_TRANSFORM,
140146
MANAGE_TOKEN,
141147
MANAGE_WATCHER,
142148
MANAGE_IDX_TEMPLATES,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import org.elasticsearch.xpack.core.security.support.MetadataUtils;
1818
import org.elasticsearch.xpack.core.security.user.KibanaUser;
1919
import org.elasticsearch.xpack.core.security.user.UsernamesField;
20+
import org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants;
2021
import org.elasticsearch.xpack.core.watcher.execution.TriggeredWatchStoreField;
2122
import org.elasticsearch.xpack.core.watcher.history.HistoryStoreField;
2223
import org.elasticsearch.xpack.core.watcher.watch.Watch;
@@ -179,28 +180,52 @@ private static Map<String, RoleDescriptor> initializeReservedRoles() {
179180
.application("kibana-*").resources("*").privileges("reserved_ml").build()
180181
},
181182
null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
183+
// DEPRECATED: to be removed in 9.0.0
182184
.put("data_frame_transforms_admin", new RoleDescriptor("data_frame_transforms_admin",
183185
new String[] { "manage_data_frame_transforms" },
184186
new RoleDescriptor.IndicesPrivileges[]{
185187
RoleDescriptor.IndicesPrivileges.builder()
186-
.indices(".data-frame-notifications*")
188+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
189+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
190+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
187191
.privileges("view_index_metadata", "read").build()
188192
},
189193
new RoleDescriptor.ApplicationResourcePrivileges[] {
190194
RoleDescriptor.ApplicationResourcePrivileges.builder()
191195
.application("kibana-*").resources("*").privileges("reserved_ml").build()
192196
}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
197+
// DEPRECATED: to be removed in 9.0.0
193198
.put("data_frame_transforms_user", new RoleDescriptor("data_frame_transforms_user",
194199
new String[] { "monitor_data_frame_transforms" },
195200
new RoleDescriptor.IndicesPrivileges[]{
196201
RoleDescriptor.IndicesPrivileges.builder()
197-
.indices(".data-frame-notifications*")
202+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
203+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
204+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
198205
.privileges("view_index_metadata", "read").build()
199206
},
200207
new RoleDescriptor.ApplicationResourcePrivileges[] {
201208
RoleDescriptor.ApplicationResourcePrivileges.builder()
202209
.application("kibana-*").resources("*").privileges("reserved_ml").build()
203210
}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
211+
.put("transform_admin", new RoleDescriptor("transform_admin",
212+
new String[] { "manage_transform" },
213+
new RoleDescriptor.IndicesPrivileges[]{
214+
RoleDescriptor.IndicesPrivileges.builder()
215+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
216+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
217+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
218+
.privileges("view_index_metadata", "read").build()
219+
}, null, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
220+
.put("transform_user", new RoleDescriptor("transform_user",
221+
new String[] { "monitor_transform" },
222+
new RoleDescriptor.IndicesPrivileges[]{
223+
RoleDescriptor.IndicesPrivileges.builder()
224+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
225+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
226+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
227+
.privileges("view_index_metadata", "read").build()
228+
}, null, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
204229
.put("watcher_admin", new RoleDescriptor("watcher_admin", new String[] { "manage_watcher" },
205230
new RoleDescriptor.IndicesPrivileges[] {
206231
RoleDescriptor.IndicesPrivileges.builder().indices(Watch.INDEX, TriggeredWatchStoreField.INDEX_NAME,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/persistence/TransformInternalIndexConstants.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ public final class TransformInternalIndexConstants {
3030

3131
// audit index
3232
public static final String AUDIT_TEMPLATE_VERSION = "1";
33-
public static final String AUDIT_INDEX_PREFIX = ".data-frame-notifications-";
33+
public static final String AUDIT_INDEX_PREFIX = ".transform-notifications-";
34+
public static final String AUDIT_INDEX_PATTERN = AUDIT_INDEX_PREFIX + "*";
35+
public static final String AUDIT_INDEX_PATTERN_DEPRECATED = ".data-frame-notifications-*";
36+
37+
public static final String AUDIT_INDEX_READ_ALIAS = ".transform-notifications-read";
3438
public static final String AUDIT_INDEX = AUDIT_INDEX_PREFIX + AUDIT_TEMPLATE_VERSION;
3539

3640
private TransformInternalIndexConstants() {

0 commit comments

Comments
 (0)