Skip to content

Commit d680ca3

Browse files
author
Hendrik Muhs
authored
[Transform] introduce new roles and deprecate old ones (#47780)
deprecate data_frame_transforms_{user,admin} roles and introduce transform_{user,admin} roles as replacement
1 parent ab08c0c commit d680ca3

File tree

12 files changed

+213
-103
lines changed

12 files changed

+213
-103
lines changed

‎client/rest-high-level/src/main/java/org/elasticsearch/client/security/user/privileges/Role.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@
2424
import org.elasticsearch.common.Strings;
2525
import org.elasticsearch.common.collect.Tuple;
2626
import org.elasticsearch.common.xcontent.ConstructingObjectParser;
27-
import org.elasticsearch.common.xcontent.XContentParser;
2827
import org.elasticsearch.common.xcontent.ObjectParser.ValueType;
28+
import org.elasticsearch.common.xcontent.XContentParser;
2929

3030
import java.util.Arrays;
3131
import java.util.Collection;
@@ -299,12 +299,14 @@ public static class ClusterPrivilegeName {
299299
public static final String NONE = "none";
300300
public static final String ALL = "all";
301301
public static final String MONITOR = "monitor";
302-
public static final String MONITOR_DATA_FRAME_TRANSFORMS = "monitor_data_frame_transforms";
302+
public static final String MONITOR_TRANSFORM_DEPRECATED = "monitor_data_frame_transforms";
303+
public static final String MONITOR_TRANSFORM = "monitor_transform";
303304
public static final String MONITOR_ML = "monitor_ml";
304305
public static final String MONITOR_WATCHER = "monitor_watcher";
305306
public static final String MONITOR_ROLLUP = "monitor_rollup";
306307
public static final String MANAGE = "manage";
307-
public static final String MANAGE_DATA_FRAME_TRANSFORMS = "manage_data_frame_transforms";
308+
public static final String MANAGE_TRANSFORM_DEPRECATED = "manage_data_frame_transforms";
309+
public static final String MANAGE_TRANSFORM = "manage_transform";
308310
public static final String MANAGE_ML = "manage_ml";
309311
public static final String MANAGE_WATCHER = "manage_watcher";
310312
public static final String MANAGE_ROLLUP = "manage_rollup";
@@ -320,8 +322,8 @@ public static class ClusterPrivilegeName {
320322
public static final String READ_CCR = "read_ccr";
321323
public static final String MANAGE_ILM = "manage_ilm";
322324
public static final String READ_ILM = "read_ilm";
323-
public static final String[] ALL_ARRAY = new String[] { NONE, ALL, MONITOR, MONITOR_DATA_FRAME_TRANSFORMS, MONITOR_ML,
324-
MONITOR_WATCHER, MONITOR_ROLLUP, MANAGE, MANAGE_DATA_FRAME_TRANSFORMS,
325+
public static final String[] ALL_ARRAY = new String[] { NONE, ALL, MONITOR, MONITOR_TRANSFORM_DEPRECATED, MONITOR_TRANSFORM,
326+
MONITOR_ML, MONITOR_WATCHER, MONITOR_ROLLUP, MANAGE, MANAGE_TRANSFORM_DEPRECATED, MANAGE_TRANSFORM,
325327
MANAGE_ML, MANAGE_WATCHER, MANAGE_ROLLUP, MANAGE_INDEX_TEMPLATES, MANAGE_INGEST_PIPELINES, TRANSPORT_CLIENT,
326328
MANAGE_SECURITY, MANAGE_SAML, MANAGE_OIDC, MANAGE_TOKEN, MANAGE_PIPELINE, MANAGE_CCR, READ_CCR, MANAGE_ILM, READ_ILM};
327329
}

‎client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.elasticsearch.client.RequestOptions;
2929
import org.elasticsearch.client.RestHighLevelClient;
3030
import org.elasticsearch.client.security.AuthenticateResponse;
31+
import org.elasticsearch.client.security.AuthenticateResponse.RealmInfo;
3132
import org.elasticsearch.client.security.ChangePasswordRequest;
3233
import org.elasticsearch.client.security.ClearRealmCacheRequest;
3334
import org.elasticsearch.client.security.ClearRealmCacheResponse;
@@ -79,7 +80,6 @@
7980
import org.elasticsearch.client.security.PutUserResponse;
8081
import org.elasticsearch.client.security.RefreshPolicy;
8182
import org.elasticsearch.client.security.TemplateRoleName;
82-
import org.elasticsearch.client.security.AuthenticateResponse.RealmInfo;
8383
import org.elasticsearch.client.security.support.ApiKey;
8484
import org.elasticsearch.client.security.support.CertificateInfo;
8585
import org.elasticsearch.client.security.support.expressiondsl.RoleMapperExpression;
@@ -99,8 +99,6 @@
9999
import org.elasticsearch.common.util.set.Sets;
100100
import org.hamcrest.Matchers;
101101

102-
import javax.crypto.SecretKeyFactory;
103-
import javax.crypto.spec.PBEKeySpec;
104102
import java.io.IOException;
105103
import java.io.InputStream;
106104
import java.nio.file.Files;
@@ -121,6 +119,9 @@
121119
import java.util.concurrent.CountDownLatch;
122120
import java.util.concurrent.TimeUnit;
123121

122+
import javax.crypto.SecretKeyFactory;
123+
import javax.crypto.spec.PBEKeySpec;
124+
124125
import static org.hamcrest.Matchers.contains;
125126
import static org.hamcrest.Matchers.containsInAnyOrder;
126127
import static org.hamcrest.Matchers.containsString;
@@ -681,8 +682,8 @@ public void testGetRoles() throws Exception {
681682

682683
List<Role> roles = response.getRoles();
683684
assertNotNull(response);
684-
// 27 system roles plus the three we created
685-
assertThat(roles.size(), equalTo(30));
685+
// 29 system roles plus the three we created
686+
assertThat(roles.size(), equalTo(32));
686687
}
687688

688689
{

‎x-pack/docs/en/rest-api/security/get-builtin-privileges.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,13 @@ A successful call returns an object with "cluster" and "index" fields.
8080
"manage_security",
8181
"manage_slm",
8282
"manage_token",
83+
"manage_transform",
8384
"manage_watcher",
8485
"monitor",
8586
"monitor_data_frame_transforms",
8687
"monitor_ml",
8788
"monitor_rollup",
89+
"monitor_transform",
8890
"monitor_watcher",
8991
"none",
9092
"read_ccr",

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,12 @@ public class ClusterPrivilegeResolver {
5050
private static final Set<String> MANAGE_API_KEY_PATTERN = Set.of("cluster:admin/xpack/security/api_key/*");
5151
private static final Set<String> MONITOR_PATTERN = Set.of("cluster:monitor/*");
5252
private static final Set<String> MONITOR_ML_PATTERN = Set.of("cluster:monitor/xpack/ml/*");
53-
private static final Set<String> MONITOR_DATA_FRAME_PATTERN = Set.of("cluster:monitor/data_frame/*", "cluster:monitor/transform/*");
53+
private static final Set<String> MONITOR_TRANSFORM_PATTERN = Set.of("cluster:monitor/data_frame/*", "cluster:monitor/transform/*");
5454
private static final Set<String> MONITOR_WATCHER_PATTERN = Set.of("cluster:monitor/xpack/watcher/*");
5555
private static final Set<String> MONITOR_ROLLUP_PATTERN = Set.of("cluster:monitor/xpack/rollup/*");
5656
private static final Set<String> ALL_CLUSTER_PATTERN = Set.of("cluster:*", "indices:admin/template/*");
5757
private static final Set<String> MANAGE_ML_PATTERN = Set.of("cluster:admin/xpack/ml/*", "cluster:monitor/xpack/ml/*");
58-
private static final Set<String> MANAGE_DATA_FRAME_PATTERN = Set.of("cluster:admin/data_frame/*", "cluster:monitor/data_frame/*",
58+
private static final Set<String> MANAGE_TRANSFORM_PATTERN = Set.of("cluster:admin/data_frame/*", "cluster:monitor/data_frame/*",
5959
"cluster:monitor/transform/*", "cluster:admin/transform/*");
6060
private static final Set<String> MANAGE_WATCHER_PATTERN = Set.of("cluster:admin/xpack/watcher/*", "cluster:monitor/xpack/watcher/*");
6161
private static final Set<String> TRANSPORT_CLIENT_PATTERN = Set.of("cluster:monitor/nodes/liveness", "cluster:monitor/state");
@@ -77,14 +77,18 @@ public class ClusterPrivilegeResolver {
7777
public static final NamedClusterPrivilege ALL = new ActionClusterPrivilege("all", ALL_CLUSTER_PATTERN);
7878
public static final NamedClusterPrivilege MONITOR = new ActionClusterPrivilege("monitor", MONITOR_PATTERN);
7979
public static final NamedClusterPrivilege MONITOR_ML = new ActionClusterPrivilege("monitor_ml", MONITOR_ML_PATTERN);
80-
public static final NamedClusterPrivilege MONITOR_DATA_FRAME =
81-
new ActionClusterPrivilege("monitor_data_frame_transforms", MONITOR_DATA_FRAME_PATTERN);
80+
public static final NamedClusterPrivilege MONITOR_TRANSFORM_DEPRECATED =
81+
new ActionClusterPrivilege("monitor_data_frame_transforms", MONITOR_TRANSFORM_PATTERN);
82+
public static final NamedClusterPrivilege MONITOR_TRANSFORM =
83+
new ActionClusterPrivilege("monitor_transform", MONITOR_TRANSFORM_PATTERN);
8284
public static final NamedClusterPrivilege MONITOR_WATCHER = new ActionClusterPrivilege("monitor_watcher", MONITOR_WATCHER_PATTERN);
8385
public static final NamedClusterPrivilege MONITOR_ROLLUP = new ActionClusterPrivilege("monitor_rollup", MONITOR_ROLLUP_PATTERN);
8486
public static final NamedClusterPrivilege MANAGE = new ActionClusterPrivilege("manage", ALL_CLUSTER_PATTERN, ALL_SECURITY_PATTERN);
8587
public static final NamedClusterPrivilege MANAGE_ML = new ActionClusterPrivilege("manage_ml", MANAGE_ML_PATTERN);
86-
public static final NamedClusterPrivilege MANAGE_DATA_FRAME =
87-
new ActionClusterPrivilege("manage_data_frame_transforms", MANAGE_DATA_FRAME_PATTERN);
88+
public static final NamedClusterPrivilege MANAGE_TRANSFORM_DEPRECATED =
89+
new ActionClusterPrivilege("manage_data_frame_transforms", MANAGE_TRANSFORM_PATTERN);
90+
public static final NamedClusterPrivilege MANAGE_TRANSFORM =
91+
new ActionClusterPrivilege("manage_transform", MANAGE_TRANSFORM_PATTERN);
8892
public static final NamedClusterPrivilege MANAGE_TOKEN = new ActionClusterPrivilege("manage_token", MANAGE_TOKEN_PATTERN);
8993
public static final NamedClusterPrivilege MANAGE_WATCHER = new ActionClusterPrivilege("manage_watcher", MANAGE_WATCHER_PATTERN);
9094
public static final NamedClusterPrivilege MANAGE_ROLLUP = new ActionClusterPrivilege("manage_rollup", MANAGE_ROLLUP_PATTERN);
@@ -118,12 +122,14 @@ public class ClusterPrivilegeResolver {
118122
ALL,
119123
MONITOR,
120124
MONITOR_ML,
121-
MONITOR_DATA_FRAME,
125+
MONITOR_TRANSFORM_DEPRECATED,
126+
MONITOR_TRANSFORM,
122127
MONITOR_WATCHER,
123128
MONITOR_ROLLUP,
124129
MANAGE,
125130
MANAGE_ML,
126-
MANAGE_DATA_FRAME,
131+
MANAGE_TRANSFORM_DEPRECATED,
132+
MANAGE_TRANSFORM,
127133
MANAGE_TOKEN,
128134
MANAGE_WATCHER,
129135
MANAGE_IDX_TEMPLATES,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import org.elasticsearch.xpack.core.security.support.MetadataUtils;
1818
import org.elasticsearch.xpack.core.security.user.KibanaUser;
1919
import org.elasticsearch.xpack.core.security.user.UsernamesField;
20+
import org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants;
2021
import org.elasticsearch.xpack.core.watcher.execution.TriggeredWatchStoreField;
2122
import org.elasticsearch.xpack.core.watcher.history.HistoryStoreField;
2223
import org.elasticsearch.xpack.core.watcher.watch.Watch;
@@ -179,28 +180,52 @@ private static Map<String, RoleDescriptor> initializeReservedRoles() {
179180
.application("kibana-*").resources("*").privileges("reserved_ml").build()
180181
},
181182
null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
183+
// DEPRECATED: to be removed in 9.0.0
182184
.put("data_frame_transforms_admin", new RoleDescriptor("data_frame_transforms_admin",
183185
new String[] { "manage_data_frame_transforms" },
184186
new RoleDescriptor.IndicesPrivileges[]{
185187
RoleDescriptor.IndicesPrivileges.builder()
186-
.indices(".data-frame-notifications*")
188+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
189+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
190+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
187191
.privileges("view_index_metadata", "read").build()
188192
},
189193
new RoleDescriptor.ApplicationResourcePrivileges[] {
190194
RoleDescriptor.ApplicationResourcePrivileges.builder()
191195
.application("kibana-*").resources("*").privileges("reserved_ml").build()
192196
}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
197+
// DEPRECATED: to be removed in 9.0.0
193198
.put("data_frame_transforms_user", new RoleDescriptor("data_frame_transforms_user",
194199
new String[] { "monitor_data_frame_transforms" },
195200
new RoleDescriptor.IndicesPrivileges[]{
196201
RoleDescriptor.IndicesPrivileges.builder()
197-
.indices(".data-frame-notifications*")
202+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
203+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
204+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
198205
.privileges("view_index_metadata", "read").build()
199206
},
200207
new RoleDescriptor.ApplicationResourcePrivileges[] {
201208
RoleDescriptor.ApplicationResourcePrivileges.builder()
202209
.application("kibana-*").resources("*").privileges("reserved_ml").build()
203210
}, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
211+
.put("transform_admin", new RoleDescriptor("transform_admin",
212+
new String[] { "manage_transform" },
213+
new RoleDescriptor.IndicesPrivileges[]{
214+
RoleDescriptor.IndicesPrivileges.builder()
215+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
216+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
217+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
218+
.privileges("view_index_metadata", "read").build()
219+
}, null, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
220+
.put("transform_user", new RoleDescriptor("transform_user",
221+
new String[] { "monitor_transform" },
222+
new RoleDescriptor.IndicesPrivileges[]{
223+
RoleDescriptor.IndicesPrivileges.builder()
224+
.indices(TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
225+
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
226+
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS)
227+
.privileges("view_index_metadata", "read").build()
228+
}, null, null, null, MetadataUtils.DEFAULT_RESERVED_METADATA, null))
204229
.put("watcher_admin", new RoleDescriptor("watcher_admin", new String[] { "manage_watcher" },
205230
new RoleDescriptor.IndicesPrivileges[] {
206231
RoleDescriptor.IndicesPrivileges.builder().indices(Watch.INDEX, TriggeredWatchStoreField.INDEX_NAME,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/persistence/TransformInternalIndexConstants.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ public final class TransformInternalIndexConstants {
3030

3131
// audit index
3232
public static final String AUDIT_TEMPLATE_VERSION = "1";
33-
public static final String AUDIT_INDEX_PREFIX = ".data-frame-notifications-";
33+
public static final String AUDIT_INDEX_PREFIX = ".transform-notifications-";
34+
public static final String AUDIT_INDEX_PATTERN = AUDIT_INDEX_PREFIX + "*";
35+
public static final String AUDIT_INDEX_PATTERN_DEPRECATED = ".data-frame-notifications-*";
36+
37+
public static final String AUDIT_INDEX_READ_ALIAS = ".transform-notifications-read";
3438
public static final String AUDIT_INDEX = AUDIT_INDEX_PREFIX + AUDIT_TEMPLATE_VERSION;
3539

3640
private TransformInternalIndexConstants() {

0 commit comments

Comments
 (0)