Skip to content

Commit 0b8ae36

Browse files
nchauletnchaulet
authored
[Fleet] Use Kibana Authz for API authorization (#205335)
1 parent 2fc2019 commit 0b8ae36

File tree

26 files changed

+1025
-383
lines changed

26 files changed

+1025
-383
lines changed

‎oas_docs/bundle.json‎

Lines changed: 93 additions & 31 deletions
Large diffs are not rendered by default.

‎oas_docs/bundle.serverless.json‎

Lines changed: 93 additions & 31 deletions
Large diffs are not rendered by default.

‎oas_docs/output/kibana.serverless.yaml‎

Lines changed: 93 additions & 31 deletions
Large diffs are not rendered by default.

‎oas_docs/output/kibana.yaml‎

Lines changed: 93 additions & 31 deletions
Large diffs are not rendered by default.

‎x-pack/platform/plugins/shared/fleet/server/constants/api_privileges.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
import { INTEGRATIONS_PLUGIN_ID, PLUGIN_ID } from '../../common';
9+
10+
export const FLEET_API_PRIVILEGES = {
11+
FLEET: {
12+
READ: `${PLUGIN_ID}-read`,
13+
ALL: `${PLUGIN_ID}-all`,
14+
},
15+
AGENTS: {
16+
READ: `${PLUGIN_ID}-agents-read`,
17+
ALL: `${PLUGIN_ID}-agents-all`,
18+
},
19+
AGENT_POLICIES: {
20+
READ: `${PLUGIN_ID}-agent-policies-read`,
21+
ALL: `${PLUGIN_ID}-agent-policies-all`,
22+
},
23+
SETTINGS: {
24+
READ: `${PLUGIN_ID}-settings-read`,
25+
ALL: `${PLUGIN_ID}-settings-all`,
26+
},
27+
INTEGRATIONS: {
28+
READ: `${INTEGRATIONS_PLUGIN_ID}-read`,
29+
ALL: `${INTEGRATIONS_PLUGIN_ID}-all`,
30+
},
31+
SETUP: `fleet-setup`,
32+
};

‎x-pack/platform/plugins/shared/fleet/server/routes/agent/index.ts‎

Lines changed: 98 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ import {
5555
PostNewAgentActionResponseSchema,
5656
PostRetrieveAgentsByActionsResponseSchema,
5757
} from '../../types/rest_spec/agent';
58-
58+
import { FLEET_API_PRIVILEGES } from '../../constants/api_privileges';
5959
import { calculateRouteAuthz } from '../../services/security/security';
6060

6161
import { genericErrorResponse } from '../schema/errors';
@@ -95,8 +95,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
9595
router.versioned
9696
.get({
9797
path: AGENT_API_ROUTES.INFO_PATTERN,
98-
fleetAuthz: {
99-
fleet: { readAgents: true },
98+
security: {
99+
authz: {
100+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
101+
},
100102
},
101103
summary: `Get an agent`,
102104
description: `Get an agent by ID.`,
@@ -126,8 +128,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
126128
router.versioned
127129
.put({
128130
path: AGENT_API_ROUTES.UPDATE_PATTERN,
129-
fleetAuthz: {
130-
fleet: { allAgents: true },
131+
security: {
132+
authz: {
133+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
134+
},
131135
},
132136
summary: `Update an agent`,
133137
description: `Update an agent by ID.`,
@@ -157,8 +161,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
157161
router.versioned
158162
.post({
159163
path: AGENT_API_ROUTES.BULK_UPDATE_AGENT_TAGS_PATTERN,
160-
fleetAuthz: {
161-
fleet: { allAgents: true },
164+
security: {
165+
authz: {
166+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
167+
},
162168
},
163169
summary: `Bulk update agent tags`,
164170
options: {
@@ -187,8 +193,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
187193
router.versioned
188194
.delete({
189195
path: AGENT_API_ROUTES.DELETE_PATTERN,
190-
fleetAuthz: {
191-
fleet: { allAgents: true },
196+
security: {
197+
authz: {
198+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
199+
},
192200
},
193201
summary: `Delete an agent`,
194202
description: `Delete an agent by ID.`,
@@ -218,9 +226,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
218226
router.versioned
219227
.get({
220228
path: AGENT_API_ROUTES.LIST_PATTERN,
221-
222-
fleetAuthz: {
223-
fleet: { readAgents: true },
229+
security: {
230+
authz: {
231+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
232+
},
224233
},
225234
summary: `Get agents`,
226235
options: {
@@ -249,8 +258,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
249258
router.versioned
250259
.get({
251260
path: AGENT_API_ROUTES.LIST_TAGS_PATTERN,
252-
fleetAuthz: {
253-
fleet: { readAgents: true },
261+
security: {
262+
authz: {
263+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
264+
},
254265
},
255266
summary: `Get agent tags`,
256267
options: {
@@ -279,8 +290,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
279290
router.versioned
280291
.post({
281292
path: AGENT_API_ROUTES.ACTIONS_PATTERN,
282-
fleetAuthz: {
283-
fleet: { allAgents: true },
293+
security: {
294+
authz: {
295+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
296+
},
284297
},
285298
summary: `Create an agent action`,
286299
options: {
@@ -313,8 +326,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
313326
router.versioned
314327
.post({
315328
path: AGENT_API_ROUTES.CANCEL_ACTIONS_PATTERN,
316-
fleetAuthz: {
317-
fleet: { allAgents: true },
329+
security: {
330+
authz: {
331+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
332+
},
318333
},
319334
summary: `Cancel an agent action`,
320335
options: {
@@ -348,8 +363,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
348363
router.versioned
349364
.post({
350365
path: AGENT_API_ROUTES.LIST_PATTERN,
351-
fleetAuthz: {
352-
fleet: { readAgents: true },
366+
security: {
367+
authz: {
368+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
369+
},
353370
},
354371
summary: `Get agents by action ids`,
355372
options: {
@@ -377,8 +394,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
377394
router.versioned
378395
.post({
379396
path: AGENT_API_ROUTES.UNENROLL_PATTERN,
380-
fleetAuthz: {
381-
fleet: { allAgents: true },
397+
security: {
398+
authz: {
399+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
400+
},
382401
},
383402
summary: `Unenroll an agent`,
384403
options: {
@@ -396,8 +415,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
396415
router.versioned
397416
.post({
398417
path: AGENT_API_ROUTES.REASSIGN_PATTERN,
399-
fleetAuthz: {
400-
fleet: { allAgents: true },
418+
security: {
419+
authz: {
420+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
421+
},
401422
},
402423
summary: `Reassign an agent`,
403424
options: {
@@ -425,8 +446,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
425446
router.versioned
426447
.post({
427448
path: AGENT_API_ROUTES.REQUEST_DIAGNOSTICS_PATTERN,
428-
fleetAuthz: {
429-
fleet: { readAgents: true },
449+
security: {
450+
authz: {
451+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
452+
},
430453
},
431454
summary: `Request agent diagnostics`,
432455
options: {
@@ -454,8 +477,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
454477
router.versioned
455478
.post({
456479
path: AGENT_API_ROUTES.BULK_REQUEST_DIAGNOSTICS_PATTERN,
457-
fleetAuthz: {
458-
fleet: { readAgents: true },
480+
security: {
481+
authz: {
482+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
483+
},
459484
},
460485
summary: `Bulk request diagnostics from agents`,
461486
options: {
@@ -483,8 +508,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
483508
router.versioned
484509
.get({
485510
path: AGENT_API_ROUTES.LIST_UPLOADS_PATTERN,
486-
fleetAuthz: {
487-
fleet: { readAgents: true },
511+
security: {
512+
authz: {
513+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
514+
},
488515
},
489516
summary: `Get agent uploads`,
490517
options: {
@@ -512,8 +539,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
512539
router.versioned
513540
.get({
514541
path: AGENT_API_ROUTES.GET_UPLOAD_FILE_PATTERN,
515-
fleetAuthz: {
516-
fleet: { readAgents: true },
542+
security: {
543+
authz: {
544+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
545+
},
517546
},
518547
summary: `Get an uploaded file`,
519548
description: `Get a file uploaded by an agent.`,
@@ -542,8 +571,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
542571
router.versioned
543572
.delete({
544573
path: AGENT_API_ROUTES.DELETE_UPLOAD_FILE_PATTERN,
545-
fleetAuthz: {
546-
fleet: { allAgents: true },
574+
security: {
575+
authz: {
576+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
577+
},
547578
},
548579
summary: `Delete an uploaded file`,
549580
description: `Delete a file uploaded by an agent.`,
@@ -568,11 +599,11 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
568599
},
569600
deleteAgentUploadFileHandler
570601
);
571-
572602
// Get agent status for policy
573603
router.versioned
574604
.get({
575605
path: AGENT_API_ROUTES.STATUS_PATTERN,
606+
// TODO move to kibana authz https://github.com/elastic/kibana/issues/203170
576607
fleetAuthz: (fleetAuthz: FleetAuthz): boolean =>
577608
calculateRouteAuthz(
578609
fleetAuthz,
@@ -604,8 +635,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
604635
router.versioned
605636
.get({
606637
path: AGENT_API_ROUTES.DATA_PATTERN,
607-
fleetAuthz: {
608-
fleet: { readAgents: true },
638+
security: {
639+
authz: {
640+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
641+
},
609642
},
610643
summary: `Get incoming agent data`,
611644
options: {
@@ -634,8 +667,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
634667
router.versioned
635668
.post({
636669
path: AGENT_API_ROUTES.UPGRADE_PATTERN,
637-
fleetAuthz: {
638-
fleet: { allAgents: true },
670+
security: {
671+
authz: {
672+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
673+
},
639674
},
640675
summary: `Upgrade an agent`,
641676
options: {
@@ -663,8 +698,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
663698
router.versioned
664699
.post({
665700
path: AGENT_API_ROUTES.BULK_UPGRADE_PATTERN,
666-
fleetAuthz: {
667-
fleet: { allAgents: true },
701+
security: {
702+
authz: {
703+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
704+
},
668705
},
669706
summary: `Bulk upgrade agents`,
670707
options: {
@@ -693,8 +730,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
693730
router.versioned
694731
.get({
695732
path: AGENT_API_ROUTES.ACTION_STATUS_PATTERN,
696-
fleetAuthz: {
697-
fleet: { readAgents: true },
733+
security: {
734+
authz: {
735+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
736+
},
698737
},
699738
summary: `Get an agent action status`,
700739
options: {
@@ -723,8 +762,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
723762
router.versioned
724763
.post({
725764
path: AGENT_API_ROUTES.BULK_REASSIGN_PATTERN,
726-
fleetAuthz: {
727-
fleet: { allAgents: true },
765+
security: {
766+
authz: {
767+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
768+
},
728769
},
729770
summary: `Bulk reassign agents`,
730771
options: {
@@ -753,8 +794,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
753794
router.versioned
754795
.post({
755796
path: AGENT_API_ROUTES.BULK_UNENROLL_PATTERN,
756-
fleetAuthz: {
757-
fleet: { allAgents: true },
797+
security: {
798+
authz: {
799+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.ALL],
800+
},
758801
},
759802
summary: `Bulk unenroll agents`,
760803
options: {
@@ -783,8 +826,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
783826
router.versioned
784827
.get({
785828
path: AGENT_API_ROUTES.AVAILABLE_VERSIONS_PATTERN,
786-
fleetAuthz: {
787-
fleet: { readAgents: true },
829+
security: {
830+
authz: {
831+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
832+
},
788833
},
789834
summary: `Get available agent versions`,
790835
options: {
@@ -817,8 +862,10 @@ export const registerAPIRoutes = (router: FleetAuthzRouter, config: FleetConfigT
817862
.get({
818863
path: '/internal/fleet/agents/status_runtime_field',
819864
access: 'internal',
820-
fleetAuthz: {
821-
fleet: { readAgents: true },
865+
security: {
866+
authz: {
867+
requiredPrivileges: [FLEET_API_PRIVILEGES.AGENTS.READ],
868+
},
822869
},
823870
})
824871
.addVersion(

0 commit comments

Comments
 (0)