[Fleet] Use Kibana Authz for API authorization #205335

nchaulet · 2024-12-31T16:05:48Z

Summary

Resolve #203170

Use Kibana authz instead of having custom logic for Fleet when it's possible. This add the required privileges to the generated open API doc.

Privileges are tested with API integration tests, so I do not think we will introduce a regression or a breaking change with that PR.

It was not possible to migrate all routes as some scenario are not yet supported like a route need (privilege1 AND privilege2) OR (privilege3 AND privilege 4) @legrego do you think it will be possible to support this kind of rules? do you want me to create an issue for that.

Do we want to backport this to 8.x?

…authz

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

…o feature-kibana-authz

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

…o feature-kibana-authz

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

…o feature-kibana-authz

elasticmachine · 2025-01-03T14:00:32Z

Pinging @elastic/fleet (Team:Fleet)

legrego · 2025-01-03T14:09:59Z

It was not possible to migrate all routes as some scenario are not yet supported like a route need (privilege1 AND privilege2) OR (privilege3 AND privilege 4) @legrego do you think it will be possible to support this kind of rules? do you want me to create an issue for that.

@elena-shostak what do you think about this request?

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

nchaulet · 2025-01-03T15:40:54Z

@elasticmachine merge upstream

juliaElastic

LGTM

…o feature-kibana-authz

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

…o feature-kibana-authz

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --include-path /api/dashboards --update'

nchaulet · 2025-01-06T02:11:17Z

@elasticmachine merge upstream

elasticmachine · 2025-01-06T03:35:57Z

💔 Build Failed

Buildkite Build
Commit: f0d6e57

Failed CI Steps

Post-Build

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [211d4a6]

History

💚 Build #264111 succeeded f37f632
💔 Build #264065 failed 5ae1d59
💔 Build #264051 failed 4750de1
💔 Build #264013 failed 61fcdad
💚 Build #263864 succeeded b20687c
💔 Build #263856 failed df86a0e

cc @nchaulet

nchaulet · 2025-01-06T14:45:09Z

@elasticmachine merge upstream

## Summary Currently, our `requiredPrivileges` structure supports `allRequired` and `anyRequired` for defining authorization logic. However, there is [a need to support](#205335 (comment)) more complex scenarios as `(privilege1 AND privilege2) OR (privilege3 AND privilege4)` To achieve `anyRequired` has been extended to allow defining multiple AND conditions evaluated with OR logic: ```ts security: { authz: { requiredPrivileges: [{ anyRequired: [ { allOf: ['privilege1', 'privilege2'] }, { allOf: ['privilege3', 'privilege4'] } ] } ] } } ``` `allRequired` now also supports scenarios `(privilege1 OR privilege2) AND (privilege3 OR privilege4)` ```ts security: { authz: { requiredPrivileges: [{ allRequired: [ { anyOf: ['privilege1', 'privilege2'] }, { anyOf: ['privilege3', 'privilege4'] } ] } ] } } ``` > [!IMPORTANT] > We expect to have unique privileges in `anyOf` or `allOf` conditions, assuming that most complex conditions can be simplified by boolean algebra laws (OR/AND distributive etc). ### Checklist - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) __Closes: https://github.com/elastic/kibana/issues/210977__ --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>

## Summary Currently, our `requiredPrivileges` structure supports `allRequired` and `anyRequired` for defining authorization logic. However, there is [a need to support](elastic#205335 (comment)) more complex scenarios as `(privilege1 AND privilege2) OR (privilege3 AND privilege4)` To achieve `anyRequired` has been extended to allow defining multiple AND conditions evaluated with OR logic: ```ts security: { authz: { requiredPrivileges: [{ anyRequired: [ { allOf: ['privilege1', 'privilege2'] }, { allOf: ['privilege3', 'privilege4'] } ] } ] } } ``` `allRequired` now also supports scenarios `(privilege1 OR privilege2) AND (privilege3 OR privilege4)` ```ts security: { authz: { requiredPrivileges: [{ allRequired: [ { anyOf: ['privilege1', 'privilege2'] }, { anyOf: ['privilege3', 'privilege4'] } ] } ] } } ``` > [!IMPORTANT] > We expect to have unique privileges in `anyOf` or `allOf` conditions, assuming that most complex conditions can be simplified by boolean algebra laws (OR/AND distributive etc). ### Checklist - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) __Closes: https://github.com/elastic/kibana/issues/210977__ --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit ed05808) # Conflicts: # oas_docs/bundle.json # oas_docs/bundle.serverless.json # oas_docs/output/kibana.serverless.yaml # oas_docs/output/kibana.yaml # src/core/packages/http/router-server-internal/tsconfig.json # src/platform/packages/shared/kbn-router-to-openapispec/src/__snapshots__/generate_oas.test.ts.snap # src/platform/packages/shared/kbn-router-to-openapispec/src/generate_oas.test.fixture.ts

## Summary Currently, our `requiredPrivileges` structure supports `allRequired` and `anyRequired` for defining authorization logic. However, there is [a need to support](elastic#205335 (comment)) more complex scenarios as `(privilege1 AND privilege2) OR (privilege3 AND privilege4)` To achieve `anyRequired` has been extended to allow defining multiple AND conditions evaluated with OR logic: ```ts security: { authz: { requiredPrivileges: [{ anyRequired: [ { allOf: ['privilege1', 'privilege2'] }, { allOf: ['privilege3', 'privilege4'] } ] } ] } } ``` `allRequired` now also supports scenarios `(privilege1 OR privilege2) AND (privilege3 OR privilege4)` ```ts security: { authz: { requiredPrivileges: [{ allRequired: [ { anyOf: ['privilege1', 'privilege2'] }, { anyOf: ['privilege3', 'privilege4'] } ] } ] } } ``` > [!IMPORTANT] > We expect to have unique privileges in `anyOf` or `allOf` conditions, assuming that most complex conditions can be simplified by boolean algebra laws (OR/AND distributive etc). ### Checklist - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) __Closes: https://github.com/elastic/kibana/issues/210977__ --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit ed05808) # Conflicts: # oas_docs/bundle.json # oas_docs/bundle.serverless.json # oas_docs/output/kibana.serverless.yaml # oas_docs/output/kibana.yaml # src/platform/packages/shared/kbn-router-to-openapispec/src/__snapshots__/generate_oas.test.ts.snap # src/platform/packages/shared/kbn-router-to-openapispec/src/generate_oas.test.fixture.ts

nchaulet and others added 11 commits December 31, 2024 10:53

[Fleet] Use Kibana Authz for API authorization

26a3fff

Merge branch 'main' of github.com:elastic/kibana into feature-kibana-…

fbcfaf5

…authz

fix missing file

9937e7e

debug and healthcheck routes

1929b00

Merge branch 'feature-kibana-authz' of github.com:nchaulet/kibana int…

4ad3fd1

…o feature-kibana-authz

[CI] Auto-commit changed files from 'node scripts/notice'

acde55a

[CI] Auto-commit changed files from 'make api-docs'

e54426c

more routes

10c360a

Merge branch 'feature-kibana-authz' of github.com:nchaulet/kibana int…

08cdcf7

…o feature-kibana-authz

nchaulet marked this pull request as ready for review January 2, 2025 17:48

nchaulet requested a review from a team as a code owner January 2, 2025 17:48

nchaulet marked this pull request as draft January 2, 2025 17:48

nchaulet added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Jan 2, 2025

nchaulet and others added 7 commits January 2, 2025 14:01

more routes

5677394

more routes

10275a0

[CI] Auto-commit changed files from 'make api-docs'

b20687c

more routes

fd368b3

Merge branch 'feature-kibana-authz' of github.com:nchaulet/kibana int…

4575e46

…o feature-kibana-authz

nchaulet self-assigned this Jan 3, 2025

nchaulet added the Team:Fleet Team label for Observability Data Collection Fleet team label Jan 3, 2025

nchaulet marked this pull request as ready for review January 3, 2025 14:00

kibanamachine added 2 commits January 3, 2025 14:15

[CI] Auto-commit changed files from 'make api-docs'

61fcdad

fix after review

76835ff

Merge branch 'main' into feature-kibana-authz

4750de1

nchaulet requested a review from juliaElastic January 3, 2025 15:41

juliaElastic approved these changes Jan 3, 2025

View reviewed changes

nchaulet and others added 8 commits January 3, 2025 10:54

fix missing commit

8550be3

Merge branch 'feature-kibana-authz' of github.com:nchaulet/kibana int…

1b4d262

…o feature-kibana-authz

[CI] Auto-commit changed files from 'make api-docs'

5ae1d59

fix agent policy fleet server access

6827555

Merge branch 'feature-kibana-authz' of github.com:nchaulet/kibana int…

57c16ef

…o feature-kibana-authz

[CI] Auto-commit changed files from 'make api-docs'

f37f632

Merge branch 'main' into feature-kibana-authz

f0d6e57

Merge branch 'main' into feature-kibana-authz

0844242

nchaulet merged commit 0b8ae36 into elastic:main Jan 6, 2025
9 checks passed

nchaulet deleted the feature-kibana-authz branch January 6, 2025 19:41

kibanamachine added the v9.0.0 label Jan 6, 2025

viduni94 pushed a commit to viduni94/kibana that referenced this pull request Jan 23, 2025

[Fleet] Use Kibana Authz for API authorization (elastic#205335)

f57852e

elena-shostak mentioned this pull request Feb 13, 2025

[Authorization] Extend privileges config to support OR evaluations #210977

Closed

4 tasks

elena-shostak mentioned this pull request Mar 24, 2025

[Authz] Added allOf and anyOf nested conditions #215516

Merged

3 tasks

nchaulet mentioned this pull request Oct 15, 2025

[Fleet] Fix permissions to download policies #239155

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Fleet] Use Kibana Authz for API authorization #205335

[Fleet] Use Kibana Authz for API authorization #205335

Uh oh!

nchaulet commented Dec 31, 2024 •

edited

Loading

Uh oh!

elasticmachine commented Jan 3, 2025

Uh oh!

legrego commented Jan 3, 2025

Uh oh!

nchaulet commented Jan 3, 2025

Uh oh!

juliaElastic left a comment

Uh oh!

nchaulet commented Jan 6, 2025

Uh oh!

elasticmachine commented Jan 6, 2025

Uh oh!

nchaulet commented Jan 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

[Fleet] Use Kibana Authz for API authorization #205335

[Fleet] Use Kibana Authz for API authorization #205335

Uh oh!

Conversation

nchaulet commented Dec 31, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

elasticmachine commented Jan 3, 2025

Uh oh!

legrego commented Jan 3, 2025

Uh oh!

nchaulet commented Jan 3, 2025

Uh oh!

juliaElastic left a comment

Choose a reason for hiding this comment

Uh oh!

nchaulet commented Jan 6, 2025

Uh oh!

elasticmachine commented Jan 6, 2025

💔 Build Failed

Failed CI Steps

Metrics [docs]

History

Uh oh!

nchaulet commented Jan 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nchaulet commented Dec 31, 2024 •

edited

Loading