Remove deprecated route and endpoint

[willyborankin]

Description

Removed:

• /_opendistro route
• /_opendistro/kibanainfo endpoint

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwperks]

@willyborankin To fully complete removing _opendistro from the SAML route would also need a chance to security-dashboards-plugin.

Something similar to opensearch-project/security-dashboards-plugin#895 which was reverted due to not having a backend PR merged in simultaneously.

There were 2 backend PRs after the break:

• Update SAML Endpoint #1936
• Change _opendistro/_security/saml/acs to /_plugins/_security/saml/acs #1949

[shikharj05]

Kindly check - #5031 (comment)

[codecov]

Codecov Report

Attention: Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.

Project coverage is 71.45%. Comparing base (cac7743) to head (7f85017).
Report is 28 commits behind head on main.

Files with missing lines	Patch %	Lines
...zon/dlic/auth/http/saml/Saml2SettingsProvider.java	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5066      +/-   ##
==========================================
- Coverage   71.47%   71.45%   -0.03%     
==========================================
  Files         336      336              
  Lines       22625    22623       -2     
  Branches     3601     3601              
==========================================
- Hits        16171    16165       -6     
- Misses       4657     4660       +3     
- Partials     1797     1798       +1     

Files with missing lines	Coverage Δ
...dlic/auth/http/saml/AuthTokenProcessorHandler.java	50.28% <ø> (ø)
...zon/dlic/auth/http/saml/HTTPSamlAuthenticator.java	67.51% <ø> (ø)
.../opensearch/security/OpenSearchSecurityPlugin.java	83.79% <ø> (ø)
...pensearch/security/auditlog/impl/AuditMessage.java	78.70% <100.00%> (ø)
...earch/security/dlic/rest/api/AccountApiAction.java	98.59% <ø> (ø)
...nsearch/security/dlic/rest/api/AuditApiAction.java	90.76% <ø> (-3.08%)	⬇️
...rch/security/dlic/rest/api/WhitelistApiAction.java	100.00% <ø> (ø)
...g/opensearch/security/dlic/rest/support/Utils.java	59.45% <100.00%> (ø)
...opensearch/security/filter/SecurityRestFilter.java	84.32% <ø> (ø)
...nsearch/security/http/OnBehalfOfAuthenticator.java	89.38% <ø> (ø)
... and 8 more

... and 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cwperks]

Suggested change

	return dashboardsRoot + "_security/saml/acs";
	return dashboardsRoot + "_plugins/_security/saml/acs";

This instance and the one below both need to start with _plugins/. I think I saw another instance above as well. Can you make sure the prefix still exists, but _opendistro is replaced with _plugins?

[willyborankin]

Fixed

[shikharj05]

@cwperks @willyborankin -
reposting to ensure we don't miss this- how do we plan to support existing customers? This would break all logins using SAML ? #5031 (comment)

[cwperks]

@shikharj05 I agree, I think we should take a similar approach to non-inclusive language and mark it as deprecated in 3.0.0 and then remove it in 4.0.0.

For SAML, the complication is in setting up the Saml2SettingsProvider which assumes the ACS endpoint is prefixed with _opendistro and does not support configuring multiple.

When setting up Dashboards with SAML auth the administrator must include server.xsrf.allowlist: ["/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout"] to allow the Identity Provider (IdP) to make cross origin requests to the ACS endpoint.

[shikharj05]

Thanks @cwperks - to keep it cleaner/consistent. should we mark all _opendistro APIs/constants/response-params as deprecated and remove in 4.0?

[cwperks]

There's other instances in this file too. I see a few others across the files covered in this PR that need to be updated.

[willyborankin]

I plan to remove the White List API in a follow-up PR, as the Allow List now fully replaces it.

[cwperks]

Got it. Do we need to introduce another API like the migrate API to handle cases where a cluster may still be referencing whitelist.yml?