buildFromRoleDescriptor uses application privilege look up
#91152
Conversation
| @@ -491,6 +491,19 @@ private void trySuccessfullyLoadSuperuserRole(CompositeRolesStore compositeRoles | |||
| final Role role = future.actionGet(); | |||
| assertThat(role.names(), arrayContaining("superuser")); | |||
| assertThat(role.application().getApplicationNames(), containsInAnyOrder("*")); | |||
| assertThat( | |||
There was a problem hiding this comment.
We test this elsewhere (e.g., in 30_superuser) but seems like an appropriate addition here
buildFromRoleDescriptor supports application privilege looupbuildFromRoleDescriptor uses application privilege look up
|
Pinging @elastic/es-security (Team:Security) |
| RESTRICTED_INDICES | ||
| RESTRICTED_INDICES, | ||
| List.of( | ||
| new ApplicationPrivilegeDescriptor("kibana-*", "reserved_monitoring", Set.of(allowedApplicationActionPattern), Map.of()) |
There was a problem hiding this comment.
Stored application privilege must have concrete application name. Are there test failures that prevent you from using something like kibana-kibana instead of kibana-*? It will be a bug if that is the case.
There was a problem hiding this comment.
Good point. I can make this work for sure. kibana-kibana doesn't do it because we randomize the application name in the assertions below, but using the randomized application name does the trick.
| new FieldPermissionsCache(Settings.EMPTY), | ||
| RESTRICTED_INDICES, | ||
| List.of( | ||
| new ApplicationPrivilegeDescriptor("kibana-*", "reserved_ml_apm_user", Set.of(allowedApplicationActionPattern), Map.of()) |
| roleDescriptor, | ||
| new FieldPermissionsCache(Settings.EMPTY), | ||
| RESTRICTED_INDICES, | ||
| List.of(new ApplicationPrivilegeDescriptor("kibana-*", "reserved_ml_admin", Set.of(allowedApplicationActionPattern), Map.of())) |
There was a problem hiding this comment.
Here as well and a few other places below. I won't be commenting for all of them since it is quite repetitive.
Yup, one more PR coming to do this 👍 |
Building a role from a single role descriptor previously only worked
correctly for application privileges with wildcard patterns. This PR
adds support for concrete name look up and ports the relevant tests.
Relates: #91107 (comment)