When using ?security_tenant=my_tenant in the url, switch tenants is not working

[rsmeyers]

Running 1.12.0

I'm using for example
https://MyHost/kibana/app/dashboards?security_tenant=my_tenant#/view/58ea38b0-1392-11eb-a0f9-c9113bcbe262?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-15m,to:now))&_a=(description:'',filters:!(),fullScreenMode:!f,options:(hidePanelTitles:!f,useMargins:!t),query:(language:kuery,query:''),timeRestore:!f,title:MyData,viewMode:view)

When I now goto the top right and click on 'Switch tenants', I can select a tenant but the actual switch isn't happening and ?security_tenant=my_tenant stays fixed to my earlier tenant.

[yuxitang-amzn]

Hi @rsmeyers ,

The url parameter has higher priority. Switching tenant will not work if security_tenant is present.

[rsmeyers]

I would say that's confusing..., the fact the choice is there gives the user the idea this will work, can't we override the security_tenant when we click on such an option ?

[yuxitang-amzn]

We don't plan to do that. I believe the security_tenant originally is for embedding multiple dashboards into one web page.

For normal browsing, we will assume security_tenant is not present. If you are using security_tenant to avoid selecting tenant every time, we have push a PR https://github.com/opendistro-for-elasticsearch/security-kibana-plugin/pull/650 to remember it. It would be included in next release or you can also build from source.

[rsmeyers]

We mainly user security_tenant in URL feature to allow hardlinking to dashboards, this makes sure when a user logs in, the tenant is auto selected.
Off course when a user then wants to switch to another tenant, trough the selection, such a user would expect it works..., but as they landed in Kibana with a dashboard/tenant link, they can't switch.

[shawnz]

Agreed, it is essential to use security_tenant this way so you can bookmark or link other users to tenant-specific pages on Kibana.

We use security_tenant this way when we send messages from the opendistro-alerting module, so as to automatically generate links that take you directly to the correct tenant.

This is why I think security_tenant should actually be added to all URLs on all pages, all the time. (See #123)

As it is currently, with multitenancy enabled, all URLs in kibana are dependent on having the right tenant selected or else they won't work. URLs are supposed to statelessly point to a particular resource without needing knowledge of secret session variables in order to know what resource is being accessed. All the information to locate the resource should be in the URL. With the current model, because of the stateful nature, it is impossible to reliably bookmark or share pages on Kibana, use Kibana in multiple tabs at the same time, etc, since all those URLs will break if you aren't in the right tenant in advance.

[davidlago]

Noted! Closing this issue in favor of #123 to track things in a single place. Thanks for the report!