Cluster privilege for proxied PKI#44862
Cluster privilege for proxied PKI#44862albertzaharovits merged 15 commits intoelastic:proxied-pkifrom
Conversation
|
Pinging @elastic/es-security |
| private static final Automaton ALL_CLUSTER_AUTOMATON = patterns("cluster:*", "indices:admin/template/*"); | ||
| private static final Automaton MANAGE_AUTOMATON = minusAndMinimize(ALL_CLUSTER_AUTOMATON, MANAGE_SECURITY_AUTOMATON); | ||
| private static final Automaton MANAGE_AUTOMATON = minusAndMinimize(minusAndMinimize(ALL_CLUSTER_AUTOMATON, MANAGE_SECURITY_AUTOMATON), | ||
| DELEGATE_PKI_AUTOMATON); |
There was a problem hiding this comment.
I'd prefer we have something like:
Automaton ALL_SECURITY_ACTIONS = patterns("cluster:admin/xpack/security/*");
Automaton MANAGE_SECURITY_AUTOMATON = minusAndMinimize(ALL_SECURITY_ACTIONS, DELEGATE_PKI_AUTOMATON);
Automaton MANAGE_AUTOMATON = minusAndMinimize(ALL_CLUSTER_AUTOMATON, ALL_SECURITY_ACTIONS);
There was a problem hiding this comment.
I went with your suggestion. Thanks for the details!
One idea I had in mind was to have this cluster action be named completely different, for example cluster:authenticate/pki/delegate. The reason is that it doesn't fit under the admin namespace (the user doing delegation could very well not be an "admin"), and it avoids possible misconfiguration when users define privileges by patterns. But I backtracked because of a lack of a good name. If you feel this is a good idea and have a name suggestion, we could give it a try.
There was a problem hiding this comment.
I don't have a good suggestion. I think putting it under admin is OK (but I agree with your attempts to find an even better place for it).
|
Thanks for the review @tvernum ! This is ready for another look. |
|
@elasticmachine test this please |
|
ping @bizybot |
|
@elasticmachine test this please |
1 similar comment
|
@elasticmachine test this please |
|
@elasticmachine run elasticsearch-ci/2 |
This adds the
delegate_pkicluster privilege that grants permissions to run the delegate-pki and invalidate-token APIs. Thedelegate_pkiis not part of themanage,manage_securityor any other cluster privilege apart fromall.It also adds the privilege to the
kibana_systemrole.Please review #44561 first, as this needs tests that rely on the REST handler to exist.