Skip to content

Commit c8d2e50

Browse files
jonathan-buttnerjonathan-buttner
committed
Merge branch 'cases-rbac-poc' of github.com:elastic/kibana into add-security-only-tests
2 parents d815591 + 78dfac4 commit c8d2e50

412 files changed

Lines changed: 2958 additions & 5990 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@
188188
/src/core/ @elastic/kibana-core
189189
/src/plugins/saved_objects_tagging_oss @elastic/kibana-core
190190
/config/kibana.yml @elastic/kibana-core
191+
/x-pack/plugins/banners/ @elastic/kibana-core
191192
/x-pack/plugins/features/ @elastic/kibana-core
192193
/x-pack/plugins/licensing/ @elastic/kibana-core
193194
/x-pack/plugins/global_search/ @elastic/kibana-core

‎Jenkinsfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ kibanaLibrary.load()
66
kibanaPipeline(timeoutMinutes: 210, checkPrChanges: true, setCommitStatus: true) {
77
slackNotifications.onFailure(disabled: !params.NOTIFY_ON_FAILURE) {
88
githubPr.withDefaultPrComments {
9-
ciStats.trackBuild(requireSuccess: githubPr.isPr()) {
9+
ciStats.trackBuild(requireSuccess: githubPr.isTrackedBranchPr()) {
1010
catchError {
1111
retryable.enable()
1212
kibanaPipeline.allCiTasks()

‎docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ readonly links: {
144144
createSnapshotLifecyclePolicy: string;
145145
createRoleMapping: string;
146146
createRoleMappingTemplates: string;
147+
createRollupJobsRequest: string;
147148
createApiKey: string;
148149
createPipeline: string;
149150
createTransformRequest: string;

‎docs/development/core/public/kibana-plugin-core-public.doclinksstart.md‎

Lines changed: 3 additions & 1 deletion
Large diffs are not rendered by default.

‎docs/user/security/authentication/index.asciidoc‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
{kib} supports the following authentication mechanisms:
99

10+
- <<multiple-authentication-providers>>
1011
- <<basic-authentication>>
1112
- <<token-authentication>>
1213
- <<pki-authentication>>
@@ -16,15 +17,20 @@
1617
- <<anonymous-authentication>>
1718
- <<http-authentication>>
1819

19-
Enable multiple authentication mechanisms at the same time specifying a prioritized list of the authentication _providers_ (typically of various types) in the configuration. Providers are consulted in ascending order. Make sure each configured provider has a unique name (e.g. `basic1` or `saml1` in the configuration example) and `order` setting. In the event that two or more providers have the same name or `order`, {kib} will fail to start.
20+
For an introduction to {kib}'s security features, including the login process, refer to <<tutorial-secure-access-to-kibana>>.
21+
22+
[[multiple-authentication-providers]]
23+
==== Multiple authentication providers
24+
25+
Enable multiple authentication mechanisms at the same time by specifying a prioritized list of the authentication _providers_ (typically of various types) in the configuration. Providers are consulted in ascending order. Make sure each configured provider has a unique name (e.g. `basic1` or `saml1` in the configuration example) and `order` setting. In the event that two or more providers have the same name or `order`, {kib} will fail to start.
2026

2127
When two or more providers are configured, you can choose the provider you want to use on the Login Selector UI. The order the providers appear is determined by the `order` setting. The appearance of the specific provider entry can be customized with the `description`, `hint`, and `icon` settings.
2228

2329
TIP: To provide login instructions to users, use the `xpack.security.loginHelp` setting, which supports Markdown format. When you specify the `xpack.security.loginHelp` setting, the Login Selector UI displays a `Need help?` link that lets users access login help information.
2430

2531
If you don't want a specific provider to show up at the Login Selector UI (e.g. to only support third-party initiated login) you can hide it with `showInSelector` setting set to `false`. However, in this case, the provider is presented in the provider chain and may be consulted during authentication based on its `order`. To disable the provider, use the `enabled` setting.
2632

27-
TIP: The Login Selector UI can also be disabled or enabled with `xpack.security.authc.selector.enabled` setting.
33+
TIP: The Login Selector UI can also be disabled or enabled with `xpack.security.authc.selector.enabled` setting.
2834

2935
Here is how your `kibana.yml` and Login Selector UI can look like if you deal with multiple authentication providers:
3036

@@ -292,9 +298,9 @@ xpack.security.authc.providers:
292298
order: 1
293299
-----------------------------------------------
294300

295-
IMPORTANT: {kib} uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications.
301+
IMPORTANT: {kib} uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications.
296302
At the end of the Kerberos handshake, {kib} forwards the service ticket to {es}, then {es} unpacks the service ticket and responds with an access and refresh token, which are used for subsequent authentication.
297-
On every {es} node that {kib} connects to, the keytab file should always contain the HTTP service principal for the {kib} host.
303+
On every {es} node that {kib} connects to, the keytab file should always contain the HTTP service principal for the {kib} host.
298304
The HTTP service principal name must have the `HTTP/kibana.domain.local@KIBANA.DOMAIN.LOCAL` format.
299305

300306

@@ -386,7 +392,7 @@ xpack.security.authc.providers:
386392
[[anonymous-access-and-embedding]]
387393
===== Anonymous access and embedding
388394

389-
One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in to view it.
395+
One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in to view it.
390396
If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.
391397

392398
If you have multiple authentication providers enabled, and you want to automatically log in anonymous users when embedding dashboards and visualizations:

‎packages/kbn-optimizer/limits.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ pageLoadAssetSize:
4646
lens: 96624
4747
licenseManagement: 41817
4848
licensing: 29004
49-
lists: 228500
49+
lists: 280504
5050
logstash: 53548
5151
management: 46112
5252
maps: 80000

‎packages/kbn-securitysolution-io-ts-utils/src/format_errors/index.ts‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ export const formatErrors = (errors: t.Errors): string[] => {
2121
.map((entry) => entry.key)
2222
.join(',');
2323

24-
const nameContext = error.context.find((entry) => entry.type?.name?.length > 0);
24+
const nameContext = error.context.find(
25+
(entry) => entry.type != null && entry.type.name != null && entry.type.name.length > 0
26+
);
2527
const suppliedValue =
2628
keyContext !== '' ? keyContext : nameContext != null ? nameContext.type.name : '';
2729
const value = isObject(error.value) ? JSON.stringify(error.value) : error.value;

‎packages/kbn-securitysolution-io-ts-utils/src/index.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,14 @@ export * from './from';
4141
export * from './id';
4242
export * from './iso_date_string';
4343
export * from './language';
44+
export * from './list_types';
4445
export * from './max_signals';
4546
export * from './meta';
4647
export * from './name';
4748
export * from './non_empty_array';
4849
export * from './non_empty_or_nullable_string_array';
4950
export * from './non_empty_string';
51+
export * from './non_empty_string_array';
5052
export * from './normalized_ml_job_id';
5153
export * from './only_false_allowed';
5254
export * from './operator';
@@ -61,6 +63,7 @@ export * from './severity';
6163
export * from './severity_mapping';
6264
export * from './string_to_positive_number';
6365
export * from './tags';
66+
export * from './test_utils';
6467
export * from './threat';
6568
export * from './threat_mapping';
6669
export * from './threat_subtechnique';

‎packages/kbn-securitysolution-io-ts-utils/src/list_types/entries_exist/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
import * as t from 'io-ts';
1010

11-
import { operator } from '../operator';
11+
import { listOperator as operator } from '../list_operator';
1212
import { NonEmptyString } from '../../non_empty_string';
1313

1414
export const entriesExists = t.exact(

‎packages/kbn-securitysolution-io-ts-utils/src/list_types/entries_list/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import * as t from 'io-ts';
1010
import { NonEmptyString } from '../../non_empty_string';
1111

1212
import { type } from '../type';
13-
import { operator } from '../operator';
13+
import { listOperator as operator } from '../list_operator';
1414

1515
export const entriesList = t.exact(
1616
t.type({

0 commit comments

Comments
 (0)