Fix privileges check when security is not enabled#67308
Merged
jloleysens merged 1 commit intoelastic:masterfrom May 26, 2020
Merged
Fix privileges check when security is not enabled#67308jloleysens merged 1 commit intoelastic:masterfrom
jloleysens merged 1 commit intoelastic:masterfrom
Conversation
sebelga
approved these changes
May 26, 2020
Contributor
sebelga
left a comment
There was a problem hiding this comment.
Code LGTM! I haven't tested locally.
The issue here was that we were only checking for the existence of the security plugin and not whether it was enabled too
I'm confused. I remember asking the core team and they told me that if a plugin is present it means that it is enabled. How can a plugin not be enabled and be present? 😊
Contributor
💚 Build SucceededTo update your PR or re-run it, just comment with: |
Contributor
Author
|
@sebelga Thanks for the review! Yeah, perhaps worth flagging this case more broadly. |
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
May 26, 2020
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
May 26, 2020
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
May 26, 2020
# Conflicts: # x-pack/plugins/ingest_pipelines/kibana.json # x-pack/plugins/ingest_pipelines/server/plugin.ts # x-pack/plugins/ingest_pipelines/server/routes/api/privileges.ts # x-pack/plugins/ingest_pipelines/server/types.ts
jloleysens
added a commit
that referenced
this pull request
May 26, 2020
…ine-editor * 'master' of github.com:elastic/kibana: (129 commits) [Canvas] Force embeddables to refresh when renderable reevaluated (#67133) [Canvas] Better handling navigating to/from canvas (#66407) [Ingest pipelines] Fix schema validation for simulate and update routes (#67199) do not use es from setup (#67277) Auto expand replicas for event log (#67286) Observability & APM do not use elasticsearch client provided via setup contract (#67263) Fix privileges check when security is not enabled (#67308) add IIS home (#66918) [ML] Adding additional job service endpoint tests (#66892) [Ingest Manager] Update fleet internal doc with latest flags (#67193) [Discover] Deangularize the loading spinner (#67165) Add `application.navigateToUrl` core API (#67110) Improve indexpattern without timefield functional test (#67031) KibanaContext in index pattern managment ui (#66985) Fix Azure metrics tutorial inside the App Home/ Add data area (#66901) add azure logs home (#66910) fix: rum agent should work correctly on new platform (#67037) [test_utils/Testbed] Move to src/test_utils folder (OSS) (#66898) only block registration when appRoute contains the exact basePath (#67125) Changed actions API endpoints urls to follow Kibana STYLEGUIDE (#65936) ... # Conflicts: # x-pack/plugins/ingest_pipelines/public/application/components/pipeline_form/pipeline_form_fields.tsx
jloleysens
added a commit
that referenced
this pull request
May 26, 2020
jloleysens
added a commit
that referenced
this pull request
May 26, 2020
jloleysens
added a commit
that referenced
this pull request
May 26, 2020
) * Fix privileges check when security is not enabled (#67308) # Conflicts: # x-pack/plugins/ingest_pipelines/kibana.json # x-pack/plugins/ingest_pipelines/server/plugin.ts # x-pack/plugins/ingest_pipelines/server/routes/api/privileges.ts # x-pack/plugins/ingest_pipelines/server/types.ts * Use legacy compat security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix #66980
How to test
To reproduce in dev setup:
elasticsearch.ymlconfig containing only what is in the config shipped with docker (https://github.com/elastic/elasticsearch/blob/master/distribution/docker/src/docker/config/elasticsearch.yml). I also removed thenetwork.host: 0.0.0.0setting.xpack.security.enabled: booleannot in yourkibana.dev.yml.Notes to reviewer
Hitting
GET _security/user/_privilegesthrows an internal server error from ESSecurity must be explicitly enabled when using a [basic] license. Enable security by setting [xpack.security.enabled] to [true] in the elasticsearch.yml file and restart the node.The issue here was that we were only checking for the existence of the security plugin and not whether it was enabled too - a case that can happen given the default docker distribution config.
Returning
res.internalError(e)does not display the actual error message asres.internalError({ body: e })does. In the former case the UI only has the message "Internal Server Error".Did a scan over our other plugins and it looks like it was only Ingest Pipelines and Snapshot & Restore that had this issue. Please flag any other cases that might have the same issue.
Release Note
We fixed an integration issue with the security plugin in Ingest Pipelines and Snapshot and Restore that would incorrectly report requiring security to be enabled when the plugins should work normally without security. This affects the default docker distribution.