Describe the bug
Even with the indices:admin/close permission, you can't close an index. You also need the indices:admin/close* permission, which isn't listed in OpenSearch Dashboards.
Added: It's not clear to me if this is a problem with the OpenSearch plugin or OpenSearch Dashboards plugin. Have we considered a "list permissions" REST API (GET _plugins/_security/api/permissions/ so that it's easier to get the authoritative list of all permissions?
To Reproduce
Steps to reproduce the behavior:
- As admin, create a new user.
- Create
test-index and index a couple documents.
- Create the following role:
PUT https://localhost:9200/_plugins/_security/api/roles/test
{
"cluster_permissions": [
],
"index_permissions": [
{
"index_patterns": [
"test-index"
],
"dls": "",
"fls": [],
"masked_fields": [],
"allowed_actions": [
"indices:admin/close",
"indices:admin/open"
]
}
]
}
- Map the new role to the new user.
- As the new user, send the following request:
POST https://localhost:9200/test-index/_close
- Note the error:
{
"acknowledged": false,
"shards_acknowledged": false,
"indices": {
"test-index": {
"closed": false,
"failedShards": {
"0": {
"failures": [
{
"shard": 0,
"index": "test-index",
"status": "FORBIDDEN",
"reason": {
"type": "security_exception",
"reason": "no permissions for [indices:admin/close[s]] and User [name=test, backend_roles=[], requestedTenant=null]"
}
}
]
}
}
}
}
}
- As admin, update the role:
https://localhost:9200/_plugins/_security/api/roles/test
{
"cluster_permissions": [
],
"index_permissions": [
{
"index_patterns": [
"test-index"
],
"dls": "",
"fls": [],
"masked_fields": [],
"allowed_actions": [
"indices:admin/close",
"indices:admin/close*",
"indices:admin/open"
]
}
]
}
- As the new user, send the request again:
POST https://localhost:9200/test-index/_close
Success.
Expected behavior
The indices:admin/close* permission should either not be necessary or should be included in the Dashboards UI.
Describe the bug
Even with the
indices:admin/closepermission, you can't close an index. You also need theindices:admin/close*permission, which isn't listed in OpenSearch Dashboards.Added: It's not clear to me if this is a problem with the OpenSearch plugin or OpenSearch Dashboards plugin. Have we considered a "list permissions" REST API (
GET _plugins/_security/api/permissions/so that it's easier to get the authoritative list of all permissions?To Reproduce
Steps to reproduce the behavior:
test-indexand index a couple documents.Success.
Expected behavior
The
indices:admin/close*permission should either not be necessary or should be included in the Dashboards UI.