Run through all of the test scenarios to validate the security plugin functionality

Configuration files

1. Before starting the cluster, add a role to roles.yml and a tenant to tenants.yml.
2. Start the cluster.
3. Open Dashboards and log in.
4. Security / Roles / Verify that the role exists.
5. Tenants / Verify that the tenant exists.

Create users

1. Open Dashboards and log in as admin.
2. Security / Internal User Database / Add a new internal user.
3. Provide a username and password.
4. Provide a backend role and a user attribute. [No backend role]
5. Submit.
6. Verify that the user is created.

Create role

1. Open Dashboards and log in as admin.
2. If you haven’t added any data, add the sample flight data.
3. Security / Roles / Add a new role.
4. Cluster Permissions / Add Permissions: Action Groups / read., indices:data/read/search*
5. Index Permissions / Add index permission / opensearch_dashboards_sample_data_flights*
6. Add Add Permissions: Action Groups / read., indices:data/read/search*
7. For Document Level Security Query, enter: {"match": {"FlightDelay": true}}
8. For Anonymize fields, enter: FlightNum
9. Tenant Permissions / Add tenant permissions / Add tenant pattern / Specify the tenant that you created earlier
10. Permissions / Add Field / kibana_all_read
11. Save Role Definition.
12. Verify that the role is created.

Map Role

1. Open Dashboards and log in as admin.
2. Security / Role Mappings / kibana_user
3. Add User / Specify the user you created earlier / Submit
4. Add a new role mapping / Choose the role you created earlier
5. Add User / Specify the user you created earlier / Submit.

Create Index Pattern

1. Change the tenant of the admin to newly created tenant
2. Add the index pattern by clicking discover tab
3. Discover / Add an index pattern: opensearch_dashboards_sample_data_flights
4. Next step / timestamp / Create index pattern
5. Move to Dashboards Basics to verify that the mappings worked and the roles are working as expected.

Dashboards Basics

1. Open Dashboards in an Incognito window and log in as the user you created earlier.
2. Explore on my own
3. DevTools:

GET kibana_sample_data_flights/_search
    {
      "query": {
        "match_all": {}
      }
    }

5. Verify that you have fewer than 10,000 hits. When I wrote this, I had 3,280 hits, all of which had “FlightDelay”: true (expected).
6. Verify that FlightNum is anonymized.

Multi-tenancy

1. Create Dashboard with admin and new tenant.
2. Check if new Dashboard is visible to the new user

Running with dev-tool requests

For creating tenant, user, role and role mapping

PUT _plugins/_security/api/tenants/security-test-tenant
{
  "description": "A tenant for security testing."
}

PUT _plugins/_security/api/internalusers/test-01
{
  "password": "abcd1234"
}

PUT _plugins/_security/api/roles/security-test-role
{
  "cluster_permissions" : [
    "read"
  ],
  "index_permissions" : [
    {
      "index_patterns" : [
        "opensearch_dashboards_sample_data_flights*"
      ],
      "dls" : """ {"match": {"FlightDelay": true}}""",
      "fls" : [ ],
      "masked_fields" : [
        "FlightNum"
      ],
      "allowed_actions" : [
        "read"
      ]
    }
  ],
  "tenant_permissions" : [
    {
      "tenant_patterns" : [
        "security-test-tenant"
      ],
      "allowed_actions" : [
        "kibana_all_read"
      ]
    }
  ]
}

PUT _plugins/_security/api/rolesmapping/security-test-role
{
  "users" : [ "test-01" ]
}