-
Notifications
You must be signed in to change notification settings - Fork 358
[BUG] Inconsistent behaviour of msearch operation when feature "do_not_fail_on_forbidden" is enabled or disabled #2113
Copy link
Copy link
Open
Labels
bugSomething isn't workingSomething isn't workinghelp wantedCommunity contributions are especially encouraged for these issues.Community contributions are especially encouraged for these issues.triagedIssues labeled as 'Triaged' have been reviewed and are deemed actionable.Issues labeled as 'Triaged' have been reviewed and are deemed actionable.
Description
What is the bug?
Various set of permissions is required to perform msearch operation when the feature "do_not_fail_on_forbidden" is enabled or disabled
How can one reproduce the bug?
Steps to reproduce the behavior:
- Create and index
marvelous_songs - Add some documents to index
marvelous_songs - Disable feature do_not_fail_on_forbidden in security plugin configuration
- Create a role
limited-rolewith cluster permissionindices:data/read/msearchand index permissionindices:data/read/searchassigned to marvelous_songs index - Create a user with the assigned role limited-role
- Perform msearch operation to find some documents from
marvelous_songsindex. The operation works correctly and returns documents which match to search criteria - Enable the feature do_not_fail_on_forbidden
- Perform again search operation described in point 6. The operation fails with 403 response code
To perform msearch operation when do_not_fail_on_forbidden feature is enabled an additional index permission indices:data/read/msearch is required.
What is the expected behavior?
The same set of cluster and index permissions is required to perform msearch operation when the feature "do_not_fail_on_forbidden" is enabled or disabled
What is your host/environment?
- OS: Ubuntu Linux 20.04 LTS
- Version 2.4.0-SNAPSHOT
- Plugins security plugin
Do you have any screenshots?
No
Do you have any additional context?
The problem was noticed during writing integration tests for do_not_fail_on_forbidden feature.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workinghelp wantedCommunity contributions are especially encouraged for these issues.Community contributions are especially encouraged for these issues.triagedIssues labeled as 'Triaged' have been reviewed and are deemed actionable.Issues labeled as 'Triaged' have been reviewed and are deemed actionable.