Description

With resource based permissions for views, the authorization system within the Security Plugin will need to handle requests that provide resource type / id data against the security roles. How these grants are written has an impact on the administrative user experience.

This issue contains an initial proposal built in a proof of concept, but is not hard requirements for the feature.

[Proposal 1] Resource Permission Grants

With requests include resource type and identifiers the security plugin will need to allow for grants to these new types. Modify the security role to include this information under a section resource_permissions so it can be checked and then the request can be permitted.

all_access:
  reserved: true
  hidden: false
  static: true
  description: "Allow full access to all indices and all cluster APIs"
  cluster_permissions:
    - "*"
  index_permissions:
    - index_patterns:
        - "*"
      allowed_actions:
        - "*"
  tenant_permissions:
    - tenant_patterns:
        - "*"
      allowed_actions:
        - "kibana_all_write"
  resource_permissions:
    - resource_type: "view"
      resource_ids: ["songs", "albums"]

Exit Criteria

• Update to the security configuration for new resource section