[Reporting] Add deprecation messages for roles mapped to reporting_user #115125

tsullivan · 2021-10-15T01:54:06Z

Closes #115096

Summary

This fixes the deprecations for various edge cases:

when security was disabled, users saw a meaningless error message
when users did not have manage_security privilege they saw a meaningless error message

Adds support for checking deprecations related to xpack.reporting.roles.allow

Screenshots

Listing of Reporting deprecations. The highlighted ones are affected in this PR.
Details for users found with deprecated reporting roles:
Details for roles found mapped to deprecated reporting roles:
If current user does not have manage_security privileges, they will see this error state:

and these messages in the Kibana server log:

Checklist

Log users that have reporting privileges granted, from a customized xpack.reporting.roles.allow
Log roles that are mapped to a deprecated reporting role
Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

Testing

Security disabled

Test the Upgrade Assistant with Reporting enabled and Security disabled

Default deprecation

Create a customer user and assign the reporting_user role
Test the Upgrade Assistant with a superuser

Customized xpack.reporting.roles.allow

Add a custom role for enabling reporting access (my_test_reporting_role)
Update kibana.yml to allow the role to access reporting: xpack.reporting.roles.allow: ['my_test_reporting_role']
Create a customer user and assign the my_test_reporting_user role
Test the Upgrade Assistant with a superuser

Mapped roles

Add role mappings that map a custom role to reporting_user in Stack Management > Role Mappings

Invalid privileges for Reporting deprecations

Create a custom superuser role that provides the manage cluster privilege, and then some privileges to Kibana (so they can login)
Test the Upgrade Assistant with the custom user that has the custom superuser role

x-pack/plugins/reporting/server/deprecations/reporting_role.ts

tsullivan · 2021-10-19T22:52:59Z

x-pack/plugins/reporting/server/config/index.ts

@@ -64,7 +64,7 @@ export const config: PluginConfigDescriptor<ReportingConfigType> = {
 defaultMessage:
 `Use Kibana application privileges to grant reporting privileges.` +
 ` Using "{fromPath}.roles.allow" to grant reporting privileges` +
- ` prevents users from using API Keys to create reports.` +
+ ` is deprecated.` +


This is unrelated to this PR, but the existing text in this config deprecation was really hard to read on the page.

tsullivan · 2021-10-19T22:53:37Z

x-pack/plugins/reporting/server/core.ts

@@ -72,6 +72,7 @@ export class ReportingCore {
 public getContract: () => ReportingSetup;

 constructor(private logger: LevelLogger, context: PluginInitializerContext<ReportingConfigType>) {
+ // TODO: capture the entire packageInfo so we can form documentation links on the server


This applies this this PR, as the doc links are hardcoded to the current version, which is an issue.

+1 would be a good idea to address it in this PR

This fixes the deprecations for various edge cases: - when security was disabled, users saw a meaningless error message - when users did not have manage_security privilege they saw a meaningless error message Adds support for checking deprecations related to xpack.reporting.roles.allow

tsullivan · 2021-10-19T22:59:31Z

x-pack/plugins/reporting/server/routes/diagnostic/browser.test.ts

+ config,
+ createMockPluginSetup({
+ router: httpSetup.createRouter(''),
+ security: null,


This is a side effect of not having the security dependency not mocked well in createMockReportingCore before this PR.

tsullivan · 2021-10-19T22:59:38Z

x-pack/plugins/reporting/server/routes/diagnostic/screenshot.test.ts

+ config,
+ createMockPluginSetup({
+ router: httpSetup.createRouter(''),
+ security: null,


This is a side effect of not having the security dependency not mocked well in createMockReportingCore before this PR.

tsullivan · 2021-10-19T23:00:06Z

x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts

@@ -39,9 +41,9 @@ export const createMockPluginSetup = (setupMock?: any): ReportingInternalSetup =
 features: featuresPluginMock.createSetup(),
 basePath: { set: jest.fn() },
 router: setupMock.router,
- security: setupMock.security,
+ security: securityMock.createSetup(),


The tests in this PR needed a better security mock from the reporting test utilities

tsullivan · 2021-10-19T23:00:22Z

x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts

 licensing: { license$: Rx.of({ isAvailable: true, isActive: true, type: 'basic' }) } as any,
- taskManager: { registerTaskDefinitions: jest.fn() } as any,
+ taskManager: taskManagerMock.createSetup(),


opportunistic cleanup

elasticmachine · 2021-10-19T23:01:36Z

Pinging @elastic/kibana-reporting-services (Team:Reporting Services)

dokmic

Code changes LGTM, but I haven't tested that.

jloleysens

This is looking great @tsullivan, I did a few tests locally and it seemed to be working as expected (I didn't test the role map deprecation manually).

I left a few non-blocker comments but I think it'd be good to address the formatting of markdown before merging.

x-pack/plugins/reporting/server/deprecations/reporting_role.ts

jloleysens · 2021-10-20T08:55:49Z

x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts

+describe('roles mapped to a deprecated role', () => {
+ test('logs a deprecation when a role was found that maps to the deprecated reporting_user role', async () => {
+ esClient.asCurrentUser.security.getRoleMapping = jest.fn().mockResolvedValue({
+ body: { dungeon_master: { roles: ['reporting_user'] } },


x-pack/plugins/reporting/server/deprecations/reporting_role.test.ts

jloleysens · 2021-10-20T09:24:23Z

x-pack/plugins/reporting/server/lib/deprecations/index.ts

+ return [
+ {
+ title,
+ level: 'fetch_error', // NOTE: is fetch_error not shown in the Upgrade Assistant UI?


Should we follow up on this with the Stack Management team?

jportner

I added some suggestions below!

A general suggestion/comment: we don't need to use template strings to prevent things from being translated. For example, instead of this:

'Set "{upgradableConfig}" in kibana.yml'

you can write thisL

'Set "xpack.reporting.roles.enabled: false" in kibana.yml'

I confirmed this with @Bamieh

x-pack/plugins/reporting/server/deprecations/reporting_role.ts

…ecation-errorhandling-7.x

kibanamachine · 2021-10-20T18:48:16Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #163021 succeeded 4847e72
💔 Build #163013 failed a8865bd
💔 Build #162999 failed 52e9b8b
💔 Build #162937 failed 5f5f4ff
💔 Build #162891 failed ebb6981

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

tsullivan · 2021-10-20T19:05:24Z

x-pack/plugins/reporting/server/core.ts

@@ -85,8 +86,8 @@ export class ReportingCore {
 this.executing = new Set();
 }

- public getKibanaVersion() {
- return this.kibanaVersion;
+ public getKibanaPackageInfo() {


This change is to allow documentation links generated on the server to use the current branch.

kibanamachine · 2021-10-20T22:03:14Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…er (elastic#115125) * [Reporting] Add deprecation messages for roles mapped to reporting_user This fixes the deprecations for various edge cases: - when security was disabled, users saw a meaningless error message - when users did not have manage_security privilege they saw a meaningless error message Adds support for checking deprecations related to xpack.reporting.roles.allow * updates to content per feedback * updates per feedback * store packageInfo in reportingCore * use branch in the documentation links generated in the server * add tests for scenario where config does not need to be changed

…er (#115125) (#115875) * [Reporting] Add deprecation messages for roles mapped to reporting_user This fixes the deprecations for various edge cases: - when security was disabled, users saw a meaningless error message - when users did not have manage_security privilege they saw a meaningless error message Adds support for checking deprecations related to xpack.reporting.roles.allow * updates to content per feedback * updates per feedback * store packageInfo in reportingCore * use branch in the documentation links generated in the server * add tests for scenario where config does not need to be changed

tsullivan marked this pull request as draft October 15, 2021 01:54

tsullivan force-pushed the reporting/roles-deprecation-errorhandling-7.x branch 2 times, most recently from a14b4ad to e2f4f7d Compare October 15, 2021 01:59

tsullivan commented Oct 15, 2021

View reviewed changes

x-pack/plugins/reporting/server/deprecations/reporting_role.ts Outdated Show resolved Hide resolved

tsullivan force-pushed the reporting/roles-deprecation-errorhandling-7.x branch 4 times, most recently from 52e9b8b to a8865bd Compare October 19, 2021 22:49

tsullivan requested review from jloleysens, dokmic and a team October 19, 2021 22:49

tsullivan commented Oct 19, 2021

View reviewed changes

tsullivan force-pushed the reporting/roles-deprecation-errorhandling-7.x branch from a8865bd to 4847e72 Compare October 19, 2021 22:56

tsullivan commented Oct 19, 2021

View reviewed changes

tsullivan requested a review from vadimkibana October 19, 2021 23:00

tsullivan marked this pull request as ready for review October 19, 2021 23:01

tsullivan changed the title ~~[Reporting] Fix deprecation messages~~ [Reporting] Add deprecation messages for roles mapped to reporting_user Oct 19, 2021

dokmic approved these changes Oct 20, 2021

View reviewed changes

jloleysens approved these changes Oct 20, 2021

View reviewed changes

jportner self-requested a review October 20, 2021 13:39

jportner reviewed Oct 20, 2021

View reviewed changes

tylersmalley deleted the branch elastic:7.16 October 20, 2021 16:09

tylersmalley closed this Oct 20, 2021

tylersmalley reopened this Oct 20, 2021

Merge remote-tracking branch 'elastic/7.16' into reporting/roles-depr…

8eced82

…ecation-errorhandling-7.x

tsullivan added 4 commits October 20, 2021 11:54

updates to content per feedback

e1697d2

updates per feedback

a72a5f6

store packageInfo in reportingCore

f8be210

use branch in the documentation links generated in the server

f61cd48

tsullivan commented Oct 20, 2021

View reviewed changes

add tests for scenario where config does not need to be changed

7bb8efa

tsullivan enabled auto-merge (squash) October 20, 2021 20:17

tsullivan merged commit 9231d80 into elastic:7.16 Oct 20, 2021

tsullivan mentioned this pull request Oct 20, 2021

[Reporting] Add deprecation messages for roles mapped to reporting_user (#115125) #115875

Merged

tsullivan deleted the reporting/roles-deprecation-errorhandling-7.x branch October 21, 2021 02:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Reporting] Add deprecation messages for roles mapped to reporting_user #115125

[Reporting] Add deprecation messages for roles mapped to reporting_user #115125

tsullivan commented Oct 15, 2021 •

edited

Loading

tsullivan Oct 19, 2021

tsullivan Oct 19, 2021

jportner Oct 20, 2021

tsullivan Oct 19, 2021

tsullivan Oct 19, 2021

tsullivan Oct 19, 2021

tsullivan Oct 19, 2021

elasticmachine commented Oct 19, 2021

dokmic left a comment

jloleysens left a comment

jloleysens Oct 20, 2021

jloleysens Oct 20, 2021

jportner left a comment

kibanamachine commented Oct 20, 2021

tsullivan Oct 20, 2021

kibanamachine commented Oct 20, 2021

[Reporting] Add deprecation messages for roles mapped to reporting_user #115125

[Reporting] Add deprecation messages for roles mapped to reporting_user #115125

Conversation

tsullivan commented Oct 15, 2021 • edited Loading

Summary

Screenshots

Checklist

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Oct 19, 2021

dokmic left a comment

Choose a reason for hiding this comment

jloleysens left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 20, 2021

💚 Build Succeeded

Metrics [docs]

History

Choose a reason for hiding this comment

kibanamachine commented Oct 20, 2021

💚 Build Succeeded

Metrics [docs]

tsullivan commented Oct 15, 2021 •

edited

Loading