Grant access to machine learning features when base privileges are used

x-pack/plugins/ml/common/types/capabilities.ts

@@ -96,7 +96,7 @@ export function getPluginPrivileges() {
   ];
   const privilege = {
     app: [PLUGIN_ID, 'kibana'],
-    excludeFromBasePrivileges: true,
+    excludeFromBasePrivileges: false,
     management: {
       insightsAndAlerting: ['jobsListLink'],
     },

x-pack/test/functional/apps/management/feature_controls/management_security.ts

@@ -64,7 +64,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         expect(sections).to.have.length(2);
         expect(sections[0]).to.eql({
           sectionId: 'insightsAndAlerting',
-          sectionLinks: ['triggersActions'],
+          sectionLinks: ['triggersActions', 'jobsListLink'],
         });
         expect(sections[1]).to.eql({
           sectionId: 'kibana',

x-pack/test/functional/apps/ml/feature_controls/ml_security.ts

@@ -77,9 +77,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         await security.user.delete('global_all');
       });
 
-      it(`doesn't show ml navlink`, async () => {
+      it(`shows ml navlink`, async () => {
         const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
-        expect(navLinks).not.to.contain('Machine Learning');
+        expect(navLinks).to.contain('Machine Learning');
       });
     });
 
@@ -103,5 +103,75 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         expect(navLinks).to.contain('Machine Learning');
       });
     });
+
+    describe('ml read', () => {
+      before(async () => {
+        await security.role.create('ml_role_read', {
+          elasticsearch: {
+            indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
+          },
+          kibana: [
+            {
+              base: [],
+              feature: { ml: ['read'], savedObjectsManagement: ['read'] },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('ml_read_user', {
+          password: 'ml_read-password',
+          roles: ['ml_role_read'],
+          full_name: 'ml read',
+        });
+
+        await PageObjects.security.login('ml_read_user', 'ml_read-password');
+      });
+
+      after(async () => {
+        await security.role.delete('ml_role_read');
+        await security.user.delete('ml_read_user');
+      });
+
+      it('shows ML navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
+        expect(navLinks).to.contain('Machine Learning');
+      });
+    });
+
+    describe('ml none', () => {
+      before(async () => {
+        await security.role.create('ml_role_none', {
+          elasticsearch: {
+            indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
+          },
+          kibana: [
+            {
+              base: [],
+              feature: { discover: ['read'] },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('ml_none_user', {
+          password: 'ml_none-password',
+          roles: ['ml_role_none'],
+          full_name: 'ml none',
+        });
+
+        await PageObjects.security.login('ml_none_user', 'ml_none-password');
+      });
+
+      after(async () => {
+        await security.role.delete('ml_role_none');
+        await security.user.delete('ml_none_user');
+      });
+
+      it('does NOT show ML navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map((link) => link.text);
+        expect(navLinks).to.not.contain('Machine Learning');
+      });
+    });
   });
 }

x-pack/test/functional/apps/ml/permissions/no_ml_access.ts

@@ -13,10 +13,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'error']);
   const ml = getService('ml');
 
-  const testUsers = [
-    { user: USER.ML_UNAUTHORIZED, discoverAvailable: true },
-    { user: USER.ML_UNAUTHORIZED_SPACES, discoverAvailable: true },
-  ];
+  const testUsers = [{ user: USER.ML_UNAUTHORIZED, discoverAvailable: true }];
 
   describe('for user with no ML access', function () {
     this.tags(['skipFirefox', 'mlqa']);

x-pack/test/functional/services/ml/security_common.ts

@@ -21,7 +21,6 @@ export enum USER {
   ML_VIEWER_SPACE1 = 'ft_ml_viewer_space1',
   ML_VIEWER_ALL_SPACES = 'ft_ml_viewer_all_spaces',
   ML_UNAUTHORIZED = 'ft_ml_unauthorized',
-  ML_UNAUTHORIZED_SPACES = 'ft_ml_unauthorized_spaces',
 }
 
 export function MachineLearningSecurityCommonProvider({ getService }: FtrProviderContext) {
@@ -90,8 +89,7 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       elasticsearch: { cluster: [], indices: [], run_as: [] },
       kibana: [
         {
-          base: [],
-          feature: { ml: ['all'], savedObjectsManagement: ['all'] },
+          base: ['all'],
           spaces: ['*'],
         },
       ],
@@ -123,8 +121,7 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       elasticsearch: { cluster: [], indices: [], run_as: [] },
       kibana: [
         {
-          base: [],
-          feature: { ml: ['read'], savedObjectsManagement: ['read'] },
+          base: ['read'],
           spaces: ['*'],
         },
       ],
@@ -134,6 +131,31 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       elasticsearch: { cluster: [], indices: [], run_as: [] },
       kibana: [{ base: [], feature: { discover: ['read'] }, spaces: ['default'] }],
     },
+    {
+      name: 'ft_all_space_ml_none',
+      elasticsearch: { cluster: [], indices: [], run_as: [] },
+      kibana: [
+        {
+          base: [],
+          // This role is intended to be used by the "ft_ml_poweruser" and "ft_ml_viewer" users; they should have access to ML by virtue of
+          // the "machine_learning_admin" and "machine_learning_user" roles. However, a user needs _at least_ one Kibana privilege to log
+          // into Kibana. This role allows these users to log in, but explicitly omits ML from the feature privileges.
+          // In addition: several functional tests that use these users also rely on UI elements that are enabled by other Kibana features,
+          // such as "View in Lens", "Add to Dashboard", and creating anomaly detection rules. These feature privileges are the minimal ones
+          // necessary to satisfy all of those functional tests.
+          feature: {
+            discover: ['read'],
+            visualize: ['read'],
+            dashboard: ['all'],
+            actions: ['all'],
+            savedObjectsManagement: ['all'],
+            advancedSettings: ['all'],
+            indexPatterns: ['all'],
+          },
+          spaces: ['*'],
+        },
+      ],
+    },
   ];
 
   const users = [
@@ -142,7 +164,7 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       full_name: 'ML Poweruser',
       password: 'mlp001',
       roles: [
-        'kibana_admin',
+        'ft_all_space_ml_none',
         'machine_learning_admin',
         'ft_ml_source',
         'ft_ml_dest',
@@ -172,7 +194,7 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       full_name: 'ML Viewer',
       password: 'mlv001',
       roles: [
-        'kibana_admin',
+        'ft_all_space_ml_none',
         'machine_learning_user',
         'ft_ml_source_readonly',
         'ft_ml_dest_readonly',
@@ -200,12 +222,6 @@ export function MachineLearningSecurityCommonProvider({ getService }: FtrProvide
       name: 'ft_ml_unauthorized',
       full_name: 'ML Unauthorized',
       password: 'mlu001',
-      roles: ['kibana_admin', 'ft_ml_source_readonly'],
-    },
-    {
-      name: 'ft_ml_unauthorized_spaces',
-      full_name: 'ML Unauthorized',
-      password: 'mlus001',
       roles: ['ft_default_space_ml_none', 'ft_ml_source_readonly'],
     },
   ];

x-pack/test/functional_basic/apps/ml/permissions/no_ml_access.ts

@@ -13,10 +13,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'error']);
   const ml = getService('ml');
 
-  const testUsers = [
-    { user: USER.ML_UNAUTHORIZED, discoverAvailable: true },
-    { user: USER.ML_UNAUTHORIZED_SPACES, discoverAvailable: true },
-  ];
+  const testUsers = [{ user: USER.ML_UNAUTHORIZED, discoverAvailable: true }];
 
   describe('for user with no ML access', function () {
     for (const testUser of testUsers) {

x-pack/test/ui_capabilities/security_and_spaces/tests/catalogue.ts

@@ -46,29 +46,46 @@ export default function catalogueTests({ getService }: FtrProviderContext) {
           case 'dual_privileges_all at everything_space': {
             expect(uiCapabilities.success).to.be(true);
             expect(uiCapabilities.value).to.have.property('catalogue');
-            // everything except ml, monitoring, and ES features are enabled
+            // everything except monitoring, and ES features are enabled
             const expected = mapValues(
               uiCapabilities.value!.catalogue,
               (enabled, catalogueId) =>
-                catalogueId !== 'ml' &&
-                catalogueId !== 'ml_file_data_visualizer' &&
                 catalogueId !== 'monitoring' &&
                 catalogueId !== 'osquery' &&
                 !esFeatureExceptions.includes(catalogueId)
             );
             expect(uiCapabilities.value!.catalogue).to.eql(expected);
             break;
           }
-          case 'everything_space_all at everything_space':
+          case 'everything_space_all at everything_space': {
+            expect(uiCapabilities.success).to.be(true);
+            expect(uiCapabilities.value).to.have.property('catalogue');
+            // everything except spaces, monitoring, the enterprise search suite, and ES features are enabled
+            // (easier to say: all "proper" Kibana features are enabled)
+            const exceptions = [
+              'monitoring',
+              'enterpriseSearch',
+              'appSearch',
+              'workplaceSearch',
+              'spaces',
+              'osquery',
+              ...esFeatureExceptions,
+            ];
+            const expected = mapValues(
+              uiCapabilities.value!.catalogue,
+              (enabled, catalogueId) => !exceptions.includes(catalogueId)
+            );
+            expect(uiCapabilities.value!.catalogue).to.eql(expected);
+            break;
+          }
           case 'global_read at everything_space':
           case 'dual_privileges_read at everything_space':
           case 'everything_space_read at everything_space': {
             expect(uiCapabilities.success).to.be(true);
             expect(uiCapabilities.value).to.have.property('catalogue');
-            // everything except spaces, ml, monitoring, the enterprise search suite, and ES features are enabled
+            // everything except spaces, ml_file_data_visualizer, monitoring, the enterprise search suite, and ES features are enabled
             // (easier to say: all "proper" Kibana features are enabled)
             const exceptions = [
-              'ml',
               'ml_file_data_visualizer',
               'monitoring',
               'enterpriseSearch',

x-pack/test/ui_capabilities/security_and_spaces/tests/nav_links.ts

@@ -42,7 +42,7 @@ export default function navLinksTests({ getService }: FtrProviderContext) {
             expect(uiCapabilities.success).to.be(true);
             expect(uiCapabilities.value).to.have.property('navLinks');
             expect(uiCapabilities.value!.navLinks).to.eql(
-              navLinksBuilder.except('ml', 'monitoring', 'osquery')
+              navLinksBuilder.except('monitoring', 'osquery')
             );
             break;
           case 'everything_space_all at everything_space':
@@ -53,7 +53,6 @@ export default function navLinksTests({ getService }: FtrProviderContext) {
             expect(uiCapabilities.value).to.have.property('navLinks');
             expect(uiCapabilities.value!.navLinks).to.eql(
               navLinksBuilder.except(
-                'ml',
                 'monitoring',
                 'enterpriseSearch',
                 'appSearch',