[Actions] System actions authorization #161341

cnasikas · 2023-07-06T11:42:20Z

Summary

This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution.

Depends on: #160983

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

…ana into system_actions_registration

…ntext

elasticmachine · 2023-07-11T09:20:04Z

Pinging @elastic/response-ops (Team:ResponseOps)

cnasikas · 2023-07-11T09:51:32Z

x-pack/plugins/actions/server/action_type_registry.ts

+ */
+ public getSystemActionKibanaPrivileges(
+ actionTypeId: string,
+ metadata?: Record<string, unknown>


See https://github.com/elastic/kibana/pull/161341/files#r1257471094

cnasikas · 2023-07-11T09:55:10Z

x-pack/plugins/actions/server/actions_client.ts

@@ -730,7 +745,8 @@ export class ActionsClient {
 (await getAuthorizationModeBySource(this.unsecuredSavedObjectsClient, source)) ===
 AuthorizationMode.RBAC
 ) {
- await this.authorization.ensureAuthorized('execute');
+ const additionalPrivileges = this.getSystemActionKibanaPrivileges(actionId, params);


Authorize system actions if needed.

cnasikas · 2023-07-11T09:56:21Z

x-pack/plugins/actions/server/authorization/actions_authorization.ts

 execute: (authorization) => [
 authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'get'),
 authorization.actions.savedObject.get(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, 'create'),
 ],
- list: (authorization) => authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'find'),
+ list: (authorization) => [


Return only string[]

cnasikas · 2023-07-11T10:14:17Z

x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts

+ kibana: [
+ {
+ feature: {
+ generalCases: ['all'],


If you want me to register a feature in x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/plugin.ts and use it instead of using Cases let me know.

ymao1

LGTM!

kibana-ci · 2023-07-20T09:44:49Z

💔 Build Failed

Failed CI Steps

Serverless Observability Tests

Test Failures

[job] [logs] Serverless Observability Tests / serverless observability UI navigation active sidenav section is auto opened on load

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`actions`	267	269	+2

Unknown metric groups

API count

id	before	after	diff
`actions`	272	275	+3

History

💚 Build #142225 succeeded 1794087
💔 Build #142213 failed dddcc8e
💚 Build #141528 succeeded 72e9d72
💔 Build #141117 failed 4259f54
💔 Build #141114 failed 0020ee9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @cnasikas

## Summary This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution. Depends on: elastic#160983 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

## Summary This PR: - Handles the references for system actions in the rule - Forbids the creation of system actions through the `kibana.yml` - Adds telemetry for system actions - Allow system action types to be disabled from the `kibana.yml` Depends on: #160983, #161341 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

## Summary This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution. Depends on: elastic#160983 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

## Summary This PR: - Handles the references for system actions in the rule - Forbids the creation of system actions through the `kibana.yml` - Adds telemetry for system actions - Allow system action types to be disabled from the `kibana.yml` Depends on: elastic#160983, elastic#161341 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

cnasikas and others added 30 commits June 28, 2023 10:51

Add isSystemAction to ActionResult type and default it to false

1352e52

Disallow registering system actions

09b82f6

Add test

dc1a2c8

Fix alerting types

bb7e9a5

Fix integration tests

774b389

Fix triggers_actions_ui types

83ee747

Fix cases types

d2b8e67

Fix cases tests

31f1f39

Fix integration tests

85ca6a4

Fix cases tests

b070bd9

Merge branch 'main' into system_actions_registration

a8e7143

Fix types from other plugins

b50a3e0

Merge branch 'system_actions_registration' of github.com:cnasikas/kib…

ee5df7b

…ana into system_actions_registration

Rename preconfiguredConnectors to inMemoryConnectors

1caf874

Create system actions

2aabeed

Prevent create/update/delete of system actions

3cf469a

Fix types

8c1246c

Merge branch 'main' into load_system_actions_in_memory

0d7aea1

Fix types

52ef0e5

Remove cases from basic

d763161

Convert preconfigured to in-memory

5c3245e

Merge branch 'main' into load_system_actions_in_memory

31bc750

Get in-memory connectors after they have been created in the route co…

d35a7f9

…ntext

Register test system action in integration tests

34ee2ab

Add integration tests

86b279c

Fix i18n

57b4d3a

Fix types

a162163

Fix integration test

2ea3c9c

Fixes

7362b97

Merge branch 'main' into load_system_actions_in_memory

cbaeb1f

cnasikas added 2 commits July 11, 2023 12:14

Add integration tests for spaces_only

be7ec67

Fix integration tests

2c565b1

cnasikas marked this pull request as ready for review July 11, 2023 09:20

cnasikas requested a review from a team as a code owner July 11, 2023 09:20

Merge branch 'main' into system_actions_rbac

a9e3bd5

cnasikas commented Jul 11, 2023

View reviewed changes

Small improvements

72e9d72

cnasikas mentioned this pull request Jul 11, 2023

[Actions] System actions enhancements #161340

Merged

2 tasks

cnasikas added 4 commits July 13, 2023 13:42

Merge branch 'main' into system_actions_rbac

a8ea16b

Do not allow setting kibana privileges if it is not a system action type

dddcc8e

Fix test

8a9e449

Fix i18n

1794087

ymao1 approved these changes Jul 19, 2023

View reviewed changes

cnasikas added 2 commits July 20, 2023 12:06

Merge branch 'main' into system_actions_rbac

0a07366

PR feedback

59cfda7

cnasikas enabled auto-merge (squash) July 20, 2023 09:16

cnasikas merged commit 2943fc9 into elastic:main Jul 20, 2023

cnasikas deleted the system_actions_rbac branch July 20, 2023 10:41

kibanamachine added the backport:skip This commit does not require backporting label Jul 20, 2023

Dosant mentioned this pull request Jul 31, 2023

Failing test: Serverless Observability Tests / serverless observability UI navigation active sidenav section is auto opened on load #162781

Closed

cnasikas mentioned this pull request Dec 1, 2023

[Actions][System actions] Do the authorization checks before enqueuing the system action #172346

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Actions] System actions authorization #161341

[Actions] System actions authorization #161341

cnasikas commented Jul 6, 2023 •

edited

Loading

elasticmachine commented Jul 11, 2023

cnasikas Jul 11, 2023

cnasikas Jul 11, 2023

cnasikas Jul 11, 2023

cnasikas Jul 11, 2023

ymao1 left a comment

kibana-ci commented Jul 20, 2023 •

edited

Loading

API count

[Actions] System actions authorization #161341

[Actions] System actions authorization #161341

Conversation

cnasikas commented Jul 6, 2023 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Jul 11, 2023

cnasikas Jul 11, 2023

Choose a reason for hiding this comment

cnasikas Jul 11, 2023

Choose a reason for hiding this comment

cnasikas Jul 11, 2023

Choose a reason for hiding this comment

cnasikas Jul 11, 2023

Choose a reason for hiding this comment

ymao1 left a comment

Choose a reason for hiding this comment

kibana-ci commented Jul 20, 2023 • edited Loading

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

API count

History

cnasikas commented Jul 6, 2023 •

edited

Loading

kibana-ci commented Jul 20, 2023 •

edited

Loading