Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adds Role Based Access-Control to the Actions framework based on Kibana Feature Controls #70304

Closed
wants to merge 19 commits into from
Closed

Adds Role Based Access-Control to the Actions framework based on Kibana Feature Controls #70304

wants to merge 19 commits into from

Conversation

gmmorris
Copy link
Contributor

Summary

This PR adds Role Based Access-Control to the Actions framework based on Kibana Feature Controls, and closes #43994

This does not provide producer level privileges to the actions framework, as we've decided to deprioritize this feature until we have concrete plans for solution specific actions - tracked here: #70303.

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@gmmorris
use feature based RBAC for actions instead of api privileges
025ed9e
@gmmorris
temporary security changes until alerting rbac branch is merged
f4f2f09
@gmmorris
base execution privileges on access to action_task_params type
29c9cc7
@gmmorris
prevent rendering alert editing when there are no privileges to edit …
541cdfd 
…their actions
@gmmorris
Merge branch 'master' into actions/feature
f56574f 
* master: (199 commits)
  [Telemetry] Add documentation about Application Usage (elastic#70624)
  [Ingest Manager] Improve agent unenrollment with unenroll action (elastic#70031)
  Handle timeouts on creating templates (elastic#70635)
  [Lens] Add ability to set colors for y-axis series (elastic#70311)
  [Uptime] Use elastic charts donut (elastic#70364)
  [Ingest Manager] Update registry URL to point to snapshot registry (elastic#70687)
  [Composable template] Create / Edit wizard (elastic#70220)
  [APM] Optimize services overview (elastic#69648)
  [Ingest Pipelines] Load from json (elastic#70297)
  [Rum Dashbaord] Rum selected service view (elastic#70579)
  [Uptime] Prevent duplicate requests on load for index status (elastic#70585)
  [ML] Changing shared module setup function parameters (elastic#70589)
  [Ingest Manager] Add ability to sort to agent configs and package configs (elastic#70676)
  [Alerting] document requirements for developing new action types (elastic#69164)
  Fixed adding an extra space character on selecting alert variable in action text fields (elastic#70028)
  [Maps] show vector tile labels on top (elastic#69444)
  chore(NA): upgrade to lodash@4 (elastic#69868)
  Add Snapshot Restore README with quick-testing steps. (elastic#70494)
  [EPM] Use higher priority than default templates (elastic#70640)
  [Maps] Fix cannot select Solid fill-color when removing fields (elastic#70621)
  ...
@gmmorris
allow all to see list of action types by default (for now)
169789a
@gmmorris
fixec privileges feature tests
49b40be
@gmmorris
fixed security test
53916fd
@gmmorris gmmorris mentioned this pull request Jul 3, 2020
Closed
7 tasks
@gmmorris
disble connector fields when user is read only
e6025ba
@gmmorris
fixed type errors
d78b918
@gmmorris
Merge branch 'master' into actions/feature
14ebe0e 
* master:
  [APM-UI] e2e speed up build (elastic#70704)
  skip flaky suite (elastic#70764)
  skip flaky suite (elastic#70762)
  [Security Solution][Endpoint] Update to new manifest format (without compression) (elastic#70752)
  [functional tests] test url field formatter on dashboard and discover (elastic#70736)
  logout from transform_poweruser user in after method of transform tests (elastic#70644)
  [SECURITY] Bug fix for topN on draggables (elastic#70450)
  [Logs UI] Reorganise log rate anomaly table (elastic#69516)
  Update dependency @elastic/charts to v19.7.0 (elastic#69791)
  Add googlecloud metricbeat module to Kibana Home (elastic#70652)
  [Logs UI] Logs overview queries for the observability dashboard (elastic#70413)
  [Lens] Fitting functions (elastic#69820)
@gmmorris
fixed security unit test
a4f1a7d
@gmmorris
show prompt if user has no privileges in actions form
7f5099c
@gmmorris
added actions feature to features test
76d2818
@gmmorris
Merge branch 'master' into actions/feature
6a2b64d 
* master:
  [APM] Fix flaky e2e’s (elastic#70790)
  [Discover] Migrate server side saved object from data to discover plugin (elastic#70342)
  [APM] Update docs on running API tests (elastic#70765)
  test: 💍 delete a flaky test (elastic#70785)
  [Security Solution] Refactor GlobalTime to useGlobalTime hook and cle… (elastic#69345)
  Remove IE11 mention from PR template [skip ci] (elastic#70486)
  [GS] add savedObjects result provider (elastic#68619)
  remove snapshot from disabled test suite. (elastic#70769)
@gmmorris gmmorris mentioned this pull request Jul 6, 2020
Closed
@gmmorris
improved copy
da1f944
@gmmorris
Merge branch 'master' into actions/feature
61626a0 
* master: (46 commits)
  [Composable template] Details panel + delete functionality (elastic#70814)
  [Uptime] Ping list body scroll (elastic#70781)
  moving indexPattern.delete() to indexPatterns.delete(indexPattern) (elastic#70430)
  Adapt expected response of advanced settings feature control for cloud tests (elastic#70793)
  skip flaky suite (elastic#70885)
  skip flaky suite (elastic#67814)
  skip flaky suite (elastic#70906)
  Revert "reenable regression and classification functional tests (elastic#70661)" (elastic#70908)
  Added UI validation when creating a Webhook connector with invalid URL (elastic#70025)
  [Security Solution] Change default index pattern (elastic#70797)
  ServiceNow push to Incident generic implementation (supporting both Case specific and generic Alerts) (elastic#68464)
  add button link to ingest (elastic#70142)
  reenable regression and classification functional tests (elastic#70661)
  [Component templates] Form wizard (elastic#69732)
  [Ingest Manager] Copy changes (elastic#70828)
  Adding test user to maps functional tests - PR 1 (elastic#70649)
  [Ingest Manager] Support limiting integrations on an agent config (elastic#70542)
  skip flaky suite (elastic#70880)
  [Metrics UI] Fix a bug in Metric Threshold query filter construction (elastic#70672)
  upgrade caniuse-lite database (elastic#70833)
  ...
@gmmorris
added readonly support to servicenow connector
a3f6142
@gmmorris
removed unused variable in i18n
6c84a9d
@kibanamachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Build metrics

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

gmmorris
gmmorris commented Jul 8, 2020
View reviewed changes
x-pack/plugins/actions/server/authorization/actions_authorization.ts
Comment on lines +22 to +28
> = {
execute: (authorization) => [
authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'get'),
authorization.actions.savedObject.get(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, 'create'),
],
list: (authorization) => authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'get'),
};
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As we're postponing the Solution specific actions RBAC to a follow up issue, we can rely on Saved Objects as a backing for the feature based RBAC

@gmmorris gmmorris mentioned this pull request Jul 8, 2020
Closed
@gmmorris gmmorris closed this Jul 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Alerting feature controls
2 participants
@gmmorris @kibanamachine