elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.62k stars 8.22k forks source link

[Infra UI] Error insufficient privileges when visiting Infra app without ML privilege #189213

Open neptunian opened 3 months ago

neptunian commented 3 months ago
  1. Create a user with elasticsearch index privileges: indices: metrics-, metricbeat- privileges: 'read', 'view_index_metadata' and kibana privileges: Infrastructure
  2. Navigate to Infra app and you will get this toast. It only seems to appear on Inventory.
  3. Adjust user to have Machine Learning kibana privilege and the toast goes away.

Solution: we probably should not show the link for Anomaly detection or be making calls if user has insufficient privileges. I think this is happening because we show anomalies in the timeline view at the bottom of the page ("show history" drawer).

Screenshot 2024-07-25 at 1 19 35 PM
elasticmachine commented 3 months ago

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

crespocarlos commented 2 months ago

@roshan-elastic @smith could we prioritize this?

roshan-elastic commented 2 months ago

Hey @crespocarlos - do you think this is a newly introduced bug or something that will have happened for years?

crespocarlos commented 2 months ago

This is an old issue. Probably as old as the ML feature introduction to Infra.

roshan-elastic commented 2 months ago

Cool cheers @crespocarlos - that helps. I've set it with a low priority for now. I don't think we'll be working on this for a while

roshan-elastic commented 2 months ago

Question @smith - do you know if there is a push to deal with RBAC issues?

Carlos has sent a group of them across and I'm wondering whether there's anyone asking us to fix these soon?

Looking at them, they seem like long-standing issues so I don't feel like they're a priority right now.

smith commented 2 months ago

@roshan-elastic there's an internal meta-issue for auditing permissions behavior to ensure things are working as intended on Serverless. Carlos is putting these related issues together so we can prioritize them as is required. I don't think there's an urgency to have every bug fixed by a specific date, but we want to make sure we know where the known issues are first.

crespocarlos commented 2 months ago

This also happens with if Analytics is disabled on the Space's feature visibility.

Image