Granular Permissions for Advanced Settings in Kibana Plugins

neptunian commented 3 months ago

Currently, advanced settings in Kibana are controlled by a global permission. Users assigned to a custom role with “all” access to specific plugins (e.g., APM, Infra, AI Assistant Management, Profiling) cannot save settings registered through uiSettings within their respective apps without the “Advanced Settings” permission. It seems that plugin authors may not be aware of the dependency on the “Advanced Settings” permission, as there is no UX indicating the need for this permission and the failures aren't caught or properly handled. This creates a confusing UX where changes appear to be saved (sometimes even showing success messages) but are not actually applied, with no error feedback.

A workaround is to give the user the Advanced Settings privilege. However, this is too broad for cases where the user should only have access to settings for a specific app.

Should plugin authors avoid using Advanced Settings if they want users with "all" access to their application to be able to modify settings? Or is it possible to add some granularity to advanced settings, where if a user has "all" access to a specific plugin, they also get access to Advanced Settings related to that plugin?

elasticmachine commented 3 months ago

Pinging @elastic/appex-sharedux (Team:SharedUX)

elasticmachine commented 3 months ago

Pinging @elastic/kibana-security (Team:Security)

Dosant commented 3 months ago

@neptunian, thank you for brining this up. Could you please point us to some specific examples in code and UI where uiSettings are updated like this? Would like to explore

neptunian commented 3 months ago

Sure! I believe all of these cases are using the hook, useEditableSettings. I'm changing it in https://github.com/elastic/kibana/pull/189920 to catch errors (like 403) so we can inform users.

APM

Create a custom role for user with "all" APM privilege
login as a user assigned to this role and navigate to APM settings (app/apm/settings/general-settings)
trying to update settings results in page refresh and no settings saved
After https://github.com/elastic/kibana/pull/189920 is merged, a toast error will be displayed saying request failed

Obs AI Assistant

Same as above, but improving with error messaging and checks in https://github.com/elastic/kibana/pull/189920

Infra

Create a custom role for user with "all" Infra privilege
login as a user assigned to this role and navigate to Infra settings (/app/metrics/settings)
Save one of the settings under the "Features" section
Save fails but successful toast message displays

Profiling

You need data to access profiling settings so use edge if you have access. I also can't see the privilege in my local kibana for some reason so use edge kibana.
Create a custom role for user with "all" Universal Profiling privilege and "all" Fleet privilege
add index privilege read to .profiling-*
login as a user assigned to this role and navigate to profiling settings app/profiling/settings
Save a setting fails with no notification

elastic / kibana