search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.65k stars 8.23k forks source link

Support for composite features #96598

Open legrego opened 3 years ago

legrego commented 3 years ago

The Kibana privilege model is currently centered around two discrete concepts: Kibana Features and Elasticsearch Features.

Broadly speaking, a Kibana Feature is something that is solely within the domain of Kibana - it uses Kibana APIs and services (such as saved objects) in order to fulfill its goals.

An Elasticsearch feature is something that requires cluster or index privileges in order to function -- in other words, these features require us to proxy the end-user's credentials to Elasticsearch, as we cannot have the kibana_system user perform these operations on their behalf.

Examples of Kibana Features include:

Examples of Elasticsearch Features include:

This distinction works fairly well, but we are coming across features that don't fit cleanly into either bucket. For example, the File Upload feature requires: 1) The ability to create index patterns (a Kibana Feature) 2) The ability to create index pipelines (an Elasticsearch Feature) 3) The ability to create indices and index documents (an Elasticsearch Feature)

It would be nice if our feature privilege model could account for these "composite" features, which require both Kibana and Elasticsearch privileges in order to function correctly.

elasticmachine commented 3 years ago

Pinging @elastic/kibana-security (Team:Security)