search

elasticfence / elasticsearch-http-user-auth

HTTP Basic Authentication and IP ACL plugin for Elasticsearch :key: (UNMAINTAINED)
http://qxip.net
148 stars 32 forks source link

Add read/write permission #7

Open marfago opened 8 years ago

marfago commented 8 years ago

HI,

It would be nice to add a read-only permission to single indexes.

ryanlutgen commented 7 years ago

Old request, but I decided to look into it in some off time that I had. I have a PR up on my fork with barebones rights implemented: https://github.com/ryanlutgen/elasticsearch-http-user-auth/pull/3 To try it out I created a user, assigned an index permission, created an index with root, and did requests with my created user when altering the rights and it works properly. I would appreciate anyone else testing to see if it works.

Essentially it alters how index permissions are stored inside the index that Elasticfence manages to include nested permissions. e.g. for an index filter, it will have a HashMap for read/write/delete rights. When a user issues a request, it references these rights and compares to the request type. In more specific code terms, I changed the data structure housing the permissions from a set to a nested HashMap.

@lmangani Since this alters the behavior of the plugin significantly and requires people to redo their user creation, I am unsure how we should version this. It makes no sense from a traditional versioning standpoint to do 5.1.1.1, but I don't know of any other alternative without stepping on the toes of Elasticsearch's version numbers.

Globegitter commented 7 years ago

@ryanlutgen this is great work and would be great to have merged in. There are only 3 alternative I can think off: Create a new plugin (might make sense, with this extra feature it could probably be called 'elasticsearch-http-user-access-control' or something similar), just support this for newer versions of elasticsearch (e.g. 5.2+), or as you proposed add 5.1.1.1. Or would it be possible maybe to have 5.1.1-v2.0 to have the '-v2.0' as an independent version number of the plugin?

I don't think any of the solutions are particularly elegant and this seems to me to be a problem of elasticsearch requiring this. And I guess they went with such a scheme to push people to have updated versions of their plugins only work with the latest version of kibana/es.

I think it doesn't really matter what you pick as long as there is a mention in the README about it. Either way having this feature merged in would be great.

lmangani commented 7 years ago

@ryanlutgen future with no compromises. please send and PR and we'll figure how to reflect in docs & co?