search

opensearch-project / security-dashboards-plugin

🔐 Manage your internal users, roles, access control, and audit logs from OpenSearch Dashboards
https://opensearch.org/docs/latest/security-plugin/index/
Apache License 2.0
66 stars 148 forks source link

[FEATURE] [RFC] Feature flag/Split security dashboards plugin into two plugins #1958

Closed derek-ho closed 2 weeks ago

derek-ho commented 1 month ago

Is your feature request related to a problem? It seems to me that security dashboards plugin is actually two plugins - one backend plugin that manages the auth and sessions within OpenSearch Dashboards/security plugin, and one frontend plugin that is the face of security admin backend APIs, such as updating roles, users, and rolesmappings. Ideally these should be two separate plugins, since there are two responsibilities here that are not tightly coupled (but which become tightly coupled by being bundled into one plugin). This RFC is to call out whether this is appetite for this splitting of responsibilities. Are there use cases where folks using OS/OSD would want to manage sessions and auth related to OSD separately?

What solution would you like? A clear separation of concerns between auth/sessions of OSD and security backend APIs.

What alternatives have you considered? Option A: feature flag the functionality of auth/session management Option B: split the plugin into two parts - one that manages the security UI pages corresponding to security backend plugin, and one plugin that handles the auth/session of OpenSearch Dashboards

cwperks commented 1 month ago

@derek-ho The security-dashboards-plugin has multiple responsibilities, but I disagree that its tightly coupled. Whichever plugin manages the session needs to be aware of the same security model that the pages in the security-dashboards-plugin reveal. I think of the responsibilities like this:

  1. Session Management (Log in screen, log out, cookie management and user info) - These features are required for the security dashboards plugin to have a functioning instance of OSD coupled to a cluster running with the security plugin enabled
  2. Security Admin Pages - This can be thought of as optional and really a convenience for configuring security through dashboards. An admin can always directly use the security APIs or securityadmin to manage security in the cluster.

For 2), I suppose you can think of it like an admin-portal plugin. In order for OSD to function with an OpenSearch backend with the security plugin installed 1) is a requirement and 2) is for convenience.

derek-ho commented 1 month ago

Thanks for the response @cwperks ! I guess I was getting more at the fact that it is tightly coupled because it is bundled as part of the same plugin. Another use case in which this might be useful is if in multiple datasources, and users want to configure audit logging, but do not want the other features of the security plugin. We should still allow users to turn off the cookies/session management since it may not apply in that case.

derek-ho commented 1 month ago

[Triage] Looks like there is not any comments on this so will not mark it as triaged just yet. We can review this in next weeks meeting and close it if there is no need for it.

scrawfor99 commented 1 month ago

@derek-ho would you provide an update on how you would like this issue to be addressed at this point? Thank you.