[BUG] Aliases and Rollover APIs fail with permission denied when user role is restricted based on index pattern

[ronniepg]

What is the bug? Aliases and Rollover index APIs fail with permission denied when user role is restricted based on index pattern

How can one reproduce the bug? Steps to reproduce the behavior:

1. Create an internal role like so curl -XPUT https://localhost:9200/_plugins/_security/api/roles/sem-role -H 'Content-Type: application/json' -d' { "cluster_permissions": [ "cluster_monitor" ], "index_permissions": [{ "index_patterns": [ "sem*" ], "allowed_actions" : ["*"] }] }
2. Create a user with this role curl -XPUT https://localhost:9200/_plugins/_security/api/internalusers/sem-user -H 'Content-Type: application/json' -d' { "password": "######", "opendistro_security_roles": ["sem-role"] } '
3. Following APIs fail
   • Get aliases/alias, e.g. curl https://localhost:9200/_cat/aliases/sem*?pretty -u sem-user fails with no permissions for [indices:admin/aliases/get]
   • Index rollover, e.g. # curl -u sem-user -X POST "https://localhost:9200/sem-source1/_rollover?pretty" fails with no permissions for [indices:admin/rollover]

These APIs work fine when the index pattern on the role is changed to " " instead of " sem "

What is the expected behavior?

• Get aliases/alias - should fetch aliases for index patterns the user has access to instead of throwing error
• Rollover should work fine given the user has permission to access the source index and create the target index based on the allowed index patterns for the user.

What is your host/environment? OpenSearch 1.2.4 with opensearch-security plugin enabled on OEL7

Do you have any screenshots? NA

Do you have any additional context?

• https://forum.opensearch.org/t/unable-to-set-permissions-for-put-index-template/4863/12
• https://forum.opensearch.org/t/internal-user-not-able-to-perform-operations-based-on-internal-role/9529 and https://forum.opensearch.org/t/internal-user-not-able-to-perform-operations-based-on-internal-role/9529/8

[DarshitChanpura]

[Triage] Thank you for filing this. We'd love to review a pull request.

[stephen-crawford]

[Triage] Keeping this issue in the backlog as it seems like a valid issue. A PR introducing a fix would happily be reviewed.

[bastbnl]

Issue exists in 2.9.0