Open dbanshee opened 8 months ago
[Triage] Hi @dbanshee thank you for filing this issue. Someone will take a closer look at your scenario and reach out with any questions.
In the meantime, @dbanshee could you please confirm whether you are still running into trouble with this issue?
[Triage] Hi @dbanshee thank you for filing this issue. Someone will take a closer look at your scenario and reach out with any questions.
In the meantime, @dbanshee could you please confirm whether you are still running into trouble with this issue?
I managed to avoid the error by not using a custom field for the roles and using user.roles
, modifying my token generation.
[Triage] Hi @dbanshee, I am happy to hear that you found a workaround for this. To address this we can at least add some documentation about this.
We can also look into further supporting the custom attribute setups similar to yours as a feature enhancement.
We have also run into this. I’m happy to see there’s already a ticket! In order to use values from a JWT as an array in the DLS query, you have to have the JWT field be a string of comma separated values with escaped quotes around them.. So instead of having in the JWT “opensearch_roles”: [ “A”, “B” ] it has to be “opensearch_roles”: “\”A\”,\”B\”” and then in DLS query "terms": { "group_permissions.keyword": [ ${attr.jwt.opensearch_roles} ] }
This makes the JWT ugly and much less useful in other contexts. It would definitely be good for this plugin to be able to utilize arrays.
Is there a timeline for this fix at all?
Describe the bug
he parsing of a JWT token field in a Document Leven Security role is not being done correctly.
Being this field a comma-separated, quoted list of user backend roles. Internal OpenSearch parsing appears to lost list item string quotes.
JWT field:
DLS on Role:
Runtime Error:
Related component
Other
To Reproduce
Being this field a comma-separated, quoted list of user backend roles.
Containing my JWT Token
opensearch_roles
a list of quoted stringsI'm trying to use a Doc Level Security (DLS) using this
opensearch_roles
files. But I encountered strange behaviour.Acording to documentation
https://opensearch.org/docs/latest/security/access-control/document-level-security/#parameter-substitution
I can use a custom JWT field as
I defined my role as
Additionally this role is mapped with a backend_role to match this role at searching stage.
Finally executing a search:
Examining opensearch log i found this error.
In particular:
The parser sustitution appears to has lost the string quotes on JWT list elements.
Another test including '[]' on DLS doesn't work either. Only wrap the previous value on '[...]'
Expected behavior
DLS use the custom list attribute to filter de documents on search.
Additional Details
Plugins
Host/Environment (please complete the following information):
Running Opensearch on Docker environment.