[BUG] Patch rolesmapping API doesnt actually add new backendroles/users

[Its-Ankush]

What is the bug? Using the Patch role mapping API, it doesnt actually add backend_roles or users. The API erases/replaces everything and adds that one role which you mention with the API

How can one reproduce the bug? Steps to reproduce the behavior:

1. Go to Security > Roles > manage_snapshots in the opensearch dashboards
2. Click on Mapped users > Manage mapping > Backend roles
3. Add 2 random backend roles like this -

4. Run the API to add a new backend role like this -

curl -k -u "username":"password" -XPATCH "https://IP:9200/_plugins/_security/api/rolesmapping/manage_snapshots" -H 'Content-Type:application/json' -d '[{"op":"add","path":"/backend_roles","value":["ghi"]}]'

5. Result

What is the expected behavior?

The same behaviour is for "op": "replace/add" and the backend roles are always erased and then added.

The ask is - to actually allow adding and stop erasing the existing backend roles/users. This will eliminate an extra GET call to fetch the pre-exisitng backend roles/users.

What is your host/environment?

• OS: Mac OS
• Version: Opensearch 2.14.0
• Plugins : opensearch-security 2.14.0.0

Do you have any screenshots? Yes, attached above

Do you have any additional context? n/a

[scrawfor99]

[Triage] Hi @Its-Ankush, thank you for filing this issue. OpenSearch follows the JSON Patch RFC (information for which can be found here: https://jsonpatch.com/). As a result, the behavior of replacing the entire config field is expected. Going to close this issue as this is not a Bug but the intended behavior.

[Its-Ankush]

Just in case if anyone wants to achieve this -

https://forum.opensearch.org/t/older-user-mappings-are-getting-wiped-out-on-using-api-to-add-new-role-mappings/12629/4

Change this

curl -k -u "username":"password" -XPATCH "https://IP:9200/_plugins/_security/api/rolesmapping/manage_snapshots" -H 'Content-Type:application/json' -d '[{"op":"add","path":"/backend_roles","value":["ghi"]}]'

To this

curl -k -u "username":"password" -XPATCH "https://IP:9200/_plugins/_security/api/rolesmapping/manage_snapshots" -H 'Content-Type:application/json' -d '[{"op":"add","path":"/backend_roles/-","value":"ghi"}]'