Add 'create_doc' index privilege #45806
Conversation
`append_only` index privilege allows users to index new documents but not update existing documents. Wherever the op-type is `index` and `_id` is specified for the document to be indexed, we would deny access even if the document does not exist. We do not know in authz service whether this document exists or not.
bizybot
added
discuss
:Security/Authorization
|
Pinging @elastic/es-security |
|
@bizybot Is there anything in particular that you wanted to be discussed with the rest of the team? Some of us got curious about the limitation you mentioned, do we understand it correctly that index requests with an id ( |
I put this as
Yes, the teams understanding is correct. I wanted to make sure that the other teams (Beats/Logstash) know about this behavior when using this privilege. Beats informed that they do explicitly set Thank you for your feedback. |
...ugin/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationService.java
Outdated
Show resolved
Hide resolved
bizybot
changed the title
|
Sorry, I have to ask though, why is it |
Yes, makes sense, I was focused more on the action. I will update it. Thank you. |
bizybot
changed the title
|
@elasticmachine run elasticsearch-ci/bwc |
1 similar comment
|
@elasticmachine run elasticsearch-ci/bwc |
...core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java
Outdated
Show resolved
Hide resolved
...core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java
Outdated
Show resolved
Hide resolved
|
@elasticmachine run elasticsearch-ci/packaging-sample |
Use case: User with `create_doc` index privilege will be allowed to only index new documents either via Index API or Bulk API. There are two cases that we need to think: - **User indexing a new document without specifying an Id.** For this ES auto generates an Id and now ES version 7.5.0 onwards defaults to `op_type` `create` we just need to authorize on the `op_type`. - **User indexing a new document with an Id.** This is problematic as we do not know whether a document with Id exists or not. If the `op_type` is `create` then we can assume the user is trying to add a document, if it exists it is going to throw an error from the index engine. Given these both cases, we can safely authorize based on the `op_type` value. If the value is `create` then the user with `create_doc` privilege is authorized to index new documents. In the `AuthorizationService` when authorizing a bulk request, we check the implied action. This code changes that to append the `:op_type/index` or `:op_type/create` to indicate the implied index action.
Use case: User with `create_doc` index privilege will be allowed to only index new documents either via Index API or Bulk API. There are two cases that we need to think: - **User indexing a new document without specifying an Id.** For this ES auto generates an Id and now ES version 7.5.0 onwards defaults to `op_type` `create` we just need to authorize on the `op_type`. - **User indexing a new document with an Id.** This is problematic as we do not know whether a document with Id exists or not. If the `op_type` is `create` then we can assume the user is trying to add a document, if it exists it is going to throw an error from the index engine. Given these both cases, we can safely authorize based on the `op_type` value. If the value is `create` then the user with `create_doc` privilege is authorized to index new documents. In the `AuthorizationService` when authorizing a bulk request, we check the implied action. This code changes that to append the `:op_type/index` or `:op_type/create` to indicate the implied index action.
This commit adds documentation for new index privilege create_doc which only allows indexing of new documents but no updates to existing documents via Index or Bulk APIs. Relates: #45806
This commit adds documentation for new index privilege create_doc which only allows indexing of new documents but no updates to existing documents via Index or Bulk APIs. Relates: elastic#45806
This commit adds documentation for new index privilege create_doc which only allows indexing of new documents but no updates to existing documents via Index or Bulk APIs. Relates: #45806
Updates the writer role documentation based on #13847 and #13848. Also corrects some mistakes. 1. Changes `read from` to the correct `write to` (Beats does not read from indices). 2. Setting `setup.template.enabled` to `false` is no longer necessary after #13847. 3. Setting `setup.ilm.overwrite` to `false` is unnecessary if `setup.ilm.check_exists` is already `false` (even today). 4. Adds a note about only `monitor` and `create_doc` being always necessary, explicitly calling out the most secure configuration (following #13847 and #13848). 5. Correct what `monitor` is for: It's for checking things like cluster version and license, not "sending monitor info". 6. Replaces `manage_pipeline` with the read-only `cluster:admin/ingest/pipeline/get`. Unfortunately, there is no read-only cluster role for pipelines, so it requires this privilege. But better than the very permissive `manage_pipeline` that allows changing any pipeline. 7. Changes `index` to the more restrictive, append-only `create_doc` (introduced in elastic/elasticsearch#45806).
Use case:
User with
create_docindex privilege will be allowed to only index new documentseither via Index API or Bulk API.
There are two cases that we need to think:
For this ES auto generates an Id and now ES version 7.5.0 onwards defaults to
op_typecreatewe just need to authorize on theop_type.This is problematic as we do not know whether a document with Id exists or not.
If the
op_typeiscreatethen we can assume the user is trying to add a document, if it exists it is going to throw an error from the index engine.Given these both cases, we can safely authorize based on the
op_typevalue. If the value iscreatethen the user withcreate_docprivilege is authorized to index new documents.In the
AuthorizationServicewhen authorizing a bulk request, we check the implied action.This code changes that to append the
:op_type/indexor:op_type/createto indicate the implied index action.