[BUG] Privileges are incorrectly evaluated in case of shrink, clone and split index operations

[kt-eliatra]

What is the bug?
A forbidden response is returned for shrink, clone and split operations even when user has all required permissions to the source index.
In addition, it seems that permissions to create the target index are not verified at all.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Define user, role, and role mapping, e.g.:

internal_users.yml
    test-user:
      hash: ...
roles.yml
    test-user-role:
      index_permissions:
        - index_patterns:
            - 'source-index'
          allowed_actions:
            - 'indices:admin/resize'
            - 'indices:monitor/stats'
roles_mapping.yml
    test-user-role:
      reserved: false
      users:
      - "test-user"

2. Upload configuration
3. Create source index, e.g.:

curl --location --request PUT 'https://localhost:9200/source-index' \
--header 'Authorization: Basic ...' \
--header 'Content-Type: application/json' \
--data-raw '{
  "settings": {
    "index": {
      "blocks.write": true
    }
  }
}'

4. Try to execute shrink/split/clone operation as the user created in previous step, e.g.:

curl --location --request PUT 'https://localhost:9200/source-index/_clone/target-index' \
--header 'Authorization: Basic ...'

5. Response status code is equal to 403, body says that no permissions for [indices:admin/resize] and User ....
6. Update role setup & upload configuration, e.g.

roles.yml
    test-user-role:
      index_permissions:
        - index_patterns:
            - '*'
          allowed_actions:
            - 'indices:admin/resize'
        - index_patterns:
            - 'source-index'
          allowed_actions:
            - 'indices:monitor/stats'

7. Try to execute shrink/split/clone operation as the user created in previous step, e.g.:

curl --location --request PUT 'https://localhost:9200/source-index/_clone/target-index' \
--header 'Authorization: Basic ...'

8. Response status code is equal to 200, target index exists

What is the expected behavior?
It should be possible to grant the 'indices:admin/resize' permission to selected index/indices.
It should be verified whether the user has the right to create the target index or not.

What is your host/environment?

• OS: Linux Mint
• Version: 20.3
• Plugins: Security Plugin 2.3.0.0

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
The problem was noticed during writing integration tests for index operations.

[vinayak15]

[Triaged] @cliu123 Can you please help to look into this issue ?

[cliu123]

@kt-eliatra test-user-role grants permissions to source-index index, but the request in step #4 is against target-index index. Would you please check if there are any things misconfigured?

[kt-eliatra]

@kt-eliatra test-user-role grants permissions to source-index index, but the request in step #4 is against target-index index. Would you please check if there are any things misconfigured?

403 is returned even if the role is configured like this:

test-user-role:
  index_permissions:
    - index_patterns:
        - 'source-index'
      allowed_actions:
        - 'indices:admin/resize'
        - 'indices:monitor/stats'
    - index_patterns:
        - 'target-index'
      allowed_actions:
        - '*'

[MaciejMierzwa]

Hi @derek-ho are you still looking into it? Could I take over?

[MaciejMierzwa]

Here's PR: #3716
Note: there are some ci fails, but those are not connected to the fix I made. It's some problems with port allocation during test execution and other similar things