Skip to content

Expose ability to deny ('except') access to fields via FLS - #26472

Merged
legrego merged 12 commits into
elastic:masterfrom
legrego:security/fls-except-fields
Apr 16, 2019
Merged

Expose ability to deny ('except') access to fields via FLS#26472
legrego merged 12 commits into
elastic:masterfrom
legrego:security/fls-except-fields

Conversation

@legrego

@legrego legrego commented Nov 30, 2018 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

This adds a "Denied Fields" input control to the Index Privileges section of the Role Management screen. This allows users to specify fields which should be denied access via FLS.

This does not implement any new security controls, but rather exposes the existing field_security.except functionality of the ES Roles API.

Fixes #17951

Proposed UI

image

image

i18n test

image

TODO

  • Design review
  • Testing

"Release note: Deny access to specific fields using Field-Level Security. This was always available via the Elasticsearch APIs, but was missing from Kibana's Role Management UI"

@legrego legrego added WIP Work in progress Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// Feature:Users/Roles/API Keys labels Nov 30, 2018
@elasticmachine

elasticmachine commented Nov 30, 2018

Copy link
Copy Markdown
Contributor

Pinging @elastic/kibana-security

@legrego

legrego commented Nov 30, 2018

Copy link
Copy Markdown
Member Author

cc @cchaos / @AlonaNadler - no rush on this, I just wanted to make you aware of the proposed UI change, if you have any feedback.

@elasticmachine

elasticmachine commented Nov 30, 2018

Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine

elasticmachine commented Dec 3, 2018

Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@cchaos

cchaos commented Dec 3, 2018

Copy link
Copy Markdown
Contributor

My only worry is that those fields may be unnecessarily squished now by adding a fourth field to that row. May want to consider moving the form to a flyout and displaying a summary in the page.

@AlonaNadler

AlonaNadler commented Dec 3, 2018 •
edited
Loading

Copy link
Copy Markdown

@legrego is this a new ES capability or a way to ease the UI for FLS?
Denied fields is similar to restricting fields?
What happens when I have a conflict? e.g. grant fields for field A and denied field A ?
Does it provide the ability to grant permission to all the fields except for field A or the opposite restrict all fields except field A

@legrego

legrego commented Dec 3, 2018

Copy link
Copy Markdown
Member Author

@cchaos I agree it is a bit squished right now. Moving to a flyout is doable, but I'm worried what that might look like for users without DLS/FLS enabled. If DLS/FLS is not enabled, then then all users will see is the Indices and Privileges dropdowns. They won't have Granted fields, Denied fields, or the Grant read privileges to selected documents switch/textarea.

We could conditionally do the flyout only if DLS/FLS is enabled, but then the documentation/screenshots for this screen might look inconsistent for some users who don't have the same feature set enabled.

@AlonaNadler this isn't new functionality - it's existed in ES for quite a while, but the Kibana UI was never updated to support it. I'm not sure when ES first introduced this, but the issue for the Kibana UI has been opened since February 2018.

@cchaos

cchaos commented Dec 4, 2018

Copy link
Copy Markdown
Contributor

@legrego So the optional fields in that line only show for a particular group of people?

How about, then, if we add another toggle above the current one that is something like "Grant granular privileges to fields" and when toggled on will show those two fields below.

@legrego

legrego commented Dec 4, 2018

Copy link
Copy Markdown
Member Author

@legrego So the optional fields in that line only show for a particular group of people?

Yep, they are only available with a Platinum license.

How about, then, if we add another toggle above the current one that is something like "Grant granular privileges to fields" and when toggled on will show those two fields below.

I like this approach. I'll give it a shot and post a screenshot so we can all see what it looks like.

@legrego
legrego requested a review from a team as a code owner April 4, 2019 12:19
@legrego

legrego commented Apr 4, 2019

Copy link
Copy Markdown
Member Author

I updated the screenshots above to reflect @cchaos's suggestions. The FLS fields are now hidden behind a toggle, consistent with the DLS fields.

@elasticmachine

elasticmachine commented Apr 4, 2019

Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine

elasticmachine commented Apr 4, 2019

Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine

elasticmachine commented Apr 4, 2019

Copy link
Copy Markdown
Contributor

💔 Build Failed

@elasticmachine

elasticmachine commented Apr 4, 2019

Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@elasticmachine

elasticmachine commented Apr 15, 2019

Copy link
Copy Markdown
Contributor

💔 Build Failed

@legrego legrego removed the WIP Work in progress label Apr 16, 2019
@legrego legrego changed the title [WIP] - Expose ability to deny ('except') access to fields via FLS Expose ability to deny ('except') access to fields via FLS Apr 16, 2019
@elasticmachine

elasticmachine commented Apr 16, 2019

Copy link
Copy Markdown
Contributor

💚 Build Succeeded

@legrego
legrego requested a review from kobelb April 16, 2019 15:18
@legrego legrego added the review label Apr 16, 2019
@legrego
legrego merged commit 9bc7bc3 into elastic:master Apr 16, 2019
@legrego
legrego deleted the security/fls-except-fields branch April 16, 2019 18:56
@legrego legrego removed the review label Apr 16, 2019
@legrego legrego mentioned this pull request Apr 16, 2019
Merged
legrego added a commit to legrego/kibana that referenced this pull request Apr 16, 2019
@legrego
Expose ability to deny ('except') access to fields via FLS (elastic#2…
860ebad 
…6472)

* expose ability to deny ('except')  access to fields via FLS

* expose ability to deny ('except')  access to fields via FLS

* Moves FLS fields behind a switch to be consistent with DLS fields

* remove unused import

* fix security page object

* remove unused code

* remove unused translations
legrego added a commit that referenced this pull request Apr 16, 2019
@legrego
[7.x] Expose ability to deny ('except') access to fields via FLS (#26472
4f574e1 
) (#35180)

Backports the following commits to 7.x:
 - Expose ability to deny ('except')  access to fields via FLS  (#26472)
@legrego legrego mentioned this pull request Aug 26, 2019
Closed
patrykkopycinski pushed a commit to patrykkopycinski/kibana that referenced this pull request May 6, 2026
@legrego
Expose ability to deny ('except') access to fields via FLS (elastic#2…
e1c541e 
…6472)

* expose ability to deny ('except')  access to fields via FLS

* expose ability to deny ('except')  access to fields via FLS

* Moves FLS fields behind a switch to be consistent with DLS fields

* remove unused import

* fix security page object

* remove unused code

* remove unused translations
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kobelb kobelb kobelb approved these changes

Assignees

No one assigned

Labels

Feature:Users/Roles/API Keys release_note:enhancement Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// v7.2.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support for "except" fields in role management UI

5 participants

@legrego @elasticmachine @cchaos @AlonaNadler @kobelb