[ML] Categorization examples privilege check by jgowdyelastic · Pull Request #57375 · elastic/kibana

jgowdyelastic · 2020-02-11T21:13:32Z

Changes the categorization_field_examples endpoint so when it calls _analyse to retrieve the tokens, it does so as the kibana internal user.
Because of this change, the endpoint also now requires the user to have job creation privileges.
The endpoint returns a 403 if this requirement is not met.

Relates to elastic/elasticsearch#51391
cc @droberts195

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2020-02-12T11:14:31Z

Pinging @elastic/ml-ui (:ml)

peteharverson

A typo, but otherwise code LGTM

This is to support the ML categorization wizard. Currently cluster:admin/analyze is only provided with the "manage" cluster privilege, which is an excessive privilege level to provide access to this single feature. It means that the ML categorization wizard only works for extremely highly privileged users. Following this change the Kibana system user will be permitted to run the _analyze endpoint on supplied strings (not on an index). The ML UI will then call the _analyze endpoint as the Kibana system user after first checking that the logged-in user is permitted to create an ML job. This will mean that users with the more reasonable "manage_ml" cluster privilege will be permitted to use the ML categorization wizard. (This is also consistent with the way the ML UI will access _all_ Elasticsearch functionality when the "ML in Spaces" project is completed.) Closes elastic#51391 Relates elastic/kibana#57375

droberts195 · 2020-02-12T11:38:41Z

The corresponding Elasticsearch change is elastic/elasticsearch#52259. Please wait for that to be merged before merging this change.

walterra

LGTM

jgowdyelastic · 2020-02-12T15:41:51Z

retest

kobelb · 2020-02-12T22:36:54Z

As an alternative to doing the privilege check using the _has_privileges API, you can augment the reserved privilege which is assigned to both the machine_learning_admin and machine_learning_user roles and take advantage of the "API Authorization" similar to this example: https://www.elastic.co/guide/en/kibana/current/development-plugin-feature-registration.html#_example_2_dev_tools

Have spoken to @kobelb and have agreed to leave this as is for now as upcoming spaces work will see the replacement of all privilege checks in ML.

This is to support the ML categorization wizard. Currently cluster:admin/analyze is only provided with the "manage" cluster privilege, which is an excessive privilege level to provide access to this single feature. It means that the ML categorization wizard only works for extremely highly privileged users. Following this change the Kibana system user will be permitted to run the _analyze endpoint on supplied strings (not on an index). The ML UI will then call the _analyze endpoint as the Kibana system user after first checking that the logged-in user is permitted to create an ML job. This will mean that users with the more reasonable "manage_ml" cluster privilege will be permitted to use the ML categorization wizard. (This is also consistent with the way the ML UI will access _all_ Elasticsearch functionality when the "ML in Spaces" project is completed.) Closes #51391 Relates elastic/kibana#57375

alvarezmelissa87

LGTM ⚡️

alvarezmelissa87

Latest edits LGTM ⚡️

jgowdyelastic · 2020-02-17T08:45:39Z

@elasticmachine merge upstream

kibanamachine · 2020-02-17T10:29:25Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 2338cec

History

💔 Build #26779 failed d51ffb42cf29199a39e14198f29439cc5713efe5
💔 Build #26759 failed 6ac04589199bb70dd77f9989069fefd73b042f3e
💚 Build #26207 succeeded 2dd82182cefda02c799406e5078090d3ab12356c
💚 Build #26145 succeeded d02c5a3bc5e0b7b1ef1b03958a0aa2f50cebc792
💚 Build #26131 succeeded b49ef18174c3bed37030dee779fb4419626db732

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* [ML] Categorization examples privilege check * adding privileges check to endpoint * fixing typo * moving privilege check to router * removing unused variable * rebasing master * removing comment Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

* [ML] Categorization examples privilege check * adding privileges check to endpoint * fixing typo * moving privilege check to router * removing unused variable * rebasing master * removing comment Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

* [ML] Categorization examples privilege check * adding privileges check to endpoint * fixing typo * moving privilege check to router * removing unused variable * rebasing master * removing comment Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

This is to support the ML categorization wizard. Currently cluster:admin/analyze is only provided with the "manage" cluster privilege, which is an excessive privilege level to provide access to this single feature. It means that the ML categorization wizard only works for extremely highly privileged users. Following this change the Kibana system user will be permitted to run the _analyze endpoint on supplied strings (not on an index). The ML UI will then call the _analyze endpoint as the Kibana system user after first checking that the logged-in user is permitted to create an ML job. This will mean that users with the more reasonable "manage_ml" cluster privilege will be permitted to use the ML categorization wizard. (This is also consistent with the way the ML UI will access _all_ Elasticsearch functionality when the "ML in Spaces" project is completed.) Closes #51391 Relates elastic/kibana#57375

jgowdyelastic force-pushed the categorization-examples-privilege-check branch 2 times, most recently from abfd38c to 9db4c01 Compare February 12, 2020 10:20

jgowdyelastic requested review from alvarezmelissa87, darnautov, peteharverson and walterra February 12, 2020 11:13

jgowdyelastic self-assigned this Feb 12, 2020

jgowdyelastic added :ml Feature:Anomaly Detection ML anomaly detection release_note:enhancement labels Feb 12, 2020

jgowdyelastic added v7.7.0 v8.0.0 labels Feb 12, 2020

jgowdyelastic marked this pull request as ready for review February 12, 2020 11:17

jgowdyelastic requested a review from a team as a code owner February 12, 2020 11:17

peteharverson approved these changes Feb 12, 2020

View reviewed changes

Comment thread x-pack/legacy/plugins/ml/server/models/job_service/new_job/categorization/examples.ts Outdated

droberts195 mentioned this pull request Feb 12, 2020

Add cluster:admin/analyze permission to Kibana system role elastic/elasticsearch#52259

Merged

pheyos mentioned this pull request Feb 12, 2020

[DOCS] Augments list of machine learning privileges elastic/stack-docs#824

Merged

walterra approved these changes Feb 12, 2020

View reviewed changes

kobelb reviewed Feb 12, 2020

View reviewed changes

alvarezmelissa87 reviewed Feb 13, 2020

View reviewed changes

jgowdyelastic force-pushed the categorization-examples-privilege-check branch from 2dd8218 to fd5e62a Compare February 14, 2020 08:49

alvarezmelissa87 approved these changes Feb 14, 2020

View reviewed changes

jgowdyelastic added 2 commits February 14, 2020 16:01

[ML] Categorization examples privilege check

5a08cb6

adding privileges check to endpoint

48f014d

jgowdyelastic added 5 commits February 14, 2020 16:01

fixing typo

683ddf4

moving privilege check to router

70c82b2

removing unused variable

4f5ae0e

rebasing master

871d547

removing comment

af4da4f

jgowdyelastic force-pushed the categorization-examples-privilege-check branch from d51ffb4 to af4da4f Compare February 14, 2020 16:02

Merge branch 'master' into categorization-examples-privilege-check

2338cec

jgowdyelastic merged commit 5452400 into elastic:master Feb 17, 2020

jgowdyelastic deleted the categorization-examples-privilege-check branch February 17, 2020 10:47

jgowdyelastic mentioned this pull request Feb 17, 2020

[7.x] [ML] Categorization examples privilege check (#57375) #57785

Merged

pheyos mentioned this pull request Mar 24, 2020

[ML] Functional tests - adjust permissions for ml_ui_extras role #61055

Merged

Navigation Menu

Repository navigation

[ML] Categorization examples privilege check - #57375

[ML] Categorization examples privilege check#57375
jgowdyelastic merged 8 commits into
elastic:masterfrom
jgowdyelastic:categorization-examples-privilege-check

jgowdyelastic commented Feb 11, 2020 •

edited

Loading

Uh oh!

elasticmachine commented Feb 12, 2020

Uh oh!

peteharverson left a comment

Uh oh!

Uh oh!

droberts195 commented Feb 12, 2020

Uh oh!

walterra left a comment

Uh oh!

jgowdyelastic commented Feb 12, 2020

Uh oh!

kobelb Feb 12, 2020

Uh oh!

jgowdyelastic Feb 13, 2020

Uh oh!

alvarezmelissa87 left a comment

Uh oh!

alvarezmelissa87 left a comment

Uh oh!

jgowdyelastic commented Feb 17, 2020

Uh oh!

kibanamachine commented Feb 17, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

jgowdyelastic commented Feb 11, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

For maintainers

Uh oh!

elasticmachine commented Feb 12, 2020

Uh oh!

peteharverson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

droberts195 commented Feb 12, 2020

Uh oh!

walterra left a comment

Choose a reason for hiding this comment

Uh oh!

jgowdyelastic commented Feb 12, 2020

Uh oh!

kobelb Feb 12, 2020

Choose a reason for hiding this comment

Uh oh!

jgowdyelastic Feb 13, 2020

Choose a reason for hiding this comment

Uh oh!

alvarezmelissa87 left a comment

Choose a reason for hiding this comment

Uh oh!

alvarezmelissa87 left a comment

Choose a reason for hiding this comment

Uh oh!

jgowdyelastic commented Feb 17, 2020

Uh oh!

kibanamachine commented Feb 17, 2020

💚 Build Succeeded

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

jgowdyelastic commented Feb 11, 2020 •

edited

Loading