Skip to content

Conversation

@n1v0lg
Copy link
Contributor

@n1v0lg n1v0lg commented Oct 9, 2024

Backports #114337 with following commits:

This PR default-enables cluster-state role mappings as the first part of the mitigation for a regression in ECK introduced by #107410. 

Prior to this PR, cluster-state role mappings were written to cluster-state, but not read from it. 

With this PR, cluster-state role mappings will be read and used to assign roles to users, i.e. in user role resolution. 

However, they will not be included in the output of the [Get role mappings API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role-mapping.html) yet. Exposing them via API is a target for a follow-up fix.

Relates: ES-9628
Supersedes: #113900
@n1v0lg n1v0lg added >bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) backport Team:Security Meta label for security team labels Oct 9, 2024
@n1v0lg n1v0lg self-assigned this Oct 9, 2024
@n1v0lg n1v0lg added the v8.16.0 label Oct 9, 2024
@n1v0lg n1v0lg marked this pull request as ready for review October 9, 2024 15:17
@n1v0lg n1v0lg changed the title Default enable cluster state role mapper (#114337) [8.16] Default enable cluster state role mapper (#114337) Oct 9, 2024
@n1v0lg n1v0lg added the auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) label Oct 9, 2024
@n1v0lg
Copy link
Contributor Author

n1v0lg commented Oct 10, 2024

@elasticmachine update branch

@n1v0lg
Copy link
Contributor Author

n1v0lg commented Oct 10, 2024

@elasticmachine update branch

@n1v0lg
Copy link
Contributor Author

n1v0lg commented Oct 10, 2024

@elasticmachine update branch

@n1v0lg
Copy link
Contributor Author

n1v0lg commented Oct 11, 2024

@elasticmachine update branch

@n1v0lg n1v0lg merged commit 7261c29 into 8.x Oct 11, 2024
19 of 21 checks passed
@n1v0lg n1v0lg deleted the 8-x-backport-114337 branch October 11, 2024 10:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) backport >bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team v8.16.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants