Failure Store Access Authorization #123986

n1v0lg · 2025-03-04T11:17:05Z

This PR implements authorization logic for failure store access. It builds on #122715.

Access to the failure store is granted by two privileges: read_failure_store and manage_failure_store. Either of these privileges lets a user access a failure store via the ::failures selector, as well as access its backing failure indices. read_failure_store grants read access (for example to search documents in a failure store), manage_failure_store grants access to write operations, such as rollover. Users with only read or manage on a data stream do not get failure store access. Vice versa, users with read_failure_store and manage_failure_store do not get access to regular data in a data stream.

The PR implements this by making authorization logic selector-aware. It involves two main changes:

Index permission groups now compare the selector under which an index resource is accessed to the selector associated with the group.
The AuthorizedIndices interface likewise uses selectors to decide which indices to treat as authorized. This part of the change requires a sizable refactor and changes to the interface.

The high-level behavior for selector-aware search is as follows:

For a user with read_failure_store over data stream logs:

POST /logs::failures/_search returns the documents in the failure store.
POST /logs/_search returns a 403.
POST /logs/_search?ignore_unavailable=true and POST /*/_search return an empty result.

Similarly, for a user with read over data stream logs:

POST /logs::failures/_search returns a 403.
POST /logs/_search returns documents in the data stream.
POST /logs::failures/_search?ignore_unavailable=true and POST /*::failures/_search return an empty result.

A user with both read and read_failure_store over data stream logs gets access to both POST /logs::failures/_search and POST /logs/_search.

The index privilege all automatically grants access to both data and the failures store, as well as all hypothetical future selectors.

Resolves: ES-10873

…g/elasticsearch into read-failure-store-privilege-authz

n1v0lg · 2025-03-18T11:26:05Z

docs/changelog/123986.yaml

@@ -0,0 +1,5 @@
+pr: 123986
+summary: Failure Store Access Authorization


Eh, actually I'll remove this and turn this into a non-issue. There are follow ups to complete this and besides the failure store itself isn't available yet so it's not really an enhancement.

slobodanadamovic

LGTM This turned out pretty neat! Nice job on integration tests. 👍

I've left couple of optional suggestions and a few non-blocking questions. Two main questions that I think we should discuss (and optionally address in the followup) are:

Should read_failure_store include the same automaton as read? I think we can drop the indices:admin/resolve/cluster since CCS/CCR are not supported in the MVP.
Do we want to allow that having read_failure_store over .fs* grants read access to failure store backing indices (just like read)? In theory we could support it.

slobodanadamovic · 2025-03-17T16:17:43Z

server/src/test/java/org/elasticsearch/cluster/metadata/IndexAbstractionResolverTests.java

        // * Indices don't have failure components so the failure component is not visible

        assertThat(isIndexVisible("data-stream1", null), is(true));
-        assertThat(isIndexVisible("data-stream1", "*"), is(true));


This seems to be leftover from the #121900 PR, right?
Looking closer, these tests seem to pass with any string value for the selector, except the failures.
Not something we should do in this PR, but I wonder if we should validate the selector inside the isIndexVisible method and only accept null, failures or data?

Yup, I'll note this down to look into in a follow up.

...ugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/AuthorizationEngine.java

.../src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java

slobodanadamovic · 2025-03-17T16:52:55Z

.../src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java

-            // Remove any selectors from abstraction name. Discard them for this check as we do not have access control for them (yet)
+            // Remove any selectors from abstraction name. Access control is based on the `selector` field of the IndexResource
            Tuple<String, String> expressionAndSelector = IndexNameExpressionResolver.splitSelectorExpression(indexOrAlias);
            indexOrAlias = expressionAndSelector.v1();


Sounds good to me!

...in/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizedIndicesTests.java

slobodanadamovic · 2025-03-18T10:07:16Z

...in/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizedIndicesTests.java

+        assertThat(authorizedIndices.check(SecuritySystemIndices.SECURITY_MAIN_ALIAS, IndexComponentSelector.DATA), is(false));
+    }
+
+    public void testDataStreamsAreNotIncludedInAuthorizedIndicesWithFailuresSelector() {


Some more unit tests we could consider adding (can be done in a followup PR):

having read_failure_store over .* and allow_restricted_indices=true does not grant access to system indices

having read_failure_store over .fs* indices does not grant read access to failure store indices (depends on the decision if we actually want to allow this - see my other comment)

having read_failure_store over * grants read access to datastreams with their failure store backing indices

having manage_failure_store over *, .fs* or datastream name does not grant access for TransportSearchAction.TYPE.name() but it should for TransportDeleteIndexAction.TYPE.name()

in general, more test coverage for resolveAuthorizedIndicesFromRole and e.g. TransportDeleteIndexAction with roles that grant manage_failure_store and manage

Absolutely. Adding these in a follow up.

...in/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizedIndicesTests.java

slobodanadamovic · 2025-03-18T11:08:12Z

...core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java

-            entry("cross_cluster_replication_internal", CROSS_CLUSTER_REPLICATION_INTERNAL),
-            DataStream.isFailureStoreFeatureFlagEnabled() ? entry("read_failure_store", READ_FAILURE_STORE) : null
-        ).filter(Objects::nonNull).collect(Collectors.toUnmodifiableMap(Map.Entry::getKey, Map.Entry::getValue))
+    private static final Map<String, IndexPrivilege> VALUES = combineSortedInOrder(


Thanks for the explanation!

slobodanadamovic · 2025-03-18T11:11:34Z

.../src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java

+            );
+        }
+
+        // TODO remove me (this has >700 usages in tests which would make for a horrible diff; will remove this once the main PR is merged)


...core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java

…g/elasticsearch into read-failure-store-privilege-authz

gmarouli · 2025-03-20T11:04:29Z

🥳

n1v0lg · 2025-03-20T11:43:06Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Questions ?

Please refer to the Backport tool documentation

* Resolve * Fix more tests * Fix bwc test * Undo spacing diff * More whitespace stuff * Another * More

This PR implements authorization logic for failure store access. It builds on elastic#122715. Access to the failure store is granted by two privileges: `read_failure_store` and `manage_failure_store`. Either of these privileges lets a user access a failure store via the `::failures` selector, as well as access its backing failure indices. `read_failure_store` grants read access (for example to search documents in a failure store), `manage_failure_store` grants access to write operations, such as rollover. Users with only `read` or `manage` on a data stream do not get failure store access. Vice versa, users with `read_failure_store` and `manage_failure_store` do not get access to regular data in a data stream. The PR implements this by making authorization logic selector-aware. It involves two main changes: 1. Index permission groups now compare the selector under which an index resource is accessed to the selector associated with the group. 2. The `AuthorizedIndices` interface likewise uses selectors to decide which indices to treat as authorized. This part of the change requires a sizable refactor and changes to the interface. The high-level behavior for selector-aware search is as follows: For a user with `read_failure_store` over data stream `logs`: - `POST /logs::failures/_search` returns the documents in the failure store. - `POST /logs/_search` returns a 403. - `POST /logs/_search?ignore_unavailable=true` and `POST /*/_search` return an empty result. Similarly, for a user with `read` over data stream `logs`: - `POST /logs::failures/_search` returns a 403. - `POST /logs/_search` returns documents in the data stream. - `POST /logs::failures/_search?ignore_unavailable=true` and `POST /*::failures/_search` return an empty result. A user with both `read` and `read_failure_store` over data stream `logs` gets access to both `POST /logs::failures/_search` and `POST /logs/_search`. The index privilege `all` automatically grants access to both data and the failures store, as well as all hypothetical future selectors. Resolves: ES-10873

n1v0lg added 30 commits February 13, 2025 11:31

WIP

0ff0bf5

More

78170dc

Moar

4c0d584

Merge branch 'main' into read-failure-store-privilege-role-building

37d5427

Merge branch 'main' into read-failure-store-privilege-role-building

0789eea

More

9976ca1

Fix

bcd42c0

Fix imports

6ceb401

Merge branch 'main' into read-failure-store-privilege-role-building

793215f

More fixes

a531e5f

Moar

2ccd969

Superuser etc

444112b

Composite role store tests

79d15eb

Test fixes

125e808

Test fixes

671cf70

Fix more

1988a21

Merge branch 'main' into read-failure-store-privilege-role-building

ffcf427

Keep selector with index privilege

c8fc1f7

Remote indices too

0858cd3

Undo docs test

8fcb15c

Simlify

bf3d46b

Cleaner selector handling

4d301c9

Fix test

b03a593

Merge branch 'main' into read-failure-store-privilege-role-building

d0e61c1

Union

da43e54

Rework IndexPrivilege#get

8582f80

Assert on names

9732f8d

More clean up and TODOs

0c848e4

Merge branch 'main' into read-failure-store-privilege-role-building

83f2148

Fix and simplify

fc01664

n1v0lg added 3 commits March 17, 2025 20:57

Merge branch 'read-failure-store-privilege-authz' of github.com:n1v0l…

1698536

…g/elasticsearch into read-failure-store-privilege-authz

Merge branch 'main' into read-failure-store-privilege-authz

80619ec

Changelog

f7c5c8e

n1v0lg changed the title ~~Failure store access - selector-aware authorization~~ Failure Store Access Authorization Mar 18, 2025

Merge branch 'main' into read-failure-store-privilege-authz

bfe9448

n1v0lg commented Mar 18, 2025

View reviewed changes

slobodanadamovic approved these changes Mar 18, 2025

View reviewed changes

Address review comments

d05ddcf

n1v0lg added >non-issue and removed >enhancement labels Mar 19, 2025

n1v0lg added 9 commits March 19, 2025 11:03

Delete docs/changelog/123986.yaml

6465b7a

RM changelog

5b71fb7

Merge branch 'read-failure-store-privilege-authz' of github.com:n1v0l…

6dd03c6

…g/elasticsearch into read-failure-store-privilege-authz

Merge branch 'main' into read-failure-store-privilege-authz

75224d8

Fix edge cases

a5b59bb

Clean up

91879e7

Merge branch 'main' into read-failure-store-privilege-authz

ff94545

Fix tests

998ad64

Merge branch 'read-failure-store-privilege-authz' of github.com:n1v0l…

3c04acf

…g/elasticsearch into read-failure-store-privilege-authz

n1v0lg added the auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) label Mar 20, 2025

Merge branch 'main' into read-failure-store-privilege-authz

21c920a

elasticsearchmachine merged commit c58ac45 into elastic:main Mar 20, 2025
22 checks passed

n1v0lg deleted the read-failure-store-privilege-authz branch March 20, 2025 09:10

n1v0lg mentioned this pull request Mar 20, 2025

[8.x] Failure Store Access Authorization (#123986) #125298

Merged

elasticsearchmachine pushed a commit that referenced this pull request Mar 20, 2025

[8.x] Failure Store Access Authorization (#123986) (#125298)

af8e407

* Resolve * Fix more tests * Fix bwc test * Undo spacing diff * More whitespace stuff * Another * More

		@@ -0,0 +1,5 @@
		pr: 123986
		summary: Failure Store Access Authorization

Failure Store Access Authorization #123986

Failure Store Access Authorization #123986

Uh oh!

Conversation

n1v0lg commented Mar 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

n1v0lg Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic left a comment

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

n1v0lg Mar 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

slobodanadamovic Mar 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

slobodanadamovic Mar 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

n1v0lg Mar 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

slobodanadamovic Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic Mar 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gmarouli commented Mar 20, 2025

Uh oh!

n1v0lg commented Mar 20, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

n1v0lg commented Mar 4, 2025 •

edited

Loading

slobodanadamovic Mar 17, 2025 •

edited

Loading

n1v0lg Mar 20, 2025 •

edited

Loading

slobodanadamovic Mar 18, 2025 •

edited

Loading