LDAP backend group - Opensearch role permissions issue

denkar · April 28, 2023, 1:29pm

Hi,

I am using ldap backend groups mapped to different roles which works fine,
but am having problem with permissions when a specific backend group is mapped to multiple different opensearch roles.

It seems like the opensearch role with most restrictive permissions beats the role which has higher permissions,
is that by design or is there a way to overcome this ?

Example:

<roles.yml>

Custom roles

Index Mgmt (view access)

With this role you can view “Discover” and “Stack Mgmt - Index Patterns”,“Index Mgmt - Indices”

view-all-indices:
reserved: true
cluster_permissions:
- “cluster:monitor*”
- “cluster:admin/opendistro/ism*”
index_permissions:
- index_patterns:
- “*”
allowed_actions:
- “indices:admin/data_stream/get”
- “indices:admin/resolve/index”
- “indices:admin/aliases/get”
- “indices:monitor/settings/get”
- “indices:monitor/stats”
- “indices:monitor/recovery”
- “indices:data/read/search”

test-app-role
With this role you can view “Discover” and “Stack Mgmt - Index Patterns”
But you cannot list Indices within “Index Mgmt - Indices”,
you get an “indices:admin/aliases/get” permission error, only way to solve this is to change index pattern to “*”

test-app-role:
reserved: true
cluster_permissions:
- “cluster:monitor*”
- “cluster:admin/opendistro/ism*”
index_permissions:
- index_patterns:
- “kibana”
- “index1*”
allowed_actions:
- “indices:admin*”
- “indices:data*”
- “indices:monitor*”
tenant_permissions:
- tenant_patterns:
- “"
allowed_actions:
- "”

<roles_mapping.yml>

Custom roles_mapping

If group is member of both roles it still does not work.

view-all-indices:
reserved: true
backend_roles:

“ldap_test_app_group”

test-app-role:
reserved: true
backend_roles:

“ldap_test_app_group”

Thing is that the “test-app-role” should be able to read/write/search its own index1 AND list all other indices
Would really appreciate if someone are able to help with this issue

Best Regards
//Dennis

pablo · May 5, 2023, 2:47pm

@denkar Have you tried .kibana or .kibana* as your index pattern in the role?

If you execute the command below, do you see only the described roles?
Could you share the output?

curl --insecure -u <test_user> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/authinfo?pretty

denkar · May 8, 2023, 11:31am

Hi,

test-app-role:
Added the index pattern “.kibana*” to the list and kept the “index1*” , but the test user still does not have the permission to see/list all indexes.

[2023-05-08T13:04:20,031][INFO ][o.o.s.p.PrivilegesEvaluator] [opensearch] No index-level perm match for User [name=api-test, backend_roles=[api-test]
[2023-05-08T13:04:20,031][INFO ][o.o.s.p.PrivilegesEvaluator] [opensearch] No permissions for [indices:admin/data_stream/get]

Here is the result from the above command:

“user” : “User [name=api-test, backend_roles=[api-test], requestedTenant=null]”,
“user_name” : “api-test”,
“user_requested_tenant” : null,
“remote_address” : “10.126.2.158:58850”,
“backend_roles” : [
“api-test”
],
“custom_attribute_names” : [
“ldap.dn”,
“attr.ldap.hasSubordinates”,
“attr.ldap.entryUUID”,
“attr.ldap.subschemaSubentry”,
“attr.ldap.createTimestamp”,
“attr.ldap.modifyTimestamp”,
“ldap.original.username”,
“attr.ldap.creatorsName”,
“attr.ldap.structuralObjectClass”,
“attr.ldap.objectClass”,
“attr.ldap.uid”,
“attr.ldap.modifiersName”
],
“roles” : [
“own_index”,
“api-test-indices”
],
“tenants” : {
“global_tenant” : false,
“admin_tenant” : false,
“api-test-indices” : true
},
“principal” : null,
“peer_certificates” : “0”,
“sso_logout_url” : null
}

Maybe it has something to do with the tenant config ?

Best Regards
//Dennis

pablo · May 9, 2023, 6:28pm

@denkar

I’ve tested your roles and when I use api-test role then I can’t list the indices in “Index Mgmt - Indices”. However, when both are assigned then I can list indices.

Could you share your opensearch_dashbaords.yml file?

pablo · May 9, 2023, 6:37pm

@denkar Please also share opensearch.yml.

denkar · May 15, 2023, 12:06pm

Hi,

Here are the files.

opensearch.yml

cluster.name: opensearch
path.logs: /var/log/opensearch

network.host: localhost
http.host: 0.0.0.0
http.port: 9200

plugins.security.ssl.transport.pemcert_filepath: ./cert/chain.pem
plugins.security.ssl.transport.pemkey_filepath: ./cert/privatekey.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: ./cert/ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: ./cert/chain.pem
plugins.security.ssl.http.pemkey_filepath: ./cert/privatekey.pem
plugins.security.ssl.http.pemtrustedcas_filepath: ./cert/ca.pem
plugins.security.ssl.http.clientauth_mode: OPTIONAL
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:

CN=opensearch.xxxxx.xx
plugins.security.nodes_dn:
CN=opensearch.xxxxx.xx
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [“all_access”, “security_rest_api_access”]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert*”, “.opendistro-anomaly-results*”, “.opendistro-anomaly-detector*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-", ".opensearch-notifications-”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response*”, “.replication-metadata-store”]
node.max_local_storage_nodes: 3
plugins.security.disabled: false

opensearch_dashboards.yml

server.host: “127.0.0.1”

opensearch.hosts: [https://opensearch.xxxxx.xx:9200]
opensearch.ssl.verificationMode: none
opensearch.username: kibanaserver
opensearch.password: xxxxx
opensearch.requestHeadersAllowlist: [ authorization,securitytenant ]

logging.dest: /var/log/opensearch-dashboard/opensearch-dashboard.log
logging.quiet: false

opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.enable_global: true
opensearch_security.multitenancy.tenants.enable_private: true
opensearch_security.multitenancy.tenants.preferred: [“Global”]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”]

pablo · May 15, 2023, 1:37pm

Do you use client certificate authentication?

Why do you need this in the opensearch_dashboards.yml? This is not required when you
have verificationMode set to none.

opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”]

denkar · May 15, 2023, 10:04pm

Nope, I dont use client cert. auth.

Misplaced config…will disable it right away and try again,
thanks for helping out

Best Regards
//Dennis

denkar · May 16, 2023, 11:20am

Hi again,

Issue still remains even though I removed the line,
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”] from opensearch_dashboards.yml

When the user logs into the GUI and tries to view all the Indices under Index Mgmt the following error occurs:
“[security_exception] no permissions for [indices:monitor/recovery] and User [name=api-test, backend_roles=[api-test], requestedTenant=]”

Config from roles.yml is below:

api-test:
reserved: true
cluster_permissions:
- “cluster:monitor*”
- “cluster:admin/opendistro/ism*”
index_permissions:
- index_patterns:
- “.kibana*”
- “index1*”
allowed_actions:
- “indices:admin*”
- “indices:data*”
- “indices:monitor*”
tenant_permissions:
- tenant_patterns:
- “"
allowed_actions:
- "”

Seems like that you really need to have the
- index_patterns:
- “*”
In order to view all indexes ?

Best Regards
//Dennis

pablo · May 19, 2023, 5:16pm

@denkar If I use only api-test role I won’t be able to see the indices no matter if I have or not ‘*’ in index_patters.

However, I’ve found that your index allowed actions didn’t work for me.

OpenSearch didn’t recognize them. I had to set the exact permissions as you had in view-all-indices role.

    allowed_actions:
    - "indices:admin/data_stream/get"
    - "indices:admin/resolve/index"
    - "indices:admin/aliases/get"
    - "indices:monitor/settings/get"
    - "indices:monitor/stats"
    - "indices:monitor/recovery"
    - "indices:data/read/search"

Then only the role with * could list the indices.

You could report it as a bug in GitHub OpenSearch security.
If you do, please share the link to the bug here.

Topic		Replies	Views
Ldap users assigned to roles and index security error Security	3	421	January 15, 2021
Role applied when login with openId doesn't give permission to specified index Security troubleshoot	2	294	July 27, 2023
LDAP groups error with different index Security	8	2927	August 13, 2019
Roles and users Security configure	2	374	April 27, 2022
LDAP - Hide unmapped backend roles Security	7	483	November 25, 2023

LDAP backend group - Opensearch role permissions issue

Custom roles

Custom roles_mapping

Related Topics