Saved objects api authentication

Security
1

Hi everyone,

I am working at fetching saved objects from an external app. This raises two issues:

  1. With kibana without opendistro, the full url looks like this:
    http://localhost:5601/api/saved_objects/_find?type=visualization
    Is it the same with opendistro?
  2. Which authentication modes are available to do that? Is basic authentication available for internal users? Is api token authentication available as it is the case with kibana + x-pack ? Has anyone managed to do that with any authentication mode?

Best regards,

Nicholson

2

Hi @nicholson

  1. Yes that API is still working with ODFE kibana. I tested on 1.12
  2. It worked with basic authentication. No token required as basic is internal authentication.

i.e.
curl -XGET --user admin:admin http://localhost:5601/api/saved_objects/_find?type=visualization

3

Thanks a lot for your reply.

Nicholson

4

Hi @pablo ,

Can you pls share opensearch documentation page for saved_objects api. I couldn’t find it in opensearch documentation.

Ref link: Confusing opensearch dashboard import API · Issue #1723 · opensearch-project/OpenSearch-Dashboards · GitHub

I want to import saved object (ndjson) file in all tenants, (private tenant + global) tentant in single API request for single "user" role.

Currently using below api to import saved object is getting import for single tenant only.

curl -XPOST -u <>:<> --insecure "https://< 
 >:<>/api/saved_objects/_import" -H "osd-xsrf: true" --form file=@"a.ndjson"

Pls let me know if any other way than saved objects api to see index-patterns, visualizations can be seen using using global index pattern for all tenants.

Ref link: Create Global Index Pattern accessible to all Tenants in Opensearch

5

@divyank_1 I don’t think your question is related to the security plugin. Would you mind posting it in the OpenSearch Dashboards category?

6

Opensearch Dashboards I think is based on Kibana 7.10 so all(?) of the apis should be working from this version.
If you want to use the api for a specific tenant you use the following header:

"Content-Type": "application/json", "osd-xsrf": "true", "securitytenant": tenant_name