[SECURITY] Deprecated sub feature cases in security solutions in 7.x

[XavierM]

Summary

Create an Upgrade Assistant automated fix to rewrite roles that are granting access to the Cases sub-feature to use the new top-level Cases feature

#109158

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[elasticmachine]

Pinging @elastic/security-threat-hunting-cases (Team:Threat Hunting:Cases)

[XavierM]

Thank you @jonathan-buttner, your idea to use a switch and a set make it more readable and easier to understand. Thanks for the suggestion.

[jonathan-buttner]

Thanks for the refactor 👍 Xavier and I paired on testing this too although we didn't test a full upgrade. Might be good to get QA to test that?

[jportner]

Will review this first thing tomorrow morning

[jportner]

As discussed offline --

This looks great so far, but I think we need four changes:

1. Update UI text to make sure that it is in line with the 7.16 upgrade assistant guidance
2. The API call fails because the request payload contains an unexpected deprecationDetails field. It looks like the deprecations client is adding this automatically. We should submit a PR for 8.0/7.16 that adds a omitDeprecationDetails field, which the deprecations client should respect.
3. Changing the existing "siem" feature privilege can unintentionally grant more access to a user in 7.16. For example, if the role has { siem: ['minimal_read'] }, the "Quick resolve" button changes that to { siem: ['read'] }. So we need to submit a PR for 8.0 that changes "siem" to something else like "securitySolutionApp", and change this code to add the new feature privilege without changing the existing one. Then, if the role has { siem: ['minimal_read'] }, the "Quick resolve" button should change that to { siem: ['minimal_read'], securitySolutionApp: ['read'] }.
4. We should ensure that after the user fixes the role, it doesn't show in the upgrade assistant anymore. You should be able to filter out any roles that contain feature privileges for "securitySolutionApp" or "securitySolutionCases".

Another thing I thought of: if the user had a Gold license at one point, and added a role with sub-feature privileges, and then downgraded to Basic, the role's sub-feature privileges are essentially "zombie privileges" -- they exist but they don't grant access to anything. But honestly it's probably such an edge case, I don't think we really need to change this feature deprecation to take that into account. I'm interested to hear what @legrego thinks, though.

Edit: here are a couple of screenshots of the flyout in the upgrade assistant...

Current:

With my suggested text changes:

I chatted with the Stack Management team and I think we are in agreement that if there are no manual steps, the flyout should not render that "Fix manually" header at all. I'll add a comment here if they decide to update the flyout to remove that. Otherwise, we should add a manual step placeholder, like "Click the 'Quick resolve' button below", so we don't have an empty section there.

[legrego]

Another thing I thought of: if the user had a Gold license at one point, and added a role with sub-feature privileges, and then downgraded to Basic, the role's sub-feature privileges are essentially "zombie privileges" -- they exist but they don't grant access to anything. But honestly it's probably such an edge case, I don't think we really need to change this feature deprecation to take that into account

It's a good question. Consider a role with siem privileges granting ['minimal_read', 'cases_read'].
Under a basic license, this role grants no access to siem, but if we run the role through the UA, then this role will (IIUC) grant read access to the new securitySolutionApp, and read access to securitySolutionCases after upgrading to 8.0.

The odds of this happening are quite small, as the license downgrade would have resulted in revoked access for one or more users, which had then gone unnoticed and uncorrected up until the point they run the UA. I'd consider this a nice-to-have, but not blocking.

Changing the existing "siem" feature privilege can unintentionally grant more access to a user in 7.16.

Great catch @jportner, sorry I hadn't considered this when we had discussed this earlier, @XavierM 😬

[jportner]

It's a good question. Consider a role with siem privileges granting ['minimal_read', 'cases_read']. Under a basic license, this role grants no access to siem, but if we run the role through the UA, then this role will (IIUC) grant read access to the new securitySolutionApp, and read access to securitySolutionCases after upgrading to 8.0.

The odds of this happening are quite small, as the license downgrade would have resulted in revoked access for one or more users, which had then gone unnoticed and uncorrected up until the point they run the UA. I'd consider this a nice-to-have, but not blocking.

Yeah, that's my understanding as well. OK, agreed that handling this is a nice-to-have but not blocking 👍

outdated

[XavierM]

waiting on this PR now #114399

[XavierM]

@elasticmachine merge upstream

[jonathan-buttner]

Looks good! We tested it together 👍

[XavierM]

@elasticmachine merge upstream

[XavierM]

@elasticmachine merge upstream

[XavierM]

@elasticmachine merge upstream

[jportner]

I tested by creating six roles:

1. with siem: ['all']
2. with siem: ['read']
3. with siem: ['minimal_all', 'cases_all', 'cases_read']
4. with siem: ['minimal_read', 'cases_read']
5. with siem: ['minimal_all']
6. with siem: ['minimal_read']

I would expect roles 1-4 to show in the upgrade assistant, and I would expect roles 5-6 to be hidden (because they don't currently grant access to Cases, so they don't need to be changed).

However, all roles showed in the upgrade assistant. When I clicked "Quick resolve" for role 5, of course nothing happened. Then I clicked "Quick resolve" for role 1, and refreshed, and all of the other deprecations were gone.

I think you need to make two changes and update tests accordingly; see comments below 😄

[jportner]

Couple of tiny nits, but LGTM! I think we are exercising everything that we need to in the tests.

[XavierM]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 8e88366
• Storybooks Preview
• Documentation Changes

Metrics [docs]

✅ unchanged

History

• 💔 Build #160743 failed a645e1b
• 💔 Build #160618 failed 221276b
• 💚 Build #160619 succeeded 61c5cdd
• 💚 Build #160490 succeeded bfe202a
• 💚 Build #160188 succeeded 029556c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream