Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unauthorized route migration for routes owned by kibana-management #204531

Conversation

kibanamachine
Copy link
Contributor

Authz API migration for unauthorized routes

This PR migrates unauthorized routes owned by your team to a new security configuration.
Please refer to the documentation for more information: Authorization API

Before migration:

router.get({
  path: '/api/path',
  ...
}, handler);

After migration:

router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);

What to do next?

  1. Review the changes in this PR.
  2. Elaborate on the reasoning to opt-out of authorization.
  3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible.
  4. You might need to update your tests to reflect the new security configuration:
  • If you have snapshot tests that include the route definition.

Any questions?

If you have any questions or need help with API authorization, please reach out to the @elastic/kibana-security team.

@kibanamachine kibanamachine added enhancement New value added to drive a business result Team:Kibana Management Dev Tools, Index Management, Upgrade Assistant, ILM, Ingest Node Pipelines, and more release_note:skip Skip the PR/issue when compiling release notes Feature:Security/Authorization Platform Security - Authorization labels Dec 17, 2024
@kibanamachine kibanamachine requested a review from a team as a code owner December 17, 2024 10:15
@kibanamachine kibanamachine added backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) Authz: API migration labels Dec 17, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-management (Team:Kibana Management)

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

@mattkime mattkime closed this Jan 6, 2025
@mattkime mattkime deleted the authz-migration/unauthorized-routes-owner-kibana-management branch January 6, 2025 03:14
mattkime added a commit that referenced this pull request Jan 6, 2025
## Summary

Simply adding `authz` info to REST endpoints as part of
#204531
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 6, 2025
)

## Summary

Simply adding `authz` info to REST endpoints as part of
elastic#204531

(cherry picked from commit 4eb9006)
kibanamachine added a commit that referenced this pull request Jan 6, 2025
…) (#205597)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[upgrade assistant] Add authz info to REST api endpoints
(#205071)](#205071)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Matthew
Kime","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-01-06T11:43:30Z","message":"[upgrade
assistant] Add authz info to REST api endpoints (#205071)\n\n##
Summary\r\n\r\nSimply adding `authz` info to REST endpoints as part
of\r\nhttps://github.com//pull/204531","sha":"4eb900651a97fe117b147e3737ad9dc3d9ee4a12","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Kibana
Management","release_note:skip","Feature:Upgrade
Assistant","v9.0.0","backport:prev-minor"],"title":"[upgrade assistant]
Add authz info to REST api
endpoints","number":205071,"url":"https://github.com/elastic/kibana/pull/205071","mergeCommit":{"message":"[upgrade
assistant] Add authz info to REST api endpoints (#205071)\n\n##
Summary\r\n\r\nSimply adding `authz` info to REST endpoints as part
of\r\nhttps://github.com//pull/204531","sha":"4eb900651a97fe117b147e3737ad9dc3d9ee4a12"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/205071","number":205071,"mergeCommit":{"message":"[upgrade
assistant] Add authz info to REST api endpoints (#205071)\n\n##
Summary\r\n\r\nSimply adding `authz` info to REST endpoints as part
of\r\nhttps://github.com//pull/204531","sha":"4eb900651a97fe117b147e3737ad9dc3d9ee4a12"}}]}]
BACKPORT-->

Co-authored-by: Matthew Kime <[email protected]>
kowalczyk-krzysztof pushed a commit to kowalczyk-krzysztof/kibana that referenced this pull request Jan 7, 2025
)

## Summary

Simply adding `authz` info to REST endpoints as part of
elastic#204531
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Jan 13, 2025
)

## Summary

Simply adding `authz` info to REST endpoints as part of
elastic#204531
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Authz: API migration backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) enhancement New value added to drive a business result Feature:Security/Authorization Platform Security - Authorization release_note:skip Skip the PR/issue when compiling release notes Team:Kibana Management Dev Tools, Index Management, Upgrade Assistant, ILM, Ingest Node Pipelines, and more
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants