Alias permissions on index_pattern else than "*" possible?

Search Guard
1

Hi,

I’m unable to restrict the permission indices:admin/aliases/get to foo-*.
If I do this, I get an no permissions for [indices:admin/aliases/get] exception.

sg_role_config:

If I only grant access to some indices, I get the exception:

        query_bot:
          tenant_permissions: []
          cluster_permissions:
            - SGS_CLUSTER_COMPOSITE_OPS_RO
            - SGS_CLUSTER_MONITOR
            - "indices:admin/aliases/get"
          index_permissions:
            - index_patterns:
                - 'foo-*'
              allowed_actions:
                - SGS_READ
                - SGS_SEARCH
                - "indices:admin/aliases/get"

If I grant permissions to all indices, it works:

        query_bot:
          tenant_permissions: []
          cluster_permissions:
            - SGS_CLUSTER_COMPOSITE_OPS_RO
            - SGS_CLUSTER_MONITOR
            - "indices:admin/aliases/get"
          index_permissions:
            - index_patterns:
                - 'foo-*'
              allowed_actions:
                - SGS_READ
                - SGS_SEARCH
            - index_patterns:
                - '*'
              allowed_actions:
                - "indices:admin/aliases/get"
2

I am assuming that you are trying to use the indices:admin/aliases/get action with a wildcard which also matches indexes the user does not have access to?

In the default configuration, Search Guard does only check whether users have all permissions to execute a given request. It does not modify the request to include only the resources the user has access to.

To a certain extent, such filtering is however done when do_not_fail_on_forbidden is enabled. Then, Search Guard will try to remove indexes a user has no access to from the request.

Unfortunately, the do_not_fail_on_forbidden feature is right now only supported for these actions:

  • indices:data/read/*
  • indices:admin/mappings/fields/get
  • indices:admin/shards/search_shards
  • indices:admin/resolve/index

For all other actions, the operation will fail if there are no permissions for all indices in the request.

We will look into supporting further actions. However, this often requires separate consideration for each action type; thus, this can take some time.

1 Like
3

Thanks for the detailed explanation.
Please put this into the documentation, that would be awesome!

1 Like
4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.