Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ResponseOps] alerting privs missing read:getActionErrorLog #158957

Closed
pmuellr opened this issue Jun 2, 2023 · 2 comments · Fixed by #166603
Closed

[ResponseOps] alerting privs missing read:getActionErrorLog #158957

pmuellr opened this issue Jun 2, 2023 · 2 comments · Fixed by #166603
Assignees
@umbopepato
Labels
bug Fixes for quality problems that affect the customer experience Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@pmuellr
Copy link
Member

pmuellr commented Jun 2, 2023

In the following code, we're missing getActionErrorLog:

kibana/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.ts

Lines 19 to 30 in e2e03ca

const readOperations: Record<AlertingEntity, string[]> = {
rule: [
'get',
'getRuleState',
'getAlertSummary',
'getExecutionLog',
'find',
'getRuleExecutionKPI',
'runSoon',
],
alert: ['get', 'find', 'getAuthorizedAlertsIndices', 'getAlertSummary'],
};

It's defined here:

kibana/x-pack/plugins/alerting/server/authorization/alerting_authorization.ts

Lines 29 to 39 in e2e03ca

export enum ReadOperations {
Get = 'get',
GetRuleState = 'getRuleState',
GetAlertSummary = 'getAlertSummary',
GetExecutionLog = 'getExecutionLog',
GetActionErrorLog = 'getActionErrorLog',
Find = 'find',
GetAuthorizedAlertsIndices = 'getAuthorizedAlertsIndices',
RunSoon = 'runSoon',
GetRuleExecutionKPI = 'getRuleExecutionKPI',
}

Found this from a support issue. User was unable to view the error logs of an action when having ALL privileges for "Actions and Connectors", "Rule Settings" and "Stack Rules". Super user can see them.

image

Once I added the string to the readOperations, I was able to view the error logs.
@pmuellr pmuellr added bug Fixes for quality problems that affect the customer experience Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Jun 2, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@XavierM XavierM moved this from Awaiting Triage to Todo in AppEx: ResponseOps - Rules & Alerts Management Jun 6, 2023
@JiaweiWu JiaweiWu self-assigned this Jun 6, 2023
@pmuellr
Copy link
Member Author

pmuellr commented Jun 7, 2023

I don't think there's any work-around for this, right?

What's interesting is that it works for super user, so I'm wondering how the auth works on that vs specific feature controls. Basically, I'm wondering if there is some other minimal set of feature control that we could add to the role to get this to work.

@XavierM XavierM moved this from Todo to Up for grabs in AppEx: ResponseOps - Rules & Alerts Management Jul 12, 2023
@XavierM XavierM assigned umbopepato and unassigned JiaweiWu Sep 11, 2023
umbopepato added a commit to umbopepato/kibana that referenced this issue Sep 18, 2023
@umbopepato
Add missing privilege to alerting read operations
b873f5a 
Closes elastic#158957
@umbopepato umbopepato mentioned this issue Sep 18, 2023
Merged
umbopepato added a commit that referenced this issue Sep 22, 2023
@umbopepato
[RAM] Add missing privilege to alerting read operations (#166603)
0eda41a 
Closes #158957

## Summary

Adds the missing `getActionErrorLog` privilege. With the updated
privileges, users with a custom Role including full access to "Actions
and Connectors", "Rule Settings" and "Stack Rules" can successfully
inspect errored actions' logs:

![Errored actions
logs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)

## To Test

- Create a Role with `All` privileges granted in `Actions and
Connectors`, `Rules Settings`, `Stack Rules` (under Kibana > Management)
and assign it to a user
- Log in with that user
- Create a rule with a failing action (i.e. an Email Connector with
wrong addresses)
- Wait for the rule to execute (or execute it manually)
- In the rule page, under `History` click the number under `Errored
actions` in one of the rows of the logs table
- Check that error logs are visible in the flyout
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 22, 2023
@umbopepato
[RAM] Add missing privilege to alerting read operations (elastic#166603)
2495269 
Closes elastic#158957

## Summary

Adds the missing `getActionErrorLog` privilege. With the updated
privileges, users with a custom Role including full access to "Actions
and Connectors", "Rule Settings" and "Stack Rules" can successfully
inspect errored actions' logs:

![Errored actions
logs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)

## To Test

- Create a Role with `All` privileges granted in `Actions and
Connectors`, `Rules Settings`, `Stack Rules` (under Kibana > Management)
and assign it to a user
- Log in with that user
- Create a rule with a failing action (i.e. an Email Connector with
wrong addresses)
- Wait for the rule to execute (or execute it manually)
- In the rule page, under `History` click the number under `Errored
actions` in one of the rows of the logs table
- Check that error logs are visible in the flyout

(cherry picked from commit 0eda41a)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 22, 2023
@umbopepato
[RAM] Add missing privilege to alerting read operations (elastic#166603)
528b8c1 
Closes elastic#158957

## Summary

Adds the missing `getActionErrorLog` privilege. With the updated
privileges, users with a custom Role including full access to "Actions
and Connectors", "Rule Settings" and "Stack Rules" can successfully
inspect errored actions' logs:

![Errored actions
logs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)

## To Test

- Create a Role with `All` privileges granted in `Actions and
Connectors`, `Rules Settings`, `Stack Rules` (under Kibana > Management)
and assign it to a user
- Log in with that user
- Create a rule with a failing action (i.e. an Email Connector with
wrong addresses)
- Wait for the rule to execute (or execute it manually)
- In the rule page, under `History` click the number under `Errored
actions` in one of the rows of the logs table
- Check that error logs are visible in the flyout

(cherry picked from commit 0eda41a)
kibanamachine added a commit that referenced this issue Sep 22, 2023
@kibanamachine @umbopepato
[8.10] [RAM] Add missing privilege to alerting read operations (#166603…
5e728ad 
…) (#167001)

# Backport

This will backport the following commits from `main` to `8.10`:
- [[RAM] Add missing privilege to alerting read operations
(#166603)](#166603)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Umberto
Pepato","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-09-22T07:23:13Z","message":"[RAM]
Add missing privilege to alerting read operations (#166603)\n\nCloses
#158957\r\n\r\n## Summary\r\n\r\nAdds the missing `getActionErrorLog`
privilege. With the updated\r\nprivileges, users with a custom Role
including full access to \"Actions\r\nand Connectors\", \"Rule
Settings\" and \"Stack Rules\" can successfully\r\ninspect errored
actions' logs:\r\n\r\n![Errored
actions\r\nlogs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)\r\n\r\n##
To Test\r\n\r\n- Create a Role with `All` privileges granted in `Actions
and\r\nConnectors`, `Rules Settings`, `Stack Rules` (under Kibana >
Management)\r\nand assign it to a user\r\n- Log in with that user\r\n-
Create a rule with a failing action (i.e. an Email Connector
with\r\nwrong addresses)\r\n- Wait for the rule to execute (or execute
it manually)\r\n- In the rule page, under `History` click the number
under `Errored\r\nactions` in one of the rows of the logs table\r\n-
Check that error logs are visible in the
flyout","sha":"0eda41a46da91ba3b4fd90a8478e1aecb03154f0","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:ResponseOps","v8.10.0","v8.11.0","v8.9.3"],"number":166603,"url":"https://github.com/elastic/kibana/pull/166603","mergeCommit":{"message":"[RAM]
Add missing privilege to alerting read operations (#166603)\n\nCloses
#158957\r\n\r\n## Summary\r\n\r\nAdds the missing `getActionErrorLog`
privilege. With the updated\r\nprivileges, users with a custom Role
including full access to \"Actions\r\nand Connectors\", \"Rule
Settings\" and \"Stack Rules\" can successfully\r\ninspect errored
actions' logs:\r\n\r\n![Errored
actions\r\nlogs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)\r\n\r\n##
To Test\r\n\r\n- Create a Role with `All` privileges granted in `Actions
and\r\nConnectors`, `Rules Settings`, `Stack Rules` (under Kibana >
Management)\r\nand assign it to a user\r\n- Log in with that user\r\n-
Create a rule with a failing action (i.e. an Email Connector
with\r\nwrong addresses)\r\n- Wait for the rule to execute (or execute
it manually)\r\n- In the rule page, under `History` click the number
under `Errored\r\nactions` in one of the rows of the logs table\r\n-
Check that error logs are visible in the
flyout","sha":"0eda41a46da91ba3b4fd90a8478e1aecb03154f0"}},"sourceBranch":"main","suggestedTargetBranches":["8.10","8.9"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/166603","number":166603,"mergeCommit":{"message":"[RAM]
Add missing privilege to alerting read operations (#166603)\n\nCloses
#158957\r\n\r\n## Summary\r\n\r\nAdds the missing `getActionErrorLog`
privilege. With the updated\r\nprivileges, users with a custom Role
including full access to \"Actions\r\nand Connectors\", \"Rule
Settings\" and \"Stack Rules\" can successfully\r\ninspect errored
actions' logs:\r\n\r\n![Errored
actions\r\nlogs](https://github.com/elastic/kibana/assets/18363145/0d34f6a3-d586-4fe7-b987-a829de0d852d)\r\n\r\n##
To Test\r\n\r\n- Create a Role with `All` privileges granted in `Actions
and\r\nConnectors`, `Rules Settings`, `Stack Rules` (under Kibana >
Management)\r\nand assign it to a user\r\n- Log in with that user\r\n-
Create a rule with a failing action (i.e. an Email Connector
with\r\nwrong addresses)\r\n- Wait for the rule to execute (or execute
it manually)\r\n- In the rule page, under `History` click the number
under `Errored\r\nactions` in one of the rows of the logs table\r\n-
Check that error logs are visible in the
flyout","sha":"0eda41a46da91ba3b4fd90a8478e1aecb03154f0"}},{"branch":"8.9","label":"v8.9.3","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Umberto Pepato <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@umbopepato umbopepato

Labels
bug Fixes for quality problems that affect the customer experience Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
AppEx: ResponseOps - Rules & Alerts Management
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[RAM] Add missing privilege to alerting read operations umbopepato/kibana
4 participants
@pmuellr @elasticmachine @umbopepato @JiaweiWu