Observability Log Explorer accessible with Kibana dashboard only role

[tahaderouiche]

Kibana version: 8.15

Elasticsearch version: 8.15

Describe the bug: Observability Log Explorer application is accessible with Dashboard only role.

Steps to reproduce:

1. Create a role with with KB dashboard only access and ES read only to indices logs-*.

{
  "indices": [
    {
      "names": [
        "logs-*"
      ],
      "privileges": [
        "read"
      ]
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_dashboard.read"
      ],
      "resources": [
        "space:default"
      ]
    }
  ]
}

2. Create a user associated to this role.
3. Login to Kibana with the dashboard-only user. Search Log Explorer in Kibana Global Search bar.
4. This will open Log Explorer with all its functionality on logs-* indices.

Expected behavior:

Viewing data in Logs Explorer should require Kibana read privileges for Discover and Integrations.

Screenshots (if relevant):

[elasticmachine]

Pinging @elastic/obs-ux-logs-team (Team:obs-ux-logs)

[mohamedhamed-ahmed]

Got a couple of questions here:

1. If Logs Explorer is to be disabled in case of missing discover or integrations privilege for the user, then it will also be removed from the left bar nav as well right ?
2. in this case what should the default entry navigation for Logs be ?

@gbamparop wdyt?

[gbamparop]

Got a couple of questions here:

1. If Logs Explorer is to be disabled in case of missing discover or integrations privilege for the user, then it will also be removed from the left bar nav as well right ?
2. in this case what should the default entry navigation for Logs be ?

@gbamparop wdyt?

With the new stateful nav, this shouldn't be a problem but in case there are no privileges to access Logs Explorer and Discover I think we should default to the remaining pages. Log stream when it's not hidden by the advanced setting that will be introduced by #193320 or otherwise default to the remaining two links (log categories / anomalies). @LucaWintergerst any thoughts?

[mohamedhamed-ahmed]

@gbamparop Thank you.

Do we know when will the new nav be available? I saw in the email its targeting 8.16 probably. But the issue here is on 8.15 as well.

The other problem is with the links that are across kibana like in Dataset quality pointing to Logs Explorer. Should we keep this the consumers' responsibility to hide/show them?

[LucaWintergerst]

for other pages we currently throw an error like this. I think this is fine
Usually this is not a big problem, as anyone with enough privs to view Dataset Quality usually has enough privs for other pages too

I think we should focus primarily on the bug that was raised by Taha and just fix this for the time being.

[mohamedhamed-ahmed]

@LucaWintergerst Thank you.
My only concern is the side bar nav Logs Link. What should it navigate to if the user doesn't have Logs Explorer Privilege.

Because if we don't do anything about it it will prevent the user from accessing the Categories and Anomalies Tabs. This might not be a problem when the new Nav is out, but I believe its important to fix for 8.15 and 8.16.

Screen.Recording.2024-09-26.at.13.57.22.mov

The above user has access to Logs but not Logs Explorer Which means he should be able to access Categories and Anomalies but because of fixing the bug in this ticket we now disabled access to Logs Explorer which was the default nav for the Logs tab from the side nav.

[LucaWintergerst]

ah, apologies, I see.
Yes, valid point, thanks for mentioning this.

So let's redirect, and the hierarchy I would go with as Giorgos already suggested:

• Log Stream
• Log Categories
• Log Anomalies
• Error Page

[mohamedhamed-ahmed]

@LucaWintergerst Sounds great, thank you :)
Will have a look now on how this can be done and add the necessary changes to the linked PR 👍

[mohamedhamed-ahmed]

Fix implemented and backported to 8.15