Create index pattern throws internal server error with non elastic user #72219

liza-mae · 2020-07-17T02:32:02Z

Kibana version: 7.9.0 BC1

Elasticsearch version: 7.9.0 BC1

Server OS version: Linux

Browser version: Chrome

Original install method (e.g. download page, yum, from source, etc.):
Staging

Description of the problem including expected versus actual behavior:

Steps to reproduce:

Create a user with roles kibana_admin and read only to an index pattern
Navigate to create index pattern, notice internal error occurs.

Errors in browser console (if relevant):

core.entry.js:34 GET https://localhost:5601/internal/index-pattern-management/resolve_index/* 500 (Internal Server Error)
_callee3$ @ core.entry.js:34
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
fetch_asyncGeneratorStep @ core.entry.js:34
_next @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
fetchResponse @ core.entry.js:34
_callee$ @ core.entry.js:34
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
fetch_asyncGeneratorStep @ core.entry.js:34
_next @ core.entry.js:34
Promise.then (async)
fetch_asyncGeneratorStep @ core.entry.js:34
_next @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
_callee2$ @ core.entry.js:34
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
fetch_asyncGeneratorStep @ core.entry.js:34
_next @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
(anonymous) @ core.entry.js:34
_callee$ @ 1.plugin.js:1
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
get_indices_asyncGeneratorStep @ 1.plugin.js:1
_next @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
_getIndices @ 1.plugin.js:1
getIndices @ 1.plugin.js:1
_callee2$ @ 1.plugin.js:1
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
create_index_pattern_wizard_asyncGeneratorStep @ 1.plugin.js:1
_next @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
_callee4$ @ 1.plugin.js:1
l @ kbn-ui-shared-deps.js:368
(anonymous) @ kbn-ui-shared-deps.js:368
forEach.e.<computed> @ kbn-ui-shared-deps.js:368
create_index_pattern_wizard_asyncGeneratorStep @ 1.plugin.js:1
_next @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
(anonymous) @ 1.plugin.js:1
UNSAFE_componentWillMount @ 1.plugin.js:1
Lo @ kbn-ui-shared-deps.js:422
Ga @ kbn-ui-shared-deps.js:422
xs @ kbn-ui-shared-deps.js:422
ml @ kbn-ui-shared-deps.js:422
hl @ kbn-ui-shared-deps.js:422
ol @ kbn-ui-shared-deps.js:422
(anonymous) @ kbn-ui-shared-deps.js:422
t.unstable_runWithPriority @ kbn-ui-shared-deps.js:430
Hi @ kbn-ui-shared-deps.js:422
Gi @ kbn-ui-shared-deps.js:422
Yi @ kbn-ui-shared-deps.js:422
se @ kbn-ui-shared-deps.js:422
An @ kbn-ui-shared-deps.js:422
Show 40 more frames
core.entry.js:34 GET https://localhost:5601/internal/index-pattern-management/resolve_index/*:* 500 (Internal Server Error)

The text was updated successfully, but these errors were encountered:

liza-mae · 2020-07-17T03:07:30Z

pinging: @elastic/kibana-security

legrego · 2020-07-17T09:53:40Z

The error is thrown from the /internal/index-pattern-management/resolve_index/{query} endpoint. @mattkime / @danhermann are you able to help resolve this one? Looks like this was introduced in #70271 to support data streams.

Was the corresponding Elasticsearch endpoint (elastic/elasticsearch#57626) introduced specifically to enable Kibana and index pattern management? If so, then that endpoint should not require the indices:admin/resolve/index privilege in order to function. We've been able to create index patterns with just the read and view_index_metadata index privileges historically, and changing that requirement isn't something we can do in a minor release.

server    log   [05:44:13.087] [error][http] { Error: [security_exception] action [indices:admin/resolve/index] is unauthorized for user [test]
    at respond (/Users/larry/repos/kibana/node_modules/elasticsearch/src/lib/transport.js:349:15)
    at checkRespForFailure (/Users/larry/repos/kibana/node_modules/elasticsearch/src/lib/transport.js:306:7)
    at HttpConnector.<anonymous> (/Users/larry/repos/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)
    at IncomingMessage.wrapper (/Users/larry/repos/kibana/node_modules/lodash/lodash.js:4929:19)
    at IncomingMessage.emit (events.js:203:15)
    at endReadableNT (_stream_readable.js:1145:12)
    at process._tickCallback (internal/process/next_tick.js:63:19)
  status: 403,
  displayName: 'AuthorizationException',
  message:
   '[security_exception] action [indices:admin/resolve/index] is unauthorized for user [test]',
  path: '/_resolve/index/*%3A*',
  query: undefined,
  body:
   { error:
      { root_cause: [Array],
        type: 'security_exception',
        reason:
         'action [indices:admin/resolve/index] is unauthorized for user [test]' },
     status: 403 },
  statusCode: 403,
  response:
   '{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/resolve/index] is unauthorized for user [test]"}],"type":"security_exception","reason":"action [indices:admin/resolve/index] is unauthorized for user [test]"},"status":403}',
  toString: [Function],
  toJSON: [Function] }

elasticmachine · 2020-07-17T09:53:56Z

Pinging @elastic/kibana-app-arch (Team:AppArch)

danhermann · 2020-07-17T13:50:57Z

Was the corresponding Elasticsearch endpoint (elastic/elasticsearch#57626) introduced specifically to enable Kibana and index pattern management? If so, then that endpoint should not require the indices:admin/resolve/index privilege in order to function. We've been able to create index patterns with just the read and view_index_metadata index privileges historically, and changing that requirement isn't something we can do in a minor release.

@legrego, by necessity, that endpoint is going to require authorization for the indices:admin/resolve/index action, but there is a case to be made that that action should be covered by the existing view_index_metadata privilege. If that would resolve this situation, I can raise the question on the ES and make that change if approved.

legrego · 2020-07-17T14:00:13Z

by necessity, that endpoint is going to require authorization for the indices:admin/resolve/index action, but there is a case to be made that that action should be covered by the existing view_index_metadata privilege. If that would resolve this situation, I can raise the question on the ES and make that change if approved.

I think that would resolve the situation from Kibana's perspective, so long as adding indices:admin/resolve/index to view_index_metadata is palatable from the ES security standpoint

danhermann · 2020-07-17T14:18:42Z

I think that would resolve the situation from Kibana's perspective, so long as adding indices:admin/resolve/index to view_index_metadata is palatable from the ES security standpoint

I'll look into that, then.

droberts195 · 2020-07-23T15:25:21Z

The Elasticsearch PR is merged and backported - see links above.

kobelb · 2020-08-04T21:54:03Z

I believe this issue has been fixed. Were any tests skipped that should be re-enabled or can we close this?

liza-mae · 2020-08-05T00:31:37Z

It was fixed, closing.

pdi-activelan · 2020-08-05T00:33:07Z

Hi elastic/kibana Thank you for contacting our support team. A support ticket has now been opened for your request. You will be notified when a response is made by email. Subject: Re: [elastic/kibana] Create index pattern throws internal server error with non elastic user (#72219) Department: Technical Support Priority: Medium Ticket message: Closed #72219. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #72219 (comment) You can view the ticket on the following link: #61 Kind Regards, activeLAN Solutions GmbH

pdi-activelan · 2020-08-05T00:33:07Z

Hi elastic/kibana Thank you for contacting our support team. A support ticket has now been opened for your request. You will be notified when a response is made by email. Subject: Re: [elastic/kibana] Create index pattern throws internal server error with non elastic user (#72219) Department: Technical Support Priority: Medium Ticket message: It was fixed, closing. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #72219 (comment) You can view the ticket on the following link: #60 Kind Regards, activeLAN Solutions GmbH

liza-mae added bug Fixes for quality problems that affect the customer experience blocker regression Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! labels Jul 17, 2020

legrego added the Team:AppArch label Jul 17, 2020

legrego removed the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Jul 17, 2020

liza-mae mentioned this issue Jul 17, 2020

[test-failed]: Chrome UI Functional Tests1.test/functional/apps/discover/_discover_histogram·js - discover app discover histogram "before all" hook for "should visualize monthly data with different day intervals" #72164

Closed

danhermann mentioned this issue Jul 17, 2020

Include the resolve index action in the view_index_metadata privilege elastic/elasticsearch#59785

Merged

legrego added the v7.9.0 label Jul 22, 2020

This was referenced Jul 23, 2020

[7.9] Include the resolve index action in the view_index_metadata privilege elastic/elasticsearch#60110

Merged

[7.x] Include the resolve index action in the view_index_metadata privilege elastic/elasticsearch#60112

Merged

liza-mae mentioned this issue Jul 28, 2020

[test-failed]: Chrome UI Functional Tests1.test/functional/apps/management/_index_pattern_results_sort·js - management index result field sort sort by heading - Name "before all" hook for "should sort ascending" #72169

Closed

liza-mae closed this as completed Aug 5, 2020

liza-mae mentioned this issue Aug 6, 2020

[test-failed]: Chrome UI Functional Tests1.test/functional/apps/management/_create_index_pattern_wizard·js - management "Create Index Pattern" wizard index alias can be an index pattern #74449

Closed

mradman-tildeloop mentioned this issue Oct 14, 2020

Create index pattern throws internal server error after update to v1.10.1.2 opensearch-project/security-dashboards-plugin#529

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create index pattern throws internal server error with non elastic user #72219

Create index pattern throws internal server error with non elastic user #72219

liza-mae commented Jul 17, 2020

liza-mae commented Jul 17, 2020

legrego commented Jul 17, 2020

elasticmachine commented Jul 17, 2020

danhermann commented Jul 17, 2020

legrego commented Jul 17, 2020

danhermann commented Jul 17, 2020

droberts195 commented Jul 23, 2020

kobelb commented Aug 4, 2020

liza-mae commented Aug 5, 2020

pdi-activelan commented Aug 5, 2020 via email

pdi-activelan commented Aug 5, 2020 via email

Create index pattern throws internal server error with non elastic user #72219

Create index pattern throws internal server error with non elastic user #72219

Comments

liza-mae commented Jul 17, 2020

liza-mae commented Jul 17, 2020

legrego commented Jul 17, 2020

elasticmachine commented Jul 17, 2020

danhermann commented Jul 17, 2020

legrego commented Jul 17, 2020

danhermann commented Jul 17, 2020

droberts195 commented Jul 23, 2020

kobelb commented Aug 4, 2020

liza-mae commented Aug 5, 2020

pdi-activelan commented Aug 5, 2020 via email

pdi-activelan commented Aug 5, 2020 via email