Remove securityOss plugin #113946

jportner · 2021-10-05T14:40:58Z

Note: we don't ship the OSS distribution anymore, but the security plugin can be disabled in 7.16 (it won't be disable-able in 8.0+).
If someone is using the Default distribution of 7.16 and they have the security plugin disabled, then they won't see the Security Checkup message when they open Kibana for the first time. This edge case is an acceptable tradeoff to eliminating an entire plugin that we don't need anymore.

This PR also deprecates the security.showInsecureClusterWarning: false setting, renaming it to xpack.security.showInsecureClusterWarning: false. This setting does not appear in our documentation.

Testing

Existing functionality was refactored, here are the steps to test and make sure it still works as expected.

1. Insecure cluster toast

Kibana shows the toast when all three of these conditions are true:

The warning is enabled in kibana.yml (default),
Security is disabled, and
Kibana has some data in the cluster that is not sample data

To test this:

Start Elasticsearch with security disabled: yarn es snapshot -E xpack.security.enabled=false
Start Kibana
Navigate to Dev Tools and add this staging data:
```
POST foo/_doc
{ "bar": "baz" }
```
Reload the page

You should see the toast now.
You can dismiss the toast, or you can disable the warning in kibana.yml using either security.showInsecureClusterWarning: false or xpack.security.showInsecureClusterWarning: false.
(I deprecated the former in favor of the latter)

2. Share Public URL

When anonymous access is enabled with another form of authentication, using the Share menu on a supported app (such as Dashboard) should show a switch for the Public URL. Enabling that will add an auth provider hint for the anonymous auth provider.

To test this:

Configure Kibana with anonymous access:

xpack.security.authc.providers:
  basic.basic1:
    order: 0
  anonymous.anonymous1:
    order: 1
    credentials:
      username: "elastic"
      password: "changeme"

Start Elasticsearch and Kibana, and add some sample data
View a Dashboard, click Share, and verify that the Public URL switch is displayed

If you configure Kibana without the anonymous auth provider, or with only the anonymous auth provider, the switch should not be displayed.

State includes access URL parameters and whether or not anonymous access is enabled. Moved the server and client side code, and updated the share plugin consumer accordingly. Got rid of a bit of dead code in the process.

The securityOss plugin provided an insecure cluster service that the security plugin augmented using its own security checkup service. I combined the two into the latter. That was the last dependency on the securityOss plugin, so this allowed me to completely remove the plugin.

jportner

Author's notes for reviewers.

x-pack/plugins/security/public/mocks.ts

x-pack/plugins/security/server/routes/security_checkup/get_state.ts

x-pack/plugins/security/public/anonymous_access/anonymous_access_service.ts

x-pack/plugins/security/public/security_checkup/security_checkup_service.tsx

The insecure cluster warning could be shown in two different scenarios: 1. The Kibana security plugin is not available 2. Kibana security is available, but Elasticsearch security is disabled Scenario 1 is no longer possible with this PR. Scenario 2 never had a functional test suite because up to this point we did not have a way to run the functional test server in that manner. This commit removes the tests for Scenario 1, and we'll need to add new tests for Scenario 2 in the 8.0 release when our functional testing tooling supports it.

jportner · 2021-10-06T02:34:19Z

I had to remove the functional tests as described in bc8ac43:

The insecure cluster warning could be shown in two different scenarios:

The Kibana security plugin is not available

Kibana security is available, but Elasticsearch security is disabled

Scenario 1 is no longer possible with this PR. Scenario 2 never had a
functional test suite because up to this point we did not have a way to
run the functional test server in that manner.

This commit removes the tests for Scenario 1, and we'll need to add new
tests for Scenario 2 in the 8.0 release when our functional testing
tooling supports it.

I'll create an issue for adding the new functional tests, and update this comment with a link.

Edit: tracking this in #114049.

legrego

Tested locally, everything seems to be working as expected. I just have a couple of minor comments below, but otherwise looking good!

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

x-pack/plugins/security/public/security_checkup/security_checkup_service.tsx

x-pack/plugins/security/public/security_checkup/security_checkup_service.test.ts

x-pack/plugins/security/public/plugin.tsx

x-pack/plugins/security/server/config_deprecations.ts

x-pack/plugins/security/server/routes/security_checkup/get_state.ts

legrego

LGTM, thanks for the edits!

kibanamachine · 2021-10-07T00:22:09Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`security`	457	459	+2
`securityOss`	11	-	-11
total			-9

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`securityOss`	9	-	-9

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`securityOss`	3	-	-3

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`security`	49.4KB	51.3KB	+1.9KB
`securityOss`	6.2KB	-	-6.2KB
`share`	53.8KB	54.0KB	+227.0B
total			-4.1KB

Unknown metric groups

API count

id	before	after	diff
`securityOss`	12	-	-12
`share`	137	143	+6
total			-6

History

💛 Build #158520 was flaky c8cefd8
💚 Build #158283 succeeded bc8ac43
💔 Build #158204 failed 126d1fb
💔 Build #158130 failed 123cc98d4ac64a0bb3df5269257c2bea9c397e4c
💚 Build #158048 succeeded 3fa7f2ca7e84ea08eefbae2010952a2c9e2ec35e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

vadimkibana

AppServices code changes LGTM.

kibanamachine · 2021-10-07T15:58:00Z

💔 Backport failed

The backport operation could not be completed due to the following error:
The PR #113946 is not merged

The backport PRs will be merged automatically after passing CI.

To backport manually run:
node scripts/backport --pr 113946

# Conflicts: # .eslintrc.js # .github/CODEOWNERS # api_docs/security_oss.mdx # packages/kbn-optimizer/limits.yml # scripts/functional_tests.js # x-pack/plugins/translations/translations/ja-JP.json # x-pack/plugins/translations/translations/zh-CN.json

* Remove securityOss plugin (#113946) # Conflicts: # .eslintrc.js # .github/CODEOWNERS # api_docs/security_oss.mdx # packages/kbn-optimizer/limits.yml # scripts/functional_tests.js # x-pack/plugins/translations/translations/ja-JP.json # x-pack/plugins/translations/translations/zh-CN.json * Add unintentionally removed translations * Fix jest test

jportner added 2 commits October 5, 2021 09:45

Move anonymous access get capabilities route

33a0413

Move anonymous access get state

9a2f8e3

State includes access URL parameters and whether or not anonymous access is enabled. Moved the server and client side code, and updated the share plugin consumer accordingly. Got rid of a bit of dead code in the process.

jportner added v8.0.0 auto-backport Deprecated - use backport:version if exact versions are needed v7.16.0 labels Oct 5, 2021

jportner added 2 commits October 5, 2021 17:25

Invert dependency between security and share plugins

bbb5d3a

jportner force-pushed the issue-104152-remove-security_oss-plugin branch from 123cc98 to 126d1fb Compare October 5, 2021 21:25

jportner commented Oct 5, 2021

View reviewed changes

jportner mentioned this pull request Oct 6, 2021

Add functional tests for insecure cluster warning #114049

Closed

jportner marked this pull request as ready for review October 6, 2021 02:39

jportner requested review from a team as code owners October 6, 2021 02:39

jportner requested a review from vadimkibana October 6, 2021 02:43

jportner added release_note:skip Skip the PR/issue when compiling release notes release_note:deprecation and removed release_note:skip Skip the PR/issue when compiling release notes release_note:deprecation labels Oct 6, 2021

tylersmalley approved these changes Oct 6, 2021

View reviewed changes

legrego reviewed Oct 6, 2021

View reviewed changes

jportner added 2 commits October 6, 2021 09:18

Merge branch 'master' into pr/jportner/113946

47bd48e

PR review feedback

c8cefd8

jportner requested a review from legrego October 6, 2021 18:41

Merge branch 'master' into pr/jportner/113946

69814f6

jportner mentioned this pull request Oct 6, 2021

[meta] Improve deprecation warnings for plugins without an enabled config in 8.0. #114188

Closed

100 tasks

legrego approved these changes Oct 6, 2021

View reviewed changes

jportner enabled auto-merge (squash) October 7, 2021 14:56

vadimkibana approved these changes Oct 7, 2021

View reviewed changes

jportner merged commit 64f37e7 into elastic:master Oct 7, 2021

jportner deleted the issue-104152-remove-security_oss-plugin branch October 7, 2021 16:01

jportner mentioned this pull request Oct 7, 2021

[7.x] Remove securityOss plugin (#113946) #114322

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove securityOss plugin #113946

Remove securityOss plugin #113946

jportner commented Oct 5, 2021 •

edited

Loading

jportner left a comment

jportner commented Oct 6, 2021 •

edited

Loading

legrego left a comment

legrego left a comment

kibanamachine commented Oct 7, 2021

API count

vadimkibana left a comment

kibanamachine commented Oct 7, 2021

Remove securityOss plugin #113946

Remove securityOss plugin #113946

Conversation

jportner commented Oct 5, 2021 • edited Loading

Testing

1. Insecure cluster toast

2. Share Public URL

jportner left a comment

Choose a reason for hiding this comment

jportner commented Oct 6, 2021 • edited Loading

legrego left a comment

Choose a reason for hiding this comment

legrego left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 7, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Public APIs missing exports

Page load bundle

API count

History

vadimkibana left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 7, 2021

💔 Backport failed

jportner commented Oct 5, 2021 •

edited

Loading

jportner commented Oct 6, 2021 •

edited

Loading