[Security Solution][Endpoint] Add RBAC to Endpoint Policy List and Policy Details pages #146480

paul-tavares · 2022-11-28T21:46:56Z

Summary

The following changes were done in support of RBAC for the policy management from security solution:
- Pages are only accessible if user has read permissions
- If user does not have read or write permissions, the link to the Policy list is remove from the Security Solution management page
- If user ONLY has read, then the Policy Details save button is removed and all form controls (ex. switches, checkboxes, etc) are disabled
- If user does not have read permissions to the Endpoint list page, then the policy list Endpoints column is displayed as plain text (no link)
Fixes a bug with the Cancel button on the Policy Details, which was redirecting the user by default to the Endpoint List - correct behavior is to redirect to the policy list by default

ℹ️ NOTE: Until the Fleet APIs can be updated to support Endpoint RBAC, this PR must be tested with fleet:all and integrations:all kibana privileges must be set

…adEndpointList` authz

…ment` is `false`

…olicyManagement`

… (should be policy list, not endpoint list by default)

…hzInitialStateMock()`

elasticmachine · 2022-11-29T21:40:09Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

…policy-list-and-details

gergoabraham

looks and works great! 👏

gergoabraham · 2022-12-01T14:19:22Z

...s/security_solution/public/management/pages/policy/view/components/policy_endpoint_count.tsx

@@ -16,10 +16,11 @@ import { getEndpointListPath, getPoliciesPath } from '../../../../common/routing
 import { APP_UI_ID } from '../../../../../../common/constants';

 /**
+ * Returns a link component that navigates to the endpoint list page filtered by a specific policy


gergoabraham · 2022-12-01T14:42:56Z

x-pack/plugins/security_solution/public/management/links.test.ts

@@ -95,106 +111,101 @@ describe('links', () => {
  });

  describe('Host Isolation Exception', () => {


awesome! thanks a lot for updating these tests!

👍

I just finished merging in your PR and how I did not loose any of your changes (I had merge conflicts 🤞 )

dasansol92

Looks great! Just left a question on a FF usage.
Also, I saw in the description gif that Host Isolation Exceptions tab appears in Policy Details page after saving it, is it expected?

dasansol92 · 2022-12-01T14:46:41Z

..._solution/public/management/pages/policy/view/policy_forms/components/policy_form_layout.tsx

@@ -61,12 +64,23 @@ export const PolicyFormLayout = React.memo(() => {
  const [showConfirm, setShowConfirm] = useState<boolean>(false);
  const [routeState, setRouteState] = useState<PolicyDetailsRouteState>();
  const policyName = policyItem?.name ?? '';
-  const hostListRouterPath = getEndpointListPath({ name: 'endpointList' });
+  const isPolicyListEnabled = useIsExperimentalFeatureEnabled('policyListEnabled');


Why do we need to check this?

Unfortunately this feature flag is still there, so we need it to determine where the user will be redirected to when they click the cancel button. If this feature is on then the default should be policy list page. Else, it should be the Endpoint list (that is what it was before).

I'm hoping that we can clean up several FF in this 8.7 release

…policy-list-and-details # Conflicts: # x-pack/plugins/security_solution/public/management/links.test.ts # x-pack/plugins/security_solution/public/management/links.ts

paul-tavares · 2022-12-01T15:09:00Z

Thanks @dasansol92 .

Re: I saw in the description gif that Host Isolation Exceptions tab appears in Policy Details page after saving it, is it expected?

I'm not sure. Probably not, but I did not touch that because there is an issue to track updating those tabs. My guess is that the authz.loading is not being checked before displaying the tabs/page. maybe.

kibana-ci · 2022-12-01T17:41:54Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 520b7dd

Failed CI Steps

Security Solution Tests #2

Test Failures

[job] [logs] Security Solution Tests #2 / Alerts detection rules table auto-refresh should disable auto refresh when any rule selected and enable it after rules unselected

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.6MB	9.7MB	+59.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	50.8KB	50.9KB	+93.0B

Unknown metric groups

async chunk count

id	before	after	diff
`securitySolution`	35	36	+1

ESLint disabled in files

id	before	after	diff
`osquery`	1	2	+1

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	19	21	+2
`fleet`	59	65	+6
`osquery`	109	115	+6
`securitySolution`	442	448	+6
total			+20

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	20	22	+2
`fleet`	68	74	+6
`osquery`	110	117	+7
`securitySolution`	519	525	+6
total			+21

History

💚 Build #91958 succeeded 395616c
💔 Build #91950 failed f67c59e7f74b678be6323403bf0d825c2d7d10f3
💔 Build #91941 failed 055f631231a760c2e105b7f31ba71910c23cd929
💔 Build #91839 failed 20c10c4df1f6a946b750a4429350d12f92114941
💔 Build #91808 failed 677a700b8afffb1e66c194b2099ed32625ed2311
💔 Build #91618 failed ae62af639d33a99942425e85a11f63abc979d8b2

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

paul-tavares added 6 commits November 28, 2022 12:26

Remove Policies from Links if Authz not allowed

a2cd9a3

Display count of endpoints as plain text if user does not have `canRe…

ba35f55

…adEndpointList` authz

remove save button from policy details

61af128

Remove policy details link from Endpoint list if `canReadPolicyManage…

cef1f86

…ment` is `false`

set Policy form inputs to disabled if user does not have `canWriteP…

400c2e5

…olicyManagement`

Fix policy details cancel button redirecting to the incorrect place…

e1aec3c

… (should be policy list, not endpoint list by default)

paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.7.0 labels Nov 28, 2022

paul-tavares self-assigned this Nov 28, 2022

paul-tavares added 4 commits November 28, 2022 17:39

links: adjust mock to calculateEndpointAuthz to use `getEndpointAut…

414473d

…hzInitialStateMock()`

Fix tests for Links

962126a

add test to LInks for policies

794eb78

Policy details jest tests

c76c2ea

paul-tavares marked this pull request as ready for review November 29, 2022 21:40

paul-tavares requested a review from a team as a code owner November 29, 2022 21:40

paul-tavares requested review from pzl and parkiino November 29, 2022 21:40

paul-tavares requested review from gergoabraham, dasansol92 and kevinlog and removed request for pzl and parkiino November 29, 2022 21:40

Merge remote-tracking branch 'upstream/main' into task/olm-4416-rbac-…

395616c

…policy-list-and-details

paul-tavares force-pushed the task/olm-4416-rbac-policy-list-and-details branch from f67c59e to 395616c Compare November 30, 2022 20:50

gergoabraham approved these changes Dec 1, 2022

View reviewed changes

dasansol92 reviewed Dec 1, 2022

View reviewed changes

paul-tavares added 2 commits December 1, 2022 09:54

Merge remote-tracking branch 'upstream/main' into task/olm-4416-rbac-…

f4d712e

…policy-list-and-details # Conflicts: # x-pack/plugins/security_solution/public/management/links.test.ts # x-pack/plugins/security_solution/public/management/links.ts

Adjust links tests after merge from upstream

520b7dd

paul-tavares requested a review from dasansol92 December 1, 2022 15:11

dasansol92 approved these changes Dec 1, 2022

View reviewed changes

paul-tavares enabled auto-merge (squash) December 1, 2022 15:32

paul-tavares merged commit d3b4d39 into elastic:main Dec 1, 2022

kibanamachine added the backport:skip This commit does not require backporting label Dec 1, 2022

paul-tavares deleted the task/olm-4416-rbac-policy-list-and-details branch December 1, 2022 20:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Add RBAC to Endpoint Policy List and Policy Details pages #146480

[Security Solution][Endpoint] Add RBAC to Endpoint Policy List and Policy Details pages #146480

paul-tavares commented Nov 28, 2022 •

edited

Loading

elasticmachine commented Nov 29, 2022

gergoabraham left a comment

gergoabraham Dec 1, 2022

gergoabraham Dec 1, 2022

paul-tavares Dec 1, 2022

dasansol92 left a comment

dasansol92 Dec 1, 2022

paul-tavares Dec 1, 2022

paul-tavares commented Dec 1, 2022 •

edited

Loading

kibana-ci commented Dec 1, 2022

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

		@@ -95,106 +111,101 @@ describe('links', () => {
		});

		describe('Host Isolation Exception', () => {

[Security Solution][Endpoint] Add RBAC to Endpoint Policy List and Policy Details pages #146480

[Security Solution][Endpoint] Add RBAC to Endpoint Policy List and Policy Details pages #146480

Conversation

paul-tavares commented Nov 28, 2022 • edited Loading

Summary

elasticmachine commented Nov 29, 2022

gergoabraham left a comment

Choose a reason for hiding this comment

gergoabraham Dec 1, 2022

Choose a reason for hiding this comment

gergoabraham Dec 1, 2022

Choose a reason for hiding this comment

paul-tavares Dec 1, 2022

Choose a reason for hiding this comment

dasansol92 left a comment

Choose a reason for hiding this comment

dasansol92 Dec 1, 2022

Choose a reason for hiding this comment

paul-tavares Dec 1, 2022

Choose a reason for hiding this comment

paul-tavares commented Dec 1, 2022 • edited Loading

kibana-ci commented Dec 1, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

Page load bundle

async chunk count

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

History

paul-tavares commented Nov 28, 2022 •

edited

Loading

paul-tavares commented Dec 1, 2022 •

edited

Loading