Authorized route migration for routes owned by kibana-security

[kibanamachine]

Authz API migration for authorized routes

This PR migrates access:<privilege> tags used in route definitions to new security configuration.
Please refer to the documentation for more information: Authorization API

Before migration:

Access control tags were defined in the options object of the route:

router.get({
  path: '/api/path',
  options: {
    tags: ['access:<privilege_1>', 'access:<privilege_2>'],
  },
  ...
}, handler);

After migration:

Tags have been replaced with the more robust security.authz.requiredPrivileges field under security:

router.get({
  path: '/api/path',
  security: {
    authz: {
      requiredPrivileges: ['<privilege_1>', '<privilege_2>'],
    },
  },
  ...
}, handler);

What to do next?

1. Review the changes in this PR.
2. You might need to update your tests to reflect the new security configuration:

• If you have tests that rely on checking access tags.
• If you have snapshot tests that include the route definition.
• If you have FTR tests that rely on checking unauthorized error message. The error message changed to also include missing privileges.

Any questions?

If you have any questions or need help with API authorization, please reach out to the @elastic/kibana-security team.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 2c317d6

Failed CI Steps

• Jest Tests #9
• Jest Tests #9
• FTR Configs #50
• FTR Configs #50
• FTR Configs #53
• FTR Configs #53
• FTR Configs #80
• FTR Configs #80
• FTR Configs #85
• FTR Configs #85

Test Failures

• [job] [logs] Jest Tests #9 / Bulk get profile routes get user profiles by their ids correctly defines route.
• [job] [logs] Jest Tests #9 / Bulk get profile routes get user profiles by their ids correctly defines route.
• [job] [logs] FTR Configs #50 / copy to space with security copy to spaces user with no access from the default space single-namespace types should return 403 when copying to space without conflicts or references
• [job] [logs] FTR Configs #53 / copy to space with security copy to spaces user with no access from the default space single-namespace types should return 403 when copying to space without conflicts or references
• [job] [logs] FTR Configs #53 / copy to space with security copy to spaces user with no access from the default space single-namespace types should return 403 when copying to space without conflicts or references
• [job] [logs] FTR Configs #50 / copy to space with security copy to spaces user with no access from the default space single-namespace types should return 403 when copying to space without conflicts or references
• [job] [logs] Jest Tests #9 / GET /internal/spaces/{spaceId}/content_summary correctly defines route.
• [job] [logs] Jest Tests #9 / GET /internal/spaces/{spaceId}/content_summary correctly defines route.
• [job] [logs] Jest Tests #9 / GET all roles by space id correctly defines route.
• [job] [logs] Jest Tests #9 / GET all roles by space id correctly defines route.
• [job] [logs] Jest Tests #9 / Invalidate sessions routes invalidate sessions correctly defines route.
• [job] [logs] Jest Tests #9 / Invalidate sessions routes invalidate sessions correctly defines route.
• [job] [logs] FTR Configs #80 / spaces api with security resolve copy to spaces conflicts user with no access from the default space single-namespace types should return 403 when not overwriting, with references
• [job] [logs] FTR Configs #85 / spaces api with security resolve copy to spaces conflicts user with no access from the default space single-namespace types should return 403 when not overwriting, with references
• [job] [logs] FTR Configs #80 / spaces api with security resolve copy to spaces conflicts user with no access from the default space single-namespace types should return 403 when not overwriting, with references
• [job] [logs] FTR Configs #85 / spaces api with security resolve copy to spaces conflicts user with no access from the default space single-namespace types should return 403 when not overwriting, with references

Metrics [docs]

✅ unchanged

History

[kibanamachine]

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11628815393

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 198380

Questions ?

Please refer to the Backport tool documentation

[elena-shostak]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation