[BUG] Close API requires "hidden" permission

[aetter]

Describe the bug
Even with the indices:admin/close permission, you can't close an index. You also need the indices:admin/close* permission, which isn't listed in OpenSearch Dashboards.

Added: It's not clear to me if this is a problem with the OpenSearch plugin or OpenSearch Dashboards plugin. Have we considered a "list permissions" REST API (GET _plugins/_security/api/permissions/ so that it's easier to get the authoritative list of all permissions?

To Reproduce
Steps to reproduce the behavior:

1. As admin, create a new user.
2. Create test-index and index a couple documents.
3. Create the following role:

PUT https://localhost:9200/_plugins/_security/api/roles/test
{
        "cluster_permissions": [
        ],
        "index_permissions": [
            {
                "index_patterns": [
                    "test-index"
                ],
                "dls": "",
                "fls": [],
                "masked_fields": [],
                "allowed_actions": [
                    "indices:admin/close",
                    "indices:admin/open"
                ]
            }
        ]
    }

4. Map the new role to the new user.
5. As the new user, send the following request:

POST https://localhost:9200/test-index/_close

6. Note the error:

{
    "acknowledged": false,
    "shards_acknowledged": false,
    "indices": {
        "test-index": {
            "closed": false,
            "failedShards": {
                "0": {
                    "failures": [
                        {
                            "shard": 0,
                            "index": "test-index",
                            "status": "FORBIDDEN",
                            "reason": {
                                "type": "security_exception",
                                "reason": "no permissions for [indices:admin/close[s]] and User [name=test, backend_roles=[], requestedTenant=null]"
                            }
                        }
                    ]
                }
            }
        }
    }
}

7. As admin, update the role:

https://localhost:9200/_plugins/_security/api/roles/test
{
        "cluster_permissions": [
        ],
        "index_permissions": [
            {
                "index_patterns": [
                    "test-index"
                ],
                "dls": "",
                "fls": [],
                "masked_fields": [],
                "allowed_actions": [
                    "indices:admin/close",
                    "indices:admin/close*",
                    "indices:admin/open"
                ]
            }
        ]
    }

8. As the new user, send the request again:

POST https://localhost:9200/test-index/_close

Success.

Expected behavior
The indices:admin/close* permission should either not be necessary or should be included in the Dashboards UI.

[stephen-crawford]

[Triage] Hi @shanilpa, do you have any thoughts on how to best handle this issue?

This issue remains relevant. Users given an error stating they need a permission should be able to assign that permission from the list. There are also "hidden" permissions which are not intuitive.

1. Make permissions not hidden (i.e. permissible actions in the YAML file of the security plugin)
2. Add permission being missed to drop-down list

[shanilpa]

@scrawfor99 A couple of clarifying questions here before I make any UX recommendations.

1. It looks like we are already working on making these "hidden" permissions available in the dropdown as mentioned in this issue. Am I missing something here? Are these permissions special and need to be treated differently from the others?

2. "Users given an error stating they need a permission should be able to assign that permission from the list.

As I understand it only an admin user has access to the Dashboards security plugin therefore they are the only ones that can assign permissions. I think it would be very risky to allow any user to self assign permissions from the list. Not sure I fully get what you meant by this statement, could you clarify?

[gaiksaya]

Hi @opensearch-project/security,
This issue was tagged for 2.6.0. Can you close it if it was resolved or tag is to be tracked for next iteration?
Thanks!

[cwperks]

This is released in 2.6.0. Closing issue.