Feature Request: Multiple roles and field anonymization

[ZhiXingHeYiApple]

Hi

Now when I use the latest version(1.10.1) of opendisto elasticsearch, I find field masking can not work well, as with document-level security, if a user is member of multiple roles it is important to understand how the field anonymization (FA) settings for these roles are combined.
In case of FA, the FA field definitions of the roles are combined with AND.

But if a user has a role that defines FA restrictions on an index, and another role that does not place any FA restrictions on the same index, the restrictions defined in the first role still apply. Is it possible to implement feature like search guard, which change that behaviour so that a role that places no restrictions on an index removes any restrictions from other roles. That can be enabled in elasticsearch.yml:

searchguard.dfm_empty_overrides_all: true

Search Guard - Multiple roles and field anonymization
thanks!

[nateynateynate]

Hi @ZhiXingHeYiApple - if I'm not asking too much, do you mind trying again with the latest OpenSearch to see if the newest version meets your needs? The Opensearch Project has superseded ODFE.

I'm going to go ahead and close this one out, but please feel free to reopen.

[cliu123]

This issue should have been resolved along with the #1735.