Skip to content

Share indices resolution code with elasticsearch core #29915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
elasticmachine opened this issue Feb 10, 2017 · 0 comments
Open

Share indices resolution code with elasticsearch core #29915

elasticmachine opened this issue Feb 10, 2017 · 0 comments
Labels
>non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team

Comments

@elasticmachine
Copy link
Collaborator

Original comment by @javanna:

As a followup of LINK REDACTED, which effectively aligns indices resolution in security with the standard es behaviour, we should investigate sharing code around indices resolution with elasticsearch. The main thing about security is that _all is converted to all the indices that the current user is authorized for, same for wildcards expansion, but all the rest is the same. We should be able to add a public method to MetaData in es core that instead of relying internally on the cluster state, takes as an argument all the available indices. That way es core can call this method and provide the indices retrieved from the cluster state, while security can call it providing the filtered indices based on its own logic. After that, all of the matching logic should be the same. This would allow to remove quite some duplicated code from security. I also noticed that the restore api in es core duplicates the indices resolution code once again (in SnapshotUtils) for a very similar reason. Fixes that we applied to indices resolution in core didn't go to restore, which is quite bad. This change would allow to improve the restore api in core as well and remove code there too.

I meant to do this a while ago but I got trapped with all kinds of security bugs around indices resolution and never got to it. I am happy to work on this, I just have to find some time to do it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team
Projects
None yet
Development

No branches or pull requests

3 participants