[ML] Retain built-in ML roles granting Kibana privileges #80014

droberts195 · 2021-10-28T12:05:41Z

The machine_learning_admin and machine_learning_user roles
in Elasticsearch also grant access to the ML pages in Kibana.

At one time it was intended that this should change in 8.0,
so that ML privileges in Kibana would be completely separate.

However, our thinking has now changed. An administrator cannot
give a user the Elasticsearch backend roles and expect Kibana
privileges alone to then stop that user from using ML - the
user could just switch to curl or even Kibana dev console (which
uses backend privileges rather than Kibana privileges). So it's
clearer what is really being permitted if the backend roles
continue to allow access to the ML UI as well as the ML backend
endpoints. There's nothing the user can see in the ML UI that
they couldn't find out by calling ML Elasticsearch endpoints
directly and rendering the responses in a more graphical way.

The machine_learning_admin and machine_learning_user roles in Elasticsearch also grant access to the ML pages in Kibana. At one time it was intended that this should change in 8.0, so that ML privileges in Kibana would be completely separate. However, our thinking has now changed. An administrator cannot give a user the Elasticsearch backend roles and expect Kibana privileges alone to then stop that user from using ML - the user could just switch to curl or even Kibana dev console (which uses backend privileges rather than Kibana privileges). So it's clearer what is really being permitted if the backend roles continue to allow access to the ML UI as well as the ML backend endpoints. There's nothing the user can see in the ML UI that they couldn't find out by calling ML Elasticsearch endpoints directly and rendering the responses in a more graphical way.

elasticmachine · 2021-10-28T12:05:44Z

Pinging @elastic/ml-core (Team:ML)

benwtrent · 2021-10-28T12:13:42Z

x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlDailyMaintenanceService.java

@@ -141,7 +141,7 @@ public void close() {
        stop();
    }

-    private synchronized void scheduleNext() {
+    private synchronized void  scheduleNext() {


Suggested change

private synchronized void scheduleNext() {

private synchronized void scheduleNext() {

The machine_learning_admin and machine_learning_user roles in Elasticsearch also grant access to the ML pages in Kibana. At one time it was intended that this should change in 8.0, so that ML privileges in Kibana would be completely separate. However, our thinking has now changed. An administrator cannot give a user the Elasticsearch backend roles and expect Kibana privileges alone to then stop that user from using ML - the user could just switch to curl or even Kibana dev console (which uses backend privileges rather than Kibana privileges). So it's clearer what is really being permitted if the backend roles continue to allow access to the ML UI as well as the ML backend endpoints. There's nothing the user can see in the ML UI that they couldn't find out by calling ML Elasticsearch endpoints directly and rendering the responses in a more graphical way.

elasticsearchmachine · 2021-10-28T13:23:58Z

💚 Backport successful

Status	Branch	Result
✅	8.0
✅	7.16

The machine_learning_admin and machine_learning_user roles in Elasticsearch also grant access to the ML pages in Kibana. At one time it was intended that this should change in 8.0, so that ML privileges in Kibana would be completely separate. However, our thinking has now changed. An administrator cannot give a user the Elasticsearch backend roles and expect Kibana privileges alone to then stop that user from using ML - the user could just switch to curl or even Kibana dev console (which uses backend privileges rather than Kibana privileges). So it's clearer what is really being permitted if the backend roles continue to allow access to the ML UI as well as the ML backend endpoints. There's nothing the user can see in the ML UI that they couldn't find out by calling ML Elasticsearch endpoints directly and rendering the responses in a more graphical way.

…0019) The machine_learning_admin and machine_learning_user roles in Elasticsearch also grant access to the ML pages in Kibana. At one time it was intended that this should change in 8.0, so that ML privileges in Kibana would be completely separate. However, our thinking has now changed. An administrator cannot give a user the Elasticsearch backend roles and expect Kibana privileges alone to then stop that user from using ML - the user could just switch to curl or even Kibana dev console (which uses backend privileges rather than Kibana privileges). So it's clearer what is really being permitted if the backend roles continue to allow access to the ML UI as well as the ML backend endpoints. There's nothing the user can see in the ML UI that they couldn't find out by calling ML Elasticsearch endpoints directly and rendering the responses in a more graphical way.

…formance * upstream/master: (153 commits) [ML] update truncation default & adding field output when input is truncated (elastic#79942) [ML] stop using isAllowedByLicense for model license checks (elastic#79908) [ML] Retain built-in ML roles granting Kibana privileges (elastic#80014) [Transform] remove old mixed cluster BWC layers, not required for 8x (elastic#79927) Increase test timeout for CoordinatorTests testAllSearchesExecuted [Transform] add rolling upgrade tests for upgrade endpoint (elastic#79721) [ML] Update trained model docs for truncate parameter for bert tokenization (elastic#79652) `CoordinatorTests` sometimes needs three term bumps (elastic#79574) [ML] Account for service being triggered twice in tests (elastic#80000) SearchContext: remove unused variable (elastic#79917) Revert "Deprecate resolution loss on date field (elastic#78921)" (elastic#79914) Re-enable GeoIpDownloaderIT#testStartWithNoDatabases() (elastic#79907) Fix SnapshotBasedIndexRecoveryIT#testSeqNoBasedRecoveryIsUsedAfterPrimaryFailOver (elastic#79469) Fix RecoverySourceHandlerTests (elastic#79546) SQL: stabilize SqlSearchPageTimeoutIT (elastic#79928) Wait 3 seconds for the server to reload trust (elastic#79778) Skip automatically preserved request headers when rewriting (elastic#79973) Check whether stdout is a real console (elastic#79882) Convert remote license checker to use LicensedFeature (elastic#79876) Miscellaneous fixes for LDAP SDK v6 upgrade (elastic#79891) ... # Conflicts: # libs/x-content/src/main/java/org/elasticsearch/xcontent/support/filtering/FilterPath.java # libs/x-content/src/test/java/org/elasticsearch/xcontent/support/filtering/FilterPathGeneratorFilteringTests.java # libs/x-content/src/test/java/org/elasticsearch/xcontent/support/filtering/FilterPathTests.java

…0018) The machine_learning_admin and machine_learning_user roles in Elasticsearch also grant access to the ML pages in Kibana. At one time it was intended that this should change in 8.0, so that ML privileges in Kibana would be completely separate. However, our thinking has now changed. An administrator cannot give a user the Elasticsearch backend roles and expect Kibana privileges alone to then stop that user from using ML - the user could just switch to curl or even Kibana dev console (which uses backend privileges rather than Kibana privileges). So it's clearer what is really being permitted if the backend roles continue to allow access to the ML UI as well as the ML backend endpoints. There's nothing the user can see in the ML UI that they couldn't find out by calling ML Elasticsearch endpoints directly and rendering the responses in a more graphical way. Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

droberts195 added >non-issue :ml Machine learning v8.0.0 v7.16.1 v8.1.0 labels Oct 28, 2021

elasticmachine added the Team:ML Meta label for the ML team label Oct 28, 2021

benwtrent reviewed Oct 28, 2021

View reviewed changes

Revert accidental change

396e716

benwtrent approved these changes Oct 28, 2021

View reviewed changes

droberts195 added the auto-backport-and-merge Automatically create backport pull requests and merge when ready label Oct 28, 2021

droberts195 merged commit 499f84a into elastic:master Oct 28, 2021

droberts195 deleted the change_priv_comments branch October 28, 2021 13:22

droberts195 mentioned this pull request Oct 28, 2021

[8.0] [ML] Retain built-in ML roles granting Kibana privileges (#80014) #80018

Merged

droberts195 mentioned this pull request Oct 28, 2021

[7.16] [ML] Retain built-in ML roles granting Kibana privileges (#80014) #80019

Merged

danhermann added v7.16.0 and removed v7.16.1 labels Nov 3, 2021

jakelandis added v8.0.0-beta1 and removed v8.0.0 labels Nov 8, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ML] Retain built-in ML roles granting Kibana privileges #80014

[ML] Retain built-in ML roles granting Kibana privileges #80014

droberts195 commented Oct 28, 2021

elasticmachine commented Oct 28, 2021

benwtrent Oct 28, 2021

elasticsearchmachine commented Oct 28, 2021

	private synchronized void scheduleNext() {
	private synchronized void scheduleNext() {

[ML] Retain built-in ML roles granting Kibana privileges #80014

[ML] Retain built-in ML roles granting Kibana privileges #80014

Conversation

droberts195 commented Oct 28, 2021

elasticmachine commented Oct 28, 2021

benwtrent Oct 28, 2021

Choose a reason for hiding this comment

elasticsearchmachine commented Oct 28, 2021

💚 Backport successful