Register `kibana_dashboard_only_user` and `kibana_user` roles deprecations in UA. #110960

azasypkin · 2021-09-02T11:00:19Z

Summary

Register kibana_dashboard_only_user and kibana_user roles deprecations in UA.

Screenshots

There are 2 different deprecations, but each affects 2 slightly different parts of the Kibana (users and role mappings) and hence will be handled differently. That's why we see 2 pairs of entries with the same title in the main Upgrade Assistant list view. The detailed description, as you'll see below, is different for every entry though:

Detailed view for list entry №1:

Detailed view for list entry №2:

Detailed view for list entry №3:

Detailed view for list entry №4:

**Previous screenshots**

Detailed view for list entry №1:

Detailed view for list entry №2:

Detailed view for list entry №3:

Detailed view for list entry №4:

Fixes #81690
Fixes #54755
Fixes #42853

azasypkin · 2021-09-10T05:55:08Z

NOTE to myself: We all should agree how we use quotes/brackets in UA messages (always use " maybe?). Right now we have this (and it looks awful):

Setting "plugins.scanDirs" is deprecated
Config key [monitoring.cluster_alerts.email_notifications.email_address] will be required
Set 'xpack.reporting.roles.enabled' to
The `kibana_dashboard_only_user` role is removed
xpack.reporting has a deprecated setting

cc @gchaps (Sorry for the noise, just noticed we already mandate using " for setting names in Deprecation messages guidelines 🎉, I assume we should use " for reserved terms and user/role names too? )

…tions in UA.

azasypkin · 2021-09-10T06:31:44Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

@@ -0,0 +1,244 @@
+/*


note: I don't try to analyze Advanced Settings to figure out if users change default role for the Dashboard only mode as it turned out to be a non-trivial task: as far as I'm aware we cannot use UI Settings client to retrieve settings from all spaces, and at the same time we cannot use SO Client directly since we need to account for UI Settings overrides coming from predefined defaults and kibana.yml. It feels like the amount of complexity wouldn't be justified for this deprecation.

azasypkin · 2021-09-10T06:33:54Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

+  const title = i18n.translate(
+    'xpack.security.deprecations.kibanaDashboardOnlyUser.deprecationTitle',
+    {
+      defaultMessage: 'The "{roleName}" role is removed',


note: I use the same title for all cases, including fetch_error. It feels reasonable to me since we know what deprecation exactly we want to handled, but I'm not sure if we have any best practices here.

I think using the same title for all cases is fine. The title isn't even shown for the fetch error anyway.

I'd personally recommend moving the translation to the top level scope so you're only defining it once.

I'd personally recommend moving the translation to the top level scope so you're only defining it once.

IIRC i18n might not work well with any label you define at the file level (it will always be in English) since file require may happen before we asynchronously initialize translations in i18n (it's OK for the client side though). I haven't heard of it being improved, but my knowledge may be outdated.

But we can have a global function to return this label, I'll go this route.

IIRC i18n might not work well with any label you define at the file level (it will always be in English) since file require may happen before we asynchronously initialize translations in i18n (it's OK for the client side though). I haven't heard of it being improved, but my knowledge may be outdated.

TIL!

azasypkin · 2021-09-10T06:35:30Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

+          },
+        }
+      ),
+      level: 'warning',


question: if I understand correctly we should not use critical here since it doesn't really blocks upgrade?

azasypkin · 2021-09-10T06:39:58Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

+        return [];
+      }
+
+      return [


note: I split role mappings and users related cases in two separate deprecation entries. I don't like that it has the same name in the UA table, but apart from that the finer granularity fits nicely here (since user needs to use different screens during manual resolution).

azasypkin · 2021-09-10T06:43:28Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+        values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },
+      }),
+      message: i18n.translate('xpack.security.deprecations.kibanaUser.usersDeprecationMessage', {
+        defaultMessage:


note: I'd better suggest using custom roles with more precise Kibana privileges set, and only use kibana_admin as the last resort, but I couldn't figure out how to keep it short, concise and not confusing.

I agree, let's keep it simple

azasypkin · 2021-09-10T06:52:27Z

Hey @jportner , would you mind giving a preliminary feedback here? Handling of these two deprecations cover quite a few use cases (e.g. failure to perform a deprecation check, quick resolve action etc.) we may see in other places too, and it'd be great to have a formal agreement on how we handle all these cases.

azasypkin · 2021-09-10T09:13:08Z

x-pack/plugins/security/server/routes/deprecations/kibana_user_role.ts

+      if (usersWithKibanaUserRole.length === 0) {
+        logger.debug(`No users with "${KIBANA_USER_ROLE_NAME}" role found.`);
+      } else {
+        logger.debug(


question: are we concerned with mentioning user names in the logs in this case?

Seeing as these are debug logs, and they will only be generated by authorized users who use the upgrade assistant, I think this is OK.

jportner · 2021-09-17T20:10:59Z

I'm planning to review this when I return on Sep 27 👍

elasticmachine · 2021-10-13T12:44:15Z

Pinging @elastic/kibana-security (Team:Security)

jportner · 2021-10-14T03:11:14Z

Time got away from me today, will plan to review first thing tomorrow 👍

jportner

A couple of nits on wording and docs links, other than that I think this is ready!

jportner · 2021-10-14T14:13:53Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+        defaultMessage:
+          'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',
+        values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },


I suggest shortening this

Suggested change

defaultMessage:

'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',

values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },

defaultMessage: 'The "{userRoleName}" role is deprecated',

values: { userRoleName: KIBANA_USER_ROLE_NAME },

It was actually inspired by the example from deprecation guide: The timezone Xyz used by Rollup job Abc is deprecated. Use Tz instead.. But I'm fine with either honestly - will change.

jportner · 2021-10-14T14:14:29Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+      }),
+      message: i18n.translate('xpack.security.deprecations.kibanaUser.usersDeprecationMessage', {
+        defaultMessage:
+          'Use a "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',


s/a/the/

Suggested change

'Use a "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

jportner · 2021-10-14T14:22:34Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+      }),
+      level: 'warning',
+      deprecationType: 'feature',
+      documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-security-authorization.html`,


I think it would be better to direct users to the "Built-in roles" page, which describes both the deprecated role and the new one:

Suggested change

documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-security-authorization.html`,

documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${packageInfo.branch}/built-in-roles.html`,

jportner · 2021-10-14T14:23:15Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+        defaultMessage:
+          'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',
+        values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },


Same as above

Suggested change

defaultMessage:

'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',

values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },

defaultMessage: 'The "{userRoleName}" role is deprecated',

values: { userRoleName: KIBANA_USER_ROLE_NAME },

jportner · 2021-10-14T14:23:27Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+        'xpack.security.deprecations.kibanaUser.roleMappingsDeprecationMessage',
+        {
+          defaultMessage:
+            'Use a "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',


Same as above

Suggested change

'Use a "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

jportner · 2021-10-14T14:23:45Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+      ),
+      level: 'warning',
+      deprecationType: 'feature',
+      documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-security-authorization.html`,


Same as above

Suggested change

documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-security-authorization.html`,

documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${packageInfo.branch}/built-in-roles.html`,

jportner · 2021-10-14T14:25:39Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

+      ),
+      level: 'warning',
+      deprecationType: 'feature',
+      documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-dashboard-only-mode.html`,


Sorry to ask you to change this again:

Suggested change

documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-dashboard-only-mode.html`,

documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${packageInfo.branch}/built-in-roles.html`,

jportner · 2021-10-14T14:25:56Z

x-pack/plugins/security/server/deprecations/kibana_dashboard_only_role.ts

+      ),
+      level: 'warning',
+      deprecationType: 'feature',
+      documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-dashboard-only-mode.html`,


Same as above

Suggested change

documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-dashboard-only-mode.html`,

documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${packageInfo.branch}/built-in-roles.html`,

jportner · 2021-10-14T14:36:31Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+    defaultMessage: 'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',
+    values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },


I missed this in my review! Since it uses the same i18n key, the defaultMessage needs to be the same:

Suggested change

defaultMessage: 'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',

values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },

defaultMessage: 'The "{userRoleName}" role is deprecated',

values: { userRoleName: KIBANA_USER_ROLE_NAME },

…inks.

jportner

Sorry, I messed up a couple things in my previous review, see below 🙈

jportner · 2021-10-14T18:04:21Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+      title: getDeprecationTitle(),
+      message: i18n.translate('xpack.security.deprecations.kibanaUser.usersDeprecationMessage', {
+        defaultMessage:
+          'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',


I'm so sorry, I messed up. I forgot that we aren't actually removing the kibana_user role in 8.0 (see #111160).

So we should probably change this message accordingly:

Suggested change

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in a future release.',

Great catch, thanks! I should have read this table more attentively.

jportner · 2021-10-14T18:04:40Z

x-pack/plugins/security/server/deprecations/kibana_user_role.ts

+        'xpack.security.deprecations.kibanaUser.roleMappingsDeprecationMessage',
+        {
+          defaultMessage:
+            'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',


Same as above

Suggested change

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in a future release.',

Fixed and updated screenshots

gchaps · 2021-10-15T19:57:32Z

With help from @jportner, here are some edits:

(No 1)

The "kibana_dashboard_only_user" role is deprecated

Users with the "kibana_dashboard_only_user" role will not be able to access the Dashboard app. Use Kibana privileges instead.

Create a custom role with Kibana privileges to grant access to Dashboard only.
Remove the "kibana_dashboard_only_user" role from all users and add the custom role. The affected users are:

(No 2)

The "kibana_dashboard_only_user" role is deprecated

Users with the "kibana_dashboard_only_user" role will not be able to access the Dashboard app. Use Kibana privileges instead.

Create a custom role with Kibana privileges to grant access to Dashboard only.
Remove the "kibana_dashboard_only_user" role from all role mappings and add the custom role. The affected users are:

(No 3)

The "kibana_user" role is deprecated

Use the "kibana_admin" role to grant access to all Kibana features in all spaces.

Remove the "kibana_user" role from all users and add the "kibana_admin" role. The affected users are:

(No 4)

The "kibana_user" role is deprecated

Use the "kibana_admin" role to grant access to all Kibana features in all spaces.

Remove the "kibana_user" role from all role mappings and add the "kibana_admin" role. The affected role mappings are:

Note

I removed the line "xxx will be removed in a future release." Our guidelines say "You do not need to include any form of "and will be removed in a future release".

If an item is deprecated, but won’t be removed in the next major version, the message should indicate that:

Note: Support for the "kibana_user" role will be removed following the release of n.0.

azasypkin · 2021-10-18T12:53:08Z

<--- JS stacktrace --->

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

Looks unrelated.

azasypkin · 2021-10-18T12:53:17Z

@elasticmachine merge upstream

azasypkin · 2021-10-18T12:53:56Z

With help from @jportner, here are some edits:

Thanks @gchaps and @jportner! Updated messages and the screenshots.

jportner

LGTM, sorry for all the back-and-forth, we had some confusion regarding the deprecation message guidance!

kibanamachine · 2021-10-18T15:08:27Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`security`	51	54	+3

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`security`	7	8	+1

Unknown metric groups

API count

id	before	after	diff
`security`	113	116	+3

History

💔 Build #416 failed 7fd0a88
💚 Build #338 succeeded f4026be
💚 Build #329 succeeded 921aff2
💚 Build #272 succeeded 98f000a
💚 Build #264 succeeded 7d9b3e5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

gchaps

updated screenshots lgtm

azasypkin added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! deprecation_warnings Feature:Security/Authorization Platform Security - Authorization 7.16 candidate labels Sep 2, 2021

azasypkin force-pushed the issue-xxx-role-deprecations branch 3 times, most recently from a791bca to 91ff082 Compare September 9, 2021 14:30

azasypkin changed the base branch from master to 7.x September 9, 2021 14:37

azasypkin force-pushed the issue-xxx-role-deprecations branch from 91ff082 to 36634ff Compare September 9, 2021 14:38

azasypkin added v7.16.0 and removed 7.16 candidate labels Sep 9, 2021

azasypkin force-pushed the issue-xxx-role-deprecations branch from 36634ff to 3d508ea Compare September 9, 2021 16:30

azasypkin force-pushed the issue-xxx-role-deprecations branch 2 times, most recently from f07374f to e686c81 Compare September 10, 2021 06:16

Register kibana_dashboard_only_user and kibana_user roles depreca…

19267a9

…tions in UA.

azasypkin force-pushed the issue-xxx-role-deprecations branch from e686c81 to 19267a9 Compare September 10, 2021 06:28

azasypkin commented Sep 10, 2021

View reviewed changes

azasypkin requested a review from jportner September 10, 2021 06:43

azasypkin commented Sep 10, 2021

View reviewed changes

azasypkin mentioned this pull request Sep 10, 2021

[Meta] Platform Security team - 8.0 upgrade work #111160

Closed

jportner mentioned this pull request Sep 28, 2021

Allow ConfigDeprecationProvider functions to access current "branch" #112221

Closed

cjcenizal mentioned this pull request Sep 28, 2021

[Meta] 8.0 Kibana deprecations #109166

Closed

jportner mentioned this pull request Sep 28, 2021

Upgrade assistant shows duplicate plugin names for fetch_error deprecation level #113330

Closed

azasypkin marked this pull request as ready for review October 13, 2021 12:44

azasypkin added the release_note:skip Skip the PR/issue when compiling release notes label Oct 13, 2021

azasypkin requested a review from jportner October 13, 2021 12:44

Remove in favor of as suggested in the guidelines.

98f000a

jportner reviewed Oct 14, 2021

View reviewed changes

azasypkin added 2 commits October 14, 2021 16:37

Merge branch '7.x' into issue-xxx-role-deprecations

2c57ba7

Improve deprecation messages and use more appropriate documentation l…

921aff2

…inks.

jportner reviewed Oct 14, 2021

View reviewed changes

Penalty for not being attentive enough.

f4026be

azasypkin requested review from gchaps and jportner October 14, 2021 18:53

azasypkin added 2 commits October 18, 2021 11:47

Merge branch '7.x' into issue-xxx-role-deprecations

e88267b

Review#3: improve deprecation messages.

7fd0a88

Merge branch '7.x' into issue-xxx-role-deprecations

88fa862

jportner approved these changes Oct 18, 2021

View reviewed changes

gchaps approved these changes Oct 18, 2021

View reviewed changes

azasypkin added the backport:skip This commit does not require backporting label Oct 18, 2021

azasypkin merged commit a453fbb into elastic:7.x Oct 18, 2021

azasypkin deleted the issue-xxx-role-deprecations branch October 18, 2021 18:12

This was referenced Oct 19, 2021

[Breaking change] Dashboard only mode has been removed #81690

Closed

Remove kibana_dashboard_only_user role #54755

Closed

jloleysens mentioned this pull request Oct 21, 2021

[Reporting/UA] Issues with the "{deprecatedRole}" role has been found message #115096

Closed

	'Use a "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',
	'Use the "{adminRoleName}" role to grant access to all Kibana features in all spaces. The "{userRoleName}" role will be removed in 8.0.',

	documentationUrl: `https://www.elastic.co/guide/en/kibana/${packageInfo.branch}/xpack-security-authorization.html`,
	documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${packageInfo.branch}/built-in-roles.html`,

		defaultMessage: 'The "{userRoleName}" role is deprecated. Use "{adminRoleName}" role instead.',
		values: { userRoleName: KIBANA_USER_ROLE_NAME, adminRoleName: KIBANA_ADMIN_ROLE_NAME },

Register kibana_dashboard_only_user and kibana_user roles deprecations in UA. #110960

Register kibana_dashboard_only_user and kibana_user roles deprecations in UA. #110960

Conversation

azasypkin commented Sep 2, 2021 • edited Loading

Summary

Screenshots

azasypkin commented Sep 10, 2021 • edited Loading

azasypkin Sep 10, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin Oct 14, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin commented Sep 10, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner commented Sep 17, 2021 • edited Loading

elasticmachine commented Oct 13, 2021

jportner commented Oct 14, 2021

jportner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner Oct 14, 2021 • edited Loading

Choose a reason for hiding this comment

jportner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin Oct 14, 2021 • edited Loading

Choose a reason for hiding this comment

gchaps commented Oct 15, 2021

azasypkin commented Oct 18, 2021

<--- JS stacktrace --->

azasypkin commented Oct 18, 2021

azasypkin commented Oct 18, 2021

jportner left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 18, 2021

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

History

gchaps left a comment

Choose a reason for hiding this comment

Register `kibana_dashboard_only_user` and `kibana_user` roles deprecations in UA. #110960

Register `kibana_dashboard_only_user` and `kibana_user` roles deprecations in UA. #110960

azasypkin commented Sep 2, 2021 •

edited

Loading

azasypkin commented Sep 10, 2021 •

edited

Loading

azasypkin Sep 10, 2021 •

edited

Loading

azasypkin Oct 14, 2021 •

edited

Loading

jportner commented Sep 17, 2021 •

edited

Loading

jportner Oct 14, 2021 •

edited

Loading

azasypkin Oct 14, 2021 •

edited

Loading