OpenSearch/docs/en/security/authorization.asciidoc

[[authorization]]
== Configuring Role-based Access Control

{security} introduces the concept of _authorization_ to Elasticsearch.
Authorization is the process of determining whether the user behind an incoming
request is allowed to execute it. This process takes place once a request is
successfully authenticated and the user behind the request is identified.

[[roles]]
[float]
=== Roles, Permissions and Privileges

The authorization process revolves around the following 5 constructs:

_Secured Resource_::
A resource to which access is restricted. Indices/aliases, documents, fields,
users and the Elasticsearch cluster itself are all examples of secured objects.

_Privilege_::
A named group representing one or more actions that a user may execute against a
secured resource. Each secured resource has its own sets of available privileges.
For example, `read` is an index privilege that represents all actions that enable
reading the indexed/stored data. For a complete list of available privileges
see <<security-privileges>>.

_Permissions_::
A set of one or more privileges against a secured resource. Permissions can
easily be described in words, here are few examples:
 * `read` privilege on the `products` index
 * `manage` privilege on the cluster
 * `run_as` privilege on `john` user
 * `read` privilege on documents that match query X
 * `read` privilege on `credit_card` field

_Role_::
A named sets of permissions

_User_::
The authenticated user.

A secure Elasticsearch cluster manages the privileges of users through _roles_.
A role has a unique name and identifies a set of permissions that translate to
privileges on resources. A user can be associated with an arbitrary number of
roles. The total set of permissions that a user has is therefore defined by
union of the permissions in all its roles.

As an administrator, you will need to define the roles that you want to use,
then assign users to the roles. These can be assigned to users in a number of
ways depending on the realms by which the users are authenticated.

[[built-in-roles]]
=== Built-in Roles

{security} applies a default role to all users, including
<<anonymous-access, anonymous users>>. The default role enables users to access
the authenticate endpoint, change their own passwords, and get information about
themselves.

{security} also provides a set of built-in roles you can explicitly assign
to users. These roles have a fixed set of privileges and cannot be updated.

[[built-in-roles-ingest-user]] `ingest_admin` ::
Grants access to manage *all* index templates and *all* ingest pipeline configurations.
+
NOTE: This role does *not* provide the ability to create indices; those privileges
must be defined in a separate role.

[[built-in-roles-kibana-system]] `kibana_system` ::
Grants access necessary for the <<kibana, Kibana system user>>
to read from and write to the Kibana indices and check the availability of the
Elasticsearch cluster.
+
NOTE: This role should not be assigned to users as the granted permissions may
change between releases.

[[built-in-roles-kibana-user]] `kibana_user`::
Grants the minimum privileges required for any user of Kibana. This role grants
access to the Kibana indices and grants  monitoring privileges for the cluster.

[[built-in-roles-logstash-system]] `logstash_system` ::
Grants access necessary for the <<ls-monitoring-user, Logstash system user>>
to send system-level data (such as monitoring) to Elasticsearch.
+
NOTE: This role should not be assigned to users as the granted permissions may
change between releases.
+
NOTE: This role does not provide access to the logstash indices and is not
suitable for use within a Logstash pipeline.

[[built-in-roles-ml-admin]] `machine_learning_admin`::
Grants `manage_ml` cluster privileges and read access to the `.ml-*` indices.

[[built-in-roles-ml-user]] `machine_learning_user`::
Grants the minimum privileges required to view {xpackml} configuration,
status, and results. This role grants `monitor_ml` cluster privileges and
read access to the `.ml-notifications` and `.ml-anomalies*` indices,
which store {ml} results.

[[built-in-roles-monitoring-user]] `monitoring_user`::
Grants the minimum privileges required for any user of Monitoring other than those
required to use Kibana. This role grants access to the monitoring indices.
Monitoring users should also be assigned the `kibana_user` role.

[[built-in-roles-remote-monitoring-agent]] `remote_monitoring_agent`::
Grants the minimum privileges required for a remote monitoring agent to write data
into this cluster.

[[built-in-roles-reporting-user]] `reporting_user`::
Grants the specific privileges required for users of Reporting other than those
required to use Kibana. This role grants access to the reporting indices. Reporting
users should also be assigned the `kibana_user` role and a role that grants them
access to the data that will be used to generate reports with.

[[built-in-roles-superuser]] `superuser`::
Grants full access to the cluster, including all indices and data. A user with
the `superuser` role can also manage users and roles and
<<run-as-privilege, impersonate>> any other user in the system. Due to the
permissive nature of this role, take extra care when assigning it to a user.

[[built-in-roles-transport-client]] `transport_client`::
Grants the privileges required to access the cluster through the Java Transport
Client. The Java Transport Client fetches information about the nodes in the
cluster using the _Node Liveness API_ and the _Cluster State API_ (when
sniffing is enabled). Assign your users this role if they use the
Transport Client.
+
NOTE: Using the Transport Client effectively means the users are granted access
to the cluster state. This means users can view the metadata over all indices,
index templates, mappings, node and basically everything about the cluster.
However, this role does not grant permission to view the data in all indices.

[[built-in-roles-watcher-admin]] `watcher_admin`::
+
Grants write access to the `.watches` index, read access to the watch history and
the triggered watches index and allows to execute all watcher actions.

[[built-in-roles-watcher-user]] `watcher_user`::
+
Grants read access to the `.watches` index, the get watch action and the watcher
stats.


[[defining-roles]]
=== Defining Roles

A role is defined by the following JSON structure:

[source,js]
-----
{
  "name": "...", <1>
  "run_as": [ ... ] <2>
  "cluster": [ ... ], <3>
  "indices": [ ... ] <4>
}
-----
<1> The role name, also used as the role ID.
<2> A list of usernames the owners of this role can <<run-as-privilege, impersonate>>.
<3> A list of cluster privileges. These privileges define the
    cluster level actions users with this role are able to execute. This field
    is optional (missing `cluster` privileges effectively mean no cluster level
    permissions).
<4> A list of indices permissions entries. This field is optional (missing `indices`
    privileges effectively mean no index level permissions).

[[valid-role-name]]
NOTE: Role names must be at least 1 and no more than 1024 characters. They can 
      contain alphanumeric characters (`a-z`, `A-Z`, `0-9`), spaces, 
      punctuation, and printable symbols in the https://en.wikipedia.org/wiki/Basic_Latin_(Unicode_block)[Basic Latin (ASCII) block]. 
      Leading or trailing whitespace is not allowed.

The following describes the structure of an indices permissions entry:

[source,js]
-------
{
  "names": [ ... ], <1>
  "privileges": [ ... ], <2>
  "field_security" : { ... }, <3>
  "query": "..." <4>
}
-------
<1> A list of indices (or index name patterns) to which the permissions in this
    entry apply.
<2> The index level privileges the owners of the role have on the associated
    indices (those indices that are specified in the `name` field)
<3> Specification for document fields the owners of the role have read access to.
    See <<field-and-document-access-control>> for details.
<4> A search query that defines the documents the owners of the role have read
    access to. A document within the associated indices must match this query
    in order for it to be accessible by the owners of the role.

[TIP]
==============================================================================
When specifying index names, you can use indices and aliases with their full
names or regular expressions that refer to multiple indices.

* Wildcard (default) - simple wildcard matching where `*` is a placeholder
  for zero or more characters, `?` is a placeholder for a single character
  and `\` may be used as an escape character.

* Regular Expressions - A more powerful syntax for matching more complex
  patterns. This regular expression is based on Lucene's regexp automaton
  syntax. To enable this syntax, it must be wrapped within a pair of
  forward slashes (`/`). Any pattern starting with `/` and not ending with
  `/` is considered to be malformed.

.Example Regular Expressions
[source,yaml]
------------------------------------------------------------------------------
"foo-bar":               # match the literal `foo-bar`
"foo-*":                 # match anything beginning with "foo-"
"logstash-201?-*":       # ? matches any one character
"/.*-201[0-9]-.*/":      # use a regex to match anything containing 2010-2019
"/foo":                  # syntax error - missing final /
------------------------------------------------------------------------------
==============================================================================

The following snippet shows an example definition of a `clicks_admin` role:

[source,js]
-----------
{
  "run_as": [ "clicks_watcher_1" ]
  "cluster": [ "monitor" ],
  "indices": [
    {
      "names": [ "events-*" ],
      "privileges": [ "read" ],
      "field_security" : {
        "grant" : [ "category", "@timestamp", "message" ]
      },
      "query": "{\"match\": {\"category\": \"click\"}}"
    }
  ]
}
-----------

Based on the above definition, users owning the `clicks_admin` role can:

  * Impersonate the `clicks_watcher_1` user and execute requests on its behalf.
  * Monitor the Elasticsearch cluster
  * Read data from all indices prefixed with `events-`
  * Within these indices, only read the events of the `click` category
  * Within these document, only read the `category`, `@timestamp` and `message`
    fields.

TIP:  For a complete list of available <<security-privileges, cluster and indices privileges>>

There are two available mechanisms to define roles: using the _Role Management APIs_
or in local files on the Elasticsearch nodes.  {security} also supports implementing
custom roles providers.  If you need to integrate with another system to retrieve
user roles, you can build a custom roles provider plugin. For more information,
see <<custom-roles-provider, Custom Roles Provider Extension>>.

[float]
[[roles-management-ui]]
=== Role Management UI

If you are a Kibana user, make sure to <<installing-xpack, install {xpack} in Kibana>>.
This enables you to easily manage users and roles from within Kibana. To manage roles,
log in to Kibana and go to *Management / Elasticsearch / Roles*.

[float]
[[roles-management-api]]
=== Role Management API

The _Role Management APIs_ enable you to add, update, remove and retrieve roles
dynamically. When you use the APIs to manage roles in the `native` realm, the
roles are stored in an internal Elasticsearch index.

[[roles-api-add]]
==== Adding a Role

To add a role, submit a PUT or POST request to the `/_xpack/security/role/<name>`
endpoint.

[source,js]
--------------------------------------------------
POST /_xpack/security/role/clicks_admin
{
  "run_as": [ "clicks_watcher_1" ],
  "cluster": [ "monitor" ],
  "indices": [
    {
      "names": [ "events-*" ],
      "privileges": [ "read" ],
      "field_security" : {
        "grant" : [ "category", "@timestamp", "message" ]
      },
      "query": "{\"match\": {\"category\": \"click\"}}"
    }
  ]
}
--------------------------------------------------
// CONSOLE
// TESTSETUP

NOTE: This API can also be used for updating role definitions.

[[roles-api-list]]
==== List Role

To retrieve all roles, submit a GET request to the `/_xpack/security/role` endpoint:

[source,js]
--------------------------------------------------
GET /_xpack/security/role
--------------------------------------------------
// CONSOLE

To retrieve particular roles, specify the roles as a comma-separated list:

[source,js]
--------------------------------------------------
GET /_xpack/security/role/clicks_admin
--------------------------------------------------
// CONSOLE

Response:

[source,js]
--------------------------------------------------
{
  "clicks_admin": {
    "run_as": [ "clicks_watcher_1" ],
    "cluster": [ "monitor" ],
    "indices": [
      {
        "names": [ "events-*" ],
        "privileges": [ "read" ],
        "field_security" : {
          "grant" : [ "category", "@timestamp", "message" ]
        },
        "query": "{\"match\": {\"category\": \"click\"}}"
      }
    ],
    "metadata": { },
    "transient_metadata": {
      "enabled": true
    }
  }
}
--------------------------------------------------
// TESTRESPONSE

NOTE: If single role is requested, that role is returned as the response. When
      requesting multiple roles, an object is returned holding the found roles,
      each keyed by the relevant role name.

[[roles-api-delete]]
==== Deleting a Role

To delete a role, submit a DELETE request to the `/_xpack/security/role/<name>`
endpoint:

[source,js]
--------------------------------------------------
DELETE /_xpack/security/role/clicks_admin
--------------------------------------------------
// CONSOLE

[float]
[[roles-management-file]]
=== File-based Role Management

Apart from the _Role Management APIs_ roles can also be defined in local
`roles.yml` file located in `CONFIG_DIR/x-pack`. This is a YAML file where each
role definition is keyed by its name.

[IMPORTANT]
==============================
If the same role name is used in the `roles.yml` file and through the
_Role Management APIs_, the role found in the file will be used.
==============================

While the _Role Management APIs_ is the preferred mechanism to define roles,
using the `roles.yml` file becomes useful if you want to define fixed roles that
no one (beside an administrator having physical access to the Elasticsearch nodes)
would be able to change.

[IMPORTANT]
==============================
The `roles.yml` file is managed locally by the node and is not globally by the
cluster. This means that with a typical multi-node cluster, the exact same
changes need to be applied on each and every node in the cluster.

A safer approach would be to apply the change on one of the nodes and have the
`roles.yml` distributed/copied to all other nodes in the cluster (either
manually or using a configuration management system such as Puppet or Chef).
==============================

The following snippet shows an example of the `roles.yml` file configuration:

[source,yaml]
-----------------------------------
click_admins:
  run_as: [ 'clicks_watcher_1' ]
  cluster: [ 'monitor' ]
  indices:
    - names: [ 'events-*' ]
      privileges: [ 'read' ]
      field_security:
        grant: ['category', '@timestamp', 'message' ]
      query: '{"match": {"category": "click"}}'
-----------------------------------

{security} continuously monitors the `roles.yml` file and automatically picks
up and apples any changes to it.

include::authorization/alias-privileges.asciidoc[]

include::authorization/mapping-roles.asciidoc[]

include::authorization/field-and-document-access-control.asciidoc[]

include::authorization/run-as-privilege.asciidoc[]

include::authorization/custom-roles-provider.asciidoc[]