mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-08 05:58:44 +00:00
3ffb20bdfc
The submit async search action should not populate the thread context DLS/FLS permission set, because it is not currently authorised as an "indices request" and hence the permission set that it builds is incomplete and it overrides the DLS/FLS permission set of the actual spawned search request (which is built correctly).
58 lines
973 B
YAML
58 lines
973 B
YAML
# All cluster rights
|
|
# All operations on all indices
|
|
# Run as all users
|
|
test-admin:
|
|
cluster:
|
|
- all
|
|
indices:
|
|
- names: '*'
|
|
privileges: [ all ]
|
|
run_as:
|
|
- '*'
|
|
|
|
user1:
|
|
cluster:
|
|
- cluster:monitor/main
|
|
indices:
|
|
- names: ['index-user1', 'index' ]
|
|
privileges:
|
|
- read
|
|
- write
|
|
- create_index
|
|
- indices:admin/refresh
|
|
|
|
user2:
|
|
cluster:
|
|
- cluster:monitor/main
|
|
indices:
|
|
- names: [ 'index-user2', 'index' ]
|
|
privileges:
|
|
- read
|
|
- write
|
|
- create_index
|
|
- indices:admin/refresh
|
|
|
|
user_dls:
|
|
cluster:
|
|
- cluster:monitor/main
|
|
indices:
|
|
- names:
|
|
- 'index*'
|
|
privileges:
|
|
- read
|
|
field_security:
|
|
grant:
|
|
- baz
|
|
query: |
|
|
{
|
|
"bool": {
|
|
"must_not": [
|
|
{
|
|
"match": {
|
|
"foo": "bar"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|