Add read-only role page to documents #5783 #6806

AntonEliatra · 2024-03-28T17:09:08Z

Description

Adding read only role page to documentation, covering read only access to OpenSearch Dashboards objects and readonly_mode. Using UI screenshot to demonstrate the process

Issues Resolved

Closes #5783
Closes #4947

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: AntonEliatra <[email protected]>

hdhalter · 2024-03-28T20:00:36Z

Thanks, @AntonEliatra! I like the use of screen shots here. Can you please address the Vale errors?

@scrawfor99 - Can you please review for technical accuracy?

We'll need to address the duplicate information here: https://opensearch.org/docs/latest/security/access-control/users-roles/#set-up-a-read-only-user-in-opensearch-dashboards.

Also, I don't see that role name in the table, only kibana_read_only: https://opensearch.org/docs/latest/security/access-control/users-roles/#predefined-roles.

Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra · 2024-03-29T09:51:53Z

@hdhalter the vale errors are fixed.

Regarding the information on https://opensearch.org/docs/latest/security/access-control/users-roles/#set-up-a-read-only-user-in-opensearch-dashboards.

Using v2.12.0 I don't see those two roles in the UI (opensearch_dashboards_user and opensearch_dashboards_read_only) and unable to use them via API

stephen-crawford

Looks good from a technical aspect; left some clarity comments.

_security/access-control/read-only-role.md

stephen-crawford · 2024-04-01T18:42:19Z

_security/access-control/read-only-role.md

+
+## Basic read only role
+
+If you are looking to create a role to access OpenSearch Dashboards, view existing dashboards/visualizations and query different indexes, assuming you want the user to have read access to all indexes and tenants, you can add cluster permission group of `cluster_composite_ops_ro`, `read` access to all indexes (`*`) and `read` access to all tenants


Not sure if we should use "indices." Ask @Naarcha-AWS

stephen-crawford · 2024-04-01T18:45:10Z

_security/access-control/read-only-role.md

+
+## Basic read only role
+
+If you are looking to create a role to access OpenSearch Dashboards, view existing dashboards/visualizations and query different indexes, assuming you want the user to have read access to all indexes and tenants, you can add cluster permission group of `cluster_composite_ops_ro`, `read` access to all indexes (`*`) and `read` access to all tenants


I would consider explaining each of these. Without knowing the background it is not super obvious what cluster_composite_ops_ro is for. Likewise it may not be obvious why you restate the permissions at different levels so you may want to clarify this.

@scrawfor99 good point, I've expanded on this, let me know if below is better:

Basic read only role

If you are looking to create a role to access OpenSearch Dashboards, view existing dashboards/visualizations and query different indexes, assuming you want the user to have read access to all indexes and tenants, you can use the following permissions.

Cluster permission

Cluster permission is needed to access cluster wide resources like visualizations and dashboards. For read only user you add already created cluster_composite_ops_ro permission.

Indexes permission

In order to view visualizations, user needs to have access to the index that was used to create it, In this can you can add read permission to all (*) indexes.

Tenant permissions

If you are using tenants to separate work area between different teams/projects, visualizations and dashboards are saved in specific tenant. To be able to view these the user needs read access to the correct tenant. To keep things more straightforward we are giving user access to all (*) tenants.

_security/access-control/read-only-role.md

Co-authored-by: Stephen Crawford <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

…t#5783 Signed-off-by: AntonEliatra <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

vagimeli

Doc review complete

hdhalter · 2024-04-23T16:25:28Z

Thanks, al! I sent it for editorial review.

natebower

@AntonEliatra @hdhalter Please see my comments and changes and let me know if you have any questions. Thanks!

_security/access-control/users-roles.md

natebower · 2024-04-23T17:16:58Z

_security/authentication-backends/client-auth.md


-You can now assign your certificate's common name (CN) to a role. For this step, you must know your certificate's CN and the role you want to assign to. To get a list of all predefined roles in OpenSearch, refer to our [list of predefined roles]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#predefined-roles). If you want to first create a role, refer to [how to create a role]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#create-users), and then map your certificate's CN to that role.
+You can now assign your certificate's common name (CN) to a role. This step requires you to identify the certificate's CN and the role you want to assign it to. To view a list of all predefined roles in OpenSearch, see [Predefined roles]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#predefined-roles). To get started, first [define a role]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#defining-roles) and then map your certificate's CN to that role.


"predefined OpenSearch roles" instead of "predefined roles in OpenSearch"?

_security/authentication-backends/client-auth.md

natebower · 2024-04-23T17:22:04Z

_security/configuration/yaml.md

@@ -165,7 +165,7 @@ plugins.security.restapi.password_validation_error_message: "Password must be mi

 In addition, a score-based password strength estimator allows you to set a threshold for password strength when creating a new internal user or updating a user's password. This feature makes use of the [zxcvbn library](https://github.com/dropbox/zxcvbn) to apply a policy that emphasizes a password's complexity rather than its capacity to meet traditional criteria such as uppercase keys, numerals, and special characters.

-For information about creating users, see [Create users]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#create-users).
+For information about creating users, see [Defining users]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#defining-users).


I'm assuming that this change is correct, but should it then read "about defining users"? It's a bit of a non sequitur now as written.

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Editorial fixes. Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Editorial fix Signed-off-by: Heather Halter <[email protected]>

hdhalter

@AntonEliatra - I've addressed all of Nathan's feedback except two items, where we need to introduce the images. Can you please address those comments and also accept my two comments? Thanks so much!

_security/authentication-backends/client-auth.md

_security/configuration/yaml.md

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra · 2024-04-24T10:21:10Z

@hdhalter thats added now

_security/access-control/users-roles.md

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra · 2024-04-24T11:09:50Z

Hi @natebower I'm a little confused regarding : vs '.'
I've seen you make suggestions changing these around, is there a rule I should follow here to avoid these in future?

natebower · 2024-04-24T11:14:32Z

Hi @natebower I'm a little confused regarding : vs '.' I've seen you make suggestions changing these around, is there a rule I should follow here to avoid these in future?

@AntonEliatra Yes: Use a colon to introduce example blocks (for example, code and scripts) and most lists. Do not use a colon to introduce tables or images. See here. Thanks!

hdhalter · 2024-04-24T17:39:12Z

This looks good to me! @natebower - are you good with it?

natebower

LGTM

* adding read-only role page to documents #5783 Signed-off-by: AntonEliatra <[email protected]> * fixing vale errors on read-only page #5783 Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/read-only-role.md Co-authored-by: Stephen Crawford <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/read-only-role.md Co-authored-by: Stephen Crawford <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * applying the suggested fixed to read only mode page #5783 Signed-off-by: AntonEliatra <[email protected]> * adding section on restapi roles to readonly_mode #5783 Signed-off-by: AntonEliatra <[email protected]> * adding section on restapi roles to readonly_mode #5783 Signed-off-by: AntonEliatra <[email protected]> * Apply suggestions from code review Co-authored-by: Naarcha-AWS <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * moving read only role content into Users and Roles page#5783 Signed-off-by: AntonEliatra <[email protected]> * moving read only role content into Users and Roles page#5783 Signed-off-by: AntonEliatra <[email protected]> * moving read only role content into Users and Roles page#5783 Signed-off-by: AntonEliatra <[email protected]> * moving read only role content into Users and Roles page#5783 Signed-off-by: AntonEliatra <[email protected]> * moving read only role content into Users and Roles page#5783 Signed-off-by: AntonEliatra <[email protected]> * Update users-roles.md Made some info architecture changes to topic Signed-off-by: Heather Halter <[email protected]> * Update users-roles.md Tweaked the wording in the 'example' section Signed-off-by: Heather Halter <[email protected]> * Update users-roles.md Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Naarcha-AWS <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update users-roles.md Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Naarcha-AWS <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/users-roles.md Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Signed-off-by: Heather Halter <[email protected]> * fixing broken links #5783 Signed-off-by: AntonEliatra <[email protected]> * removing duplicate details from user-role page #5783 Signed-off-by: AntonEliatra <[email protected]> * Apply suggestions from code review Co-authored-by: Heather Halter <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update users-roles.md Added link to https://opensearch.org/docs/latest/security/authentication-backends/ldap/ Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Apply suggestions from code review Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Apply suggestions from code review Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Apply suggestions from code review Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update _security/access-control/users-roles.md Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Apply suggestions from code review Editorial fixes. Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]> * Update users-roles.md Editorial fix Signed-off-by: Heather Halter <[email protected]> * Apply suggestions from code review Co-authored-by: Heather Halter <[email protected]> Signed-off-by: AntonEliatra <[email protected]> * adding reference to images #5783 Signed-off-by: AntonEliatra <[email protected]> * Apply suggestions from code review Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]> --------- Signed-off-by: AntonEliatra <[email protected]> Signed-off-by: Heather Halter <[email protected]> Co-authored-by: Stephen Crawford <[email protected]> Co-authored-by: Naarcha-AWS <[email protected]> Co-authored-by: Heather Halter <[email protected]> Co-authored-by: Melissa Vagi <[email protected]> Co-authored-by: Nathan Bower <[email protected]> (cherry picked from commit 5f98cb8) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

adding read-only role page to documents opensearch-project#5783

f7cda22

Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra requested review from hdhalter, kolchfa-aws, Naarcha-AWS, vagimeli, AMoo-Miki, natebower, dlvenable and stephen-crawford as code owners March 28, 2024 17:09

Merge branch 'main' into adding-read-only-user-page

09b3275

AntonEliatra mentioned this pull request Mar 28, 2024

[DOC] Update and validate instructions for creating read-only roles #5783

Closed

hdhalter assigned stephen-crawford Mar 28, 2024

hdhalter added 2 - In progress Issue/PR: The issue or PR is in progress. security backport 2.12 PR: Backport label for 2.12 labels Mar 28, 2024

fixing vale errors on read-only page opensearch-project#5783

8c6614b

Signed-off-by: AntonEliatra <[email protected]>

stephen-crawford approved these changes Apr 1, 2024

View reviewed changes

AntonEliatra and others added 3 commits April 1, 2024 21:28

Update _security/access-control/read-only-role.md

7e16aa1

Co-authored-by: Stephen Crawford <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

Update _security/access-control/read-only-role.md

62bddf2

Co-authored-by: Stephen Crawford <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

applying the suggested fixed to read only mode page opensearch-projec…

696ce56

…t#5783 Signed-off-by: AntonEliatra <[email protected]>

AntonEliatra requested a review from epugh as a code owner April 1, 2024 20:55

Naarcha-AWS added 4 - Doc review PR: Doc review in progress backport 2.13 PR: Backport label for 2.13 and removed 2 - In progress Issue/PR: The issue or PR is in progress. backport 2.12 PR: Backport label for 2.12 labels Apr 3, 2024

AntonEliatra added 3 commits April 5, 2024 10:16

Merge branch 'opensearch-project:main' into adding-read-only-user-page

a4b3dbb

adding section on restapi roles to readonly_mode opensearch-project#5783

c6bc7a8

Signed-off-by: AntonEliatra <[email protected]>

adding section on restapi roles to readonly_mode opensearch-project#5783

066b381

Signed-off-by: AntonEliatra <[email protected]>

hdhalter and others added 5 commits April 19, 2024 13:10

Update _security/access-control/users-roles.md

ef4a8e2

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Apply suggestions from code review

53753e9

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Apply suggestions from code review

04d424f

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Apply suggestions from code review

cc0089f

Co-authored-by: Melissa Vagi <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

Merge branch 'opensearch-project:main' into adding-read-only-user-page

707223d

vagimeli approved these changes Apr 23, 2024

View reviewed changes

hdhalter added 5 - Editorial review PR: Editorial review in progress and removed 4 - Doc review PR: Doc review in progress labels Apr 23, 2024

natebower reviewed Apr 23, 2024

View reviewed changes

hdhalter and others added 4 commits April 23, 2024 13:17

Update _security/access-control/users-roles.md

ae869e4

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Update _security/access-control/users-roles.md

e668264

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Apply suggestions from code review

7502ca0

Editorial fixes. Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: Heather Halter <[email protected]>

Update users-roles.md

fecc37a

Editorial fix Signed-off-by: Heather Halter <[email protected]>

hdhalter reviewed Apr 24, 2024

View reviewed changes

_security/authentication-backends/client-auth.md Outdated Show resolved Hide resolved

_security/configuration/yaml.md Outdated Show resolved Hide resolved

AntonEliatra and others added 2 commits April 24, 2024 11:09

Apply suggestions from code review

2b7dfe4

Co-authored-by: Heather Halter <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

adding reference to images opensearch-project#5783

f76d141

Signed-off-by: AntonEliatra <[email protected]>

natebower reviewed Apr 24, 2024

View reviewed changes

_security/access-control/users-roles.md Outdated Show resolved Hide resolved

natebower reviewed Apr 24, 2024

View reviewed changes

_security/access-control/users-roles.md Outdated Show resolved Hide resolved

Apply suggestions from code review

803aeef

Co-authored-by: Nathan Bower <[email protected]> Signed-off-by: AntonEliatra <[email protected]>

natebower approved these changes Apr 24, 2024

View reviewed changes

Merge branch 'main' into adding-read-only-user-page

9bc682e

hdhalter merged commit 5f98cb8 into opensearch-project:main Apr 24, 2024
5 checks passed

opensearch-trigger-bot bot mentioned this pull request Apr 24, 2024

[Backport 2.13] Add read-only role page to documents #5783 #7020

Merged

github-actions bot pushed a commit that referenced this pull request Apr 24, 2024

Add read-only role page to documents #5783 (#6806) (#7020)

8cbaaeb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add read-only role page to documents #5783 #6806

Add read-only role page to documents #5783 #6806

AntonEliatra commented Mar 28, 2024 •

edited by hdhalter

Loading

hdhalter commented Mar 28, 2024

AntonEliatra commented Mar 29, 2024

stephen-crawford left a comment

stephen-crawford Apr 1, 2024

stephen-crawford Apr 1, 2024

AntonEliatra Apr 1, 2024

vagimeli left a comment

hdhalter commented Apr 23, 2024

natebower left a comment

natebower Apr 23, 2024

natebower Apr 23, 2024

hdhalter left a comment

AntonEliatra commented Apr 24, 2024

AntonEliatra commented Apr 24, 2024

natebower commented Apr 24, 2024

hdhalter commented Apr 24, 2024

natebower left a comment


		## Basic read only role

		If you are looking to create a role to access OpenSearch Dashboards, view existing dashboards/visualizations and query different indexes, assuming you want the user to have read access to all indexes and tenants, you can add cluster permission group of `cluster_composite_ops_ro`, `read` access to all indexes (`*`) and `read` access to all tenants


		You can now assign your certificate's common name (CN) to a role. For this step, you must know your certificate's CN and the role you want to assign to. To get a list of all predefined roles in OpenSearch, refer to our [list of predefined roles]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#predefined-roles). If you want to first create a role, refer to [how to create a role]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#create-users), and then map your certificate's CN to that role.
		You can now assign your certificate's common name (CN) to a role. This step requires you to identify the certificate's CN and the role you want to assign it to. To view a list of all predefined roles in OpenSearch, see [Predefined roles]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#predefined-roles). To get started, first [define a role]({{site.url}}{{site.baseurl}}/security/access-control/users-roles/#defining-roles) and then map your certificate's CN to that role.

Add read-only role page to documents #5783 #6806

Add read-only role page to documents #5783 #6806

Conversation

AntonEliatra commented Mar 28, 2024 • edited by hdhalter Loading

Description

Issues Resolved

Checklist

hdhalter commented Mar 28, 2024

AntonEliatra commented Mar 29, 2024

stephen-crawford left a comment

Choose a reason for hiding this comment

stephen-crawford Apr 1, 2024

Choose a reason for hiding this comment

stephen-crawford Apr 1, 2024

Choose a reason for hiding this comment

AntonEliatra Apr 1, 2024

Choose a reason for hiding this comment

Basic read only role

Cluster permission

Indexes permission

Tenant permissions

vagimeli left a comment

Choose a reason for hiding this comment

hdhalter commented Apr 23, 2024

natebower left a comment

Choose a reason for hiding this comment

natebower Apr 23, 2024

Choose a reason for hiding this comment

natebower Apr 23, 2024

Choose a reason for hiding this comment

hdhalter left a comment

Choose a reason for hiding this comment

AntonEliatra commented Apr 24, 2024

AntonEliatra commented Apr 24, 2024

natebower commented Apr 24, 2024

hdhalter commented Apr 24, 2024

natebower left a comment

Choose a reason for hiding this comment

AntonEliatra commented Mar 28, 2024 •

edited by hdhalter

Loading