OSD Permission and Permission Evaluation POC 2.0.2

[cliu123]

Reference on saved object registration: multi-data-source POC

Description

The POC proves:

1. Dashboards can have saved object permissions, access policies and privilege evaluation mechnism for functionalities stored in a single .kibana index. So the it could have granular access control on inidividual saved objects without relying on tenant. Tenant could be removed.
2. It's Dashboards self-owned data storage(in this case still an OpenSearch index .kibana) that doesn't rely on OpenSearch security plugin that stores permissions and access policies in security configuration index and evaluate priviledges.
3. In the same approach, Dashboards identities(a new set of identities) can also be stored in Dashboards self-owned data storage.

APIs

Create sample-permission saved object:

% curl -XPOST http://localhost:5601/api/saved_objects/sample-permission -H 'osd-xsrf:true' -H 'Content-Type: application/json' -d '{
    "attributes":{
       "name":"saved_objects_data_read_get",
       "count":1
    }
 }'
{"type":"sample-permission","id":"ac9d3140-fb6e-11ec-bc8d-af0ea0fe07ba","attributes":{"name":"saved_objects_data_read_get","count":1},"references":[],"updated_at":"2022-07-04T07:55:30.258Z","version":"WzEsMV0="}% 

Find all sample_permission saved objects:

% curl 'http://localhost:5601/api/saved_objects/_find?type=sample-permission' -H 'Content-Type: application/json' -H 'osd-xsrf:true'
{"page":1,"per_page":20,"total":1,"saved_objects":[{"type":"sample-permission","id":"ac9d3140-fb6e-11ec-bc8d-af0ea0fe07ba","attributes":{"name":"saved_objects_data_read_get","count":1},"references":[],"updated_at":"2022-07-04T07:55:30.258Z","version":"WzAsMV0=","score":0}]}% 

Get a sample_permission saved object by id:

% curl 'http://localhost:5601/api/saved_objects/sample-permission/ac9d3140-fb6e-11ec-bc8d-af0ea0fe07ba' -H 'Content-Type: application/json' -H 'osd-xsrf:true'
{"id":"ac9d3140-fb6e-11ec-bc8d-af0ea0fe07ba","type":"sample-permission","namespaces":[],"updated_at":"2022-07-04T07:55:30.258Z","version":"WzAsMV0=","attributes":{"name":"saved_objects_data_read_get","count":1},"references":[]}% 

Evaluate permissions:

• Request with a non-existent permission gets unauthorized({"authorized":"false"}):

% curl 'http://localhost:5601/api/permission_management/hasPermission/123' -H 'Content-Type: application/json' -H 'osd-xsrf:true'
{"authorized":"false"}%

• Request with an existent permission gets authorized({"authorized":"true"}):

% curl 'http://localhost:5601/api/permission_management/hasPermission/saved_objects_data_read_get' -H 'Content-Type: application/json' -H 'osd-xsrf:true'
{"authorized":"true"}%                            

[seraphjiang]

could we remove elastic license head~

[cliu123]

Done