[8.14] [Roles] Support for remote_cluster field in ES role definition (#182377)

docs/api/role-management/put.asciidoc

@@ -26,7 +26,7 @@ To use the create or update role API, you must have the `manage_security` cluste
 
 `elasticsearch`::
   (Optional, object) {es} cluster and index privileges. Valid keys include
-  `cluster`, `indices`, `remote_indices`, and `run_as`. For more information, see
+  `cluster`, `indices`, `remote_indices`, `remote_cluster`, and `run_as`. For more information, see
   {ref}/defining-roles.html[Defining roles].
 
 `kibana`::
@@ -210,6 +210,12 @@ $ curl -X PUT api/security/role/my_kibana_role
         "names": [ "remote_index1", "remote_index2" ],
         "privileges": [ "all" ]
       }
+    ],
+    "remote_cluster": [
+      {
+        "clusters": [ "remote_cluster1" ],
+        "privileges": [ "monitor_enrich" ]
+      }
     ]
   },
   "kibana": [

x-pack/packages/security/plugin_types_common/index.ts

@@ -16,6 +16,7 @@ export type {
   RoleIndexPrivilege,
   RoleKibanaPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
   FeaturesPrivileges,
 } from './src/authorization';
 export type { SecurityLicense, SecurityLicenseFeatures, LoginLayout } from './src/licensing';

x-pack/packages/security/plugin_types_common/src/authorization/index.ts

@@ -11,4 +11,5 @@ export type {
   RoleKibanaPrivilege,
   RoleIndexPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
 } from './role';

x-pack/packages/security/plugin_types_common/src/authorization/role.ts

@@ -28,10 +28,16 @@ export interface RoleKibanaPrivilege {
   _reserved?: string[];
 }
 
+export interface RoleRemoteClusterPrivilege {
+  clusters: string[];
+  privileges: string[];
+}
+
 export interface Role {
   name: string;
   elasticsearch: {
     cluster: string[];
+    remote_cluster?: RoleRemoteClusterPrivilege[];
     indices: RoleIndexPrivilege[];
     remote_indices?: RoleRemoteIndexPrivilege[];
     run_as: string[];

x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts

@@ -59,6 +59,11 @@ export interface SecurityLicenseFeatures {
    */
   readonly allowRoleRemoteIndexPrivileges: boolean;
 
+  /**
+   * Indicates whether we allow users to define remote cluster privileges in roles.
+   */
+  readonly allowRemoteClusterPrivileges: boolean;
+
   /**
    * Indicates whether we allow Role-based access control (RBAC).
    */

x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts

@@ -22,6 +22,19 @@ export const elasticsearchRoleSchema = schema.object({
    */
   cluster: schema.maybe(schema.arrayOf(schema.string())),
 
+  /**
+   * An optional list of remote cluster privileges. These privileges define the remote cluster level actions that
+   * users with this role are able to execute
+   */
+  remote_cluster: schema.maybe(
+    schema.arrayOf(
+      schema.object({
+        privileges: schema.arrayOf(schema.string(), { minSize: 1 }),
+        clusters: schema.arrayOf(schema.string(), { minSize: 1 }),
+      })
+    )
+  ),
+
   /**
    * An optional list of indices permissions entries.
    */

x-pack/plugins/security/common/index.ts

@@ -31,6 +31,7 @@ export type {
   RoleIndexPrivilege,
   RoleKibanaPrivilege,
   RoleRemoteIndexPrivilege,
+  RoleRemoteClusterPrivilege,
   FeaturesPrivileges,
   LoginLayout,
   SecurityLicenseFeatures,

x-pack/plugins/security/common/licensing/license_service.test.ts

@@ -26,6 +26,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       layout: 'error-es-unavailable',
       allowRbac: false,
       allowSubFeaturePrivileges: false,
@@ -50,6 +51,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       layout: 'error-xpack-unavailable',
       allowRbac: false,
       allowSubFeaturePrivileges: false,
@@ -78,6 +80,7 @@ describe('license features', function () {
             "allowAuditLogging": false,
             "allowLogin": false,
             "allowRbac": false,
+            "allowRemoteClusterPrivileges": false,
             "allowRoleDocumentLevelSecurity": false,
             "allowRoleFieldLevelSecurity": false,
             "allowRoleRemoteIndexPrivileges": false,
@@ -101,6 +104,7 @@ describe('license features', function () {
             "allowAuditLogging": true,
             "allowLogin": true,
             "allowRbac": true,
+            "allowRemoteClusterPrivileges": true,
             "allowRoleDocumentLevelSecurity": true,
             "allowRoleFieldLevelSecurity": true,
             "allowRoleRemoteIndexPrivileges": true,
@@ -137,6 +141,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -164,6 +169,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: false,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -190,6 +196,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
@@ -216,6 +223,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRoleRemoteIndexPrivileges: false,
+      allowRemoteClusterPrivileges: false,
       allowRbac: true,
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,
@@ -242,6 +250,7 @@ describe('license features', function () {
       allowRoleDocumentLevelSecurity: true,
       allowRoleFieldLevelSecurity: true,
       allowRoleRemoteIndexPrivileges: true,
+      allowRemoteClusterPrivileges: true,
       allowRbac: true,
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,

x-pack/plugins/security/common/licensing/license_service.ts

@@ -77,6 +77,7 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRoleRemoteIndexPrivileges: false,
+        allowRemoteClusterPrivileges: false,
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
@@ -98,6 +99,7 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRoleRemoteIndexPrivileges: false,
+        allowRemoteClusterPrivileges: false,
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
@@ -119,6 +121,7 @@ export class SecurityLicenseService {
       allowRoleDocumentLevelSecurity: isLicensePlatinumOrBetter,
       allowRoleFieldLevelSecurity: isLicensePlatinumOrBetter,
       allowRoleRemoteIndexPrivileges: isLicensePlatinumOrBetter,
+      allowRemoteClusterPrivileges: isLicensePlatinumOrBetter,
       allowRbac: true,
       allowUserProfileCollaboration: isLicenseStandardOrBetter,
     };

x-pack/plugins/security/common/model/builtin_es_privileges.ts

@@ -8,4 +8,5 @@
 export interface BuiltinESPrivileges {
   cluster: string[];
   index: string[];
+  remote_cluster: string[];
 }

x-pack/plugins/security/public/management/role_mappings/role_mappings_api_client.ts

@@ -15,6 +15,7 @@ export interface CheckRoleMappingFeaturesResponse {
   canUseStoredScripts: boolean;
   hasCompatibleRealms: boolean;
   canUseRemoteIndices: boolean;
+  canUseRemoteClusters: boolean;
 }
 
 type DeleteRoleMappingsResponse = Array<{

x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx

@@ -214,7 +214,7 @@ function useRole(
       ? rolesAPIClient.getRole(roleName)
       : Promise.resolve({
           name: '',
-          elasticsearch: { cluster: [], indices: [], run_as: [] },
+          elasticsearch: { cluster: [], indices: [], run_as: [], remote_cluster: [] },
           kibana: [],
           _unrecognized_applications: [],
         } as Role);
@@ -533,6 +533,9 @@ export const EditRolePage: FunctionComponent<Props> = ({
           canUseRemoteIndices={
             buildFlavor === 'traditional' && featureCheckState.value?.canUseRemoteIndices
           }
+          canUseRemoteClusters={
+            buildFlavor === 'traditional' && featureCheckState.value?.canUseRemoteClusters
+          }
           isDarkMode={isDarkMode}
           buildFlavor={buildFlavor}
         />