[Authz] Superuser privileges

packages/core/http/core-http-router-server-internal/src/security_route_config_validator.test.ts

@@ -276,4 +276,19 @@ describe('RouteSecurity validation', () => {
       `"[authz.requiredPrivileges]: anyRequired privileges must contain unique values"`
     );
   });
+
+  it('should fail validation when anyRequired has superuser privileges set', () => {
+    const invalidRouteSecurity = {
+      authz: {
+        requiredPrivileges: [
+          { anyRequired: ['privilege1', 'privilege1'], allRequired: ['privilege4'] },
+          { anyRequired: ['privilege5', 'superuser'] },
+        ],
+      },
+    };
+
+    expect(() => validRouteSecurity(invalidRouteSecurity)).toThrowErrorMatchingInlineSnapshot(
+      `"[authz.requiredPrivileges]: superuser privileges set cannot be used in anyRequired"`
+    );
+  });
 });

packages/core/http/core-http-router-server-internal/src/security_route_config_validator.ts

@@ -49,6 +49,10 @@ const requiredPrivilegesSchema = schema.arrayOf(
         }
       });
 
+      if (anyRequired.includes('superuser')) {
+        return 'superuser privileges set cannot be used in anyRequired';
+      }
+
       if (anyRequired.length && allRequired.length) {
         for (const privilege of anyRequired) {
           if (allRequired.includes(privilege)) {

x-pack/plugins/encrypted_saved_objects/server/routes/key_rotation.test.ts

@@ -45,7 +45,7 @@ describe('Key rotation routes', () => {
     it('correctly defines route.', () => {
       expect(routeConfig.options).toEqual({
         access: 'public',
-        tags: ['access:rotateEncryptionKey', 'oas-tag:saved objects'],
+        tags: ['oas-tag:saved objects'],
         summary: `Rotate a key for encrypted saved objects`,
         description: `If a saved object cannot be decrypted using the primary encryption key, Kibana attempts to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.
         NOTE: Bulk key rotation can consume a considerable amount of resources and hence only user with a superuser role can trigger it.`,
@@ -96,7 +96,7 @@ describe('Key rotation routes', () => {
 
       expect(config.options).toEqual({
         access: 'internal',
-        tags: ['access:rotateEncryptionKey', 'oas-tag:saved objects'],
+        tags: ['oas-tag:saved objects'],
         summary: `Rotate a key for encrypted saved objects`,
         description: `If a saved object cannot be decrypted using the primary encryption key, Kibana attempts to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.
         NOTE: Bulk key rotation can consume a considerable amount of resources and hence only user with a superuser role can trigger it.`,

x-pack/plugins/encrypted_saved_objects/server/routes/key_rotation.ts

@@ -6,6 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
+import { ReservedPrivilegesSet } from '@kbn/security-plugin/common';
 
 import type { RouteDefinitionParams } from '.';
 
@@ -39,9 +40,14 @@ export function defineKeyRotationRoutes({
           type: schema.maybe(schema.string()),
         }),
       },
+      security: {
+        authz: {
+          requiredPrivileges: [ReservedPrivilegesSet.Superuser],
+        },
+      },
       options: {
-        tags: ['access:rotateEncryptionKey', 'oas-tag:saved objects'],
         access: buildFlavor === 'serverless' ? 'internal' : 'public',
+        tags: ['oas-tag:saved objects'],
         summary: `Rotate a key for encrypted saved objects`,
         description: `If a saved object cannot be decrypted using the primary encryption key, Kibana attempts to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.
         NOTE: Bulk key rotation can consume a considerable amount of resources and hence only user with a superuser role can trigger it.`,

x-pack/plugins/security/common/constants.ts

@@ -127,3 +127,14 @@ export const API_VERSIONS = {
     },
   },
 };
+
+/**
+ * Privileges that define the superuser role or the role equivalent to the superuser role.
+ */
+export const SUPER_USER_PRIVILEGES = {
+  kibana: ['*'],
+  elasticsearch: {
+    cluster: ['all'],
+    index: { '*': ['all'] },
+  },
+};

x-pack/plugins/security/common/index.ts

@@ -48,3 +48,5 @@ export type {
   UserProfileLabels,
   UserProfileUserInfoWithSecurity,
 } from '@kbn/security-plugin-types-common';
+
+export { ReservedPrivilegesSet } from './types';

x-pack/plugins/security/common/types.ts

@@ -24,3 +24,8 @@ export enum LogoutReason {
 export interface SecurityCheckupState {
   displayAlert: boolean;
 }
+
+export enum ReservedPrivilegesSet {
+  Operator = 'operator',
+  Superuser = 'superuser',
+}

x-pack/plugins/security/server/authorization/api_authorization.test.ts

@@ -15,6 +15,7 @@ import {
 
 import { initAPIAuthorization } from './api_authorization';
 import { authorizationMock } from './index.mock';
+import { ReservedPrivilegesSet } from '../../common/types';
 
 describe('initAPIAuthorization', () => {
   test(`protected route when "mode.useRbacForRequest()" returns false continues`, async () => {
@@ -149,7 +150,10 @@ describe('initAPIAuthorization', () => {
         asserts,
       }: {
         security?: RouteSecurity;
-        kibanaPrivilegesResponse?: Array<{ privilege: string; authorized: boolean }>;
+        kibanaPrivilegesResponse?: {
+          privileges: { kibana: Array<{ privilege: string; authorized: boolean }> };
+          hasAllRequested?: boolean;
+        };
         kibanaPrivilegesRequestActions?: string[];
         asserts: {
           forbidden?: boolean;
@@ -180,11 +184,7 @@ describe('initAPIAuthorization', () => {
         const mockResponse = httpServerMock.createResponseFactory();
         const mockPostAuthToolkit = httpServiceMock.createOnPostAuthToolkit();
 
-        const mockCheckPrivileges = jest.fn().mockReturnValue({
-          privileges: {
-            kibana: kibanaPrivilegesResponse,
-          },
-        });
+        const mockCheckPrivileges = jest.fn().mockReturnValue(kibanaPrivilegesResponse);
         mockAuthz.mode.useRbacForRequest.mockReturnValue(true);
         mockAuthz.checkPrivilegesDynamicallyWithRequest.mockImplementation((request) => {
           // hapi conceals the actual "request" from us, so we make sure that the headers are passed to
@@ -194,6 +194,12 @@ describe('initAPIAuthorization', () => {
           return mockCheckPrivileges;
         });
 
+        mockAuthz.checkPrivilegesWithRequest.mockImplementation((request) => {
+          expect(request.headers).toMatchObject(headers);
+
+          return { globally: () => kibanaPrivilegesResponse };
+        });
+
         await postAuthHandler(mockRequest, mockResponse, mockPostAuthToolkit);
 
         expect(mockAuthz.mode.useRbacForRequest).toHaveBeenCalledWith(mockRequest);
@@ -207,11 +213,13 @@ describe('initAPIAuthorization', () => {
           return;
         }
 
-        expect(mockCheckPrivileges).toHaveBeenCalledWith({
-          kibana: kibanaPrivilegesRequestActions!.map((action: string) =>
-            mockAuthz.actions.api.get(action)
-          ),
-        });
+        if (kibanaPrivilegesRequestActions) {
+          expect(mockCheckPrivileges).toHaveBeenCalledWith({
+            kibana: kibanaPrivilegesRequestActions!.map((action: string) =>
+              mockAuthz.actions.api.get(action)
+            ),
+          });
+        }
 
         if (asserts.forbidden) {
           expect(mockResponse.forbidden).toHaveBeenCalled();
@@ -239,11 +247,15 @@ describe('initAPIAuthorization', () => {
             ],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: true },
-          { privilege: 'api:privilege3', authorized: false },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: true },
+              { privilege: 'api:privilege3', authorized: false },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2', 'privilege3'],
         asserts: {
           authzResult: {
@@ -267,10 +279,14 @@ describe('initAPIAuthorization', () => {
             ],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: true },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: true },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2'],
         asserts: {
           authzResult: {
@@ -293,11 +309,15 @@ describe('initAPIAuthorization', () => {
             ],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: false },
-          { privilege: 'api:privilege2', authorized: true },
-          { privilege: 'api:privilege3', authorized: false },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: false },
+              { privilege: 'api:privilege2', authorized: true },
+              { privilege: 'api:privilege3', authorized: false },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2', 'privilege3'],
         asserts: {
           authzResult: {
@@ -317,10 +337,14 @@ describe('initAPIAuthorization', () => {
             requiredPrivileges: ['privilege1', 'privilege2'],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: true },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: true },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2'],
         asserts: {
           authzResult: {
@@ -344,18 +368,54 @@ describe('initAPIAuthorization', () => {
             ],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: false },
-          { privilege: 'api:privilege3', authorized: false },
-        ],
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2', 'privilege3'],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: false },
+              { privilege: 'api:privilege3', authorized: false },
+            ],
+          },
+        },
         asserts: {
           forbidden: true,
         },
       }
     );
 
+    testSecurityConfig(
+      `protected route restricted to only superusers returns forbidden if user not a superuser`,
+      {
+        security: {
+          authz: {
+            requiredPrivileges: [ReservedPrivilegesSet.Superuser],
+          },
+        },
+        kibanaPrivilegesResponse: { privileges: { kibana: [] }, hasAllRequested: false },
+        asserts: {
+          forbidden: true,
+        },
+      }
+    );
+
+    testSecurityConfig(
+      `protected route allowed only for superuser access returns "authzResult" if user is superuser`,
+      {
+        security: {
+          authz: {
+            requiredPrivileges: [ReservedPrivilegesSet.Superuser],
+          },
+        },
+        kibanaPrivilegesResponse: { privileges: { kibana: [] }, hasAllRequested: true },
+        asserts: {
+          authzResult: {
+            [ReservedPrivilegesSet.Superuser]: true,
+          },
+        },
+      }
+    );
+
     testSecurityConfig(
       `protected route returns forbidden if user doesn't have at least one from allRequired privileges requested`,
       {
@@ -369,12 +429,16 @@ describe('initAPIAuthorization', () => {
             ],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: false },
-          { privilege: 'api:privilege3', authorized: false },
-          { privilege: 'api:privilege4', authorized: true },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: false },
+              { privilege: 'api:privilege3', authorized: false },
+              { privilege: 'api:privilege4', authorized: true },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2', 'privilege3', 'privilege4'],
         asserts: {
           forbidden: true,
@@ -390,10 +454,14 @@ describe('initAPIAuthorization', () => {
             requiredPrivileges: ['privilege1', 'privilege2'],
           },
         },
-        kibanaPrivilegesResponse: [
-          { privilege: 'api:privilege1', authorized: true },
-          { privilege: 'api:privilege2', authorized: false },
-        ],
+        kibanaPrivilegesResponse: {
+          privileges: {
+            kibana: [
+              { privilege: 'api:privilege1', authorized: true },
+              { privilege: 'api:privilege2', authorized: false },
+            ],
+          },
+        },
         kibanaPrivilegesRequestActions: ['privilege1', 'privilege2'],
         asserts: {
           forbidden: true,