[Authz] Add Security Solution authorization for SessionView and Kubernetes Dashboard

[opauloh]

Summary

Authz API migration for unauthorized routes

This PR applies the securitySolution authorization to endpoints of the Security Solution's features Session View and Kubernetes Dashboard, using the new Kibana Security Api authorization.

Once this PR is merged, accessing the Session View or Kubernetes endpoints with a user that lacks Kibana Security (Read) privilege will return the following error:

{
    "statusCode": 403,
    "error": "Forbidden",
    "message": "API [GET /internal/session_view/process_events?index=logs-endpoint.events.process] is unauthorized for user, this action is granted by the Kibana privileges [securitySolution]"
}

See this comment for more context

Related

• Authorization API
• Unauthorized route migration for routes owned by kibana-cloud-security-posture #198353
• closes https://github.com/elastic/security-team/issues/11044

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: ded55a7

Failed CI Steps

• FTR Configs #34
• FTR Configs #34

Test Failures

• [job] [logs] FTR Configs #34 / Session View API (basic) Session view - /internal/session_view/process_events - with a basic license using typical process event data Session View obs_only_all_spaces_all should NOT be able to view alerts in session view
• [job] [logs] FTR Configs #34 / Session View API (basic) Session view - /internal/session_view/process_events - with a basic license using typical process event data Session View obs_only_all_spaces_all should NOT be able to view alerts in session view

Metrics [docs]

✅ unchanged

History

[albertoblaz]

@opauloh Should we close this PR as per your last comment on the issue?

[opauloh]

Closing due to the circumstances on this comment