Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[8.x] [ESO] Add flag to allow ESO consumers to opt-out of highly rand…
…om UIDs (elastic#198287) (elastic#198956) # Backport This will backport the following commits from `main` to `8.x`: - [[ESO] Add flag to allow ESO consumers to opt-out of highly random UIDs (elastic#198287)](elastic#198287) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Sid","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-05T14:40:53Z","message":"[ESO] Add flag to allow ESO consumers to opt-out of highly random UIDs (elastic#198287)\n\nCloses https://github.com/elastic/kibana/issues/194692\r\n\r\n## Summary\r\nAllow consumers of ESOs to explicitly opt out of the strict highly\r\nrandom UID requirements while registering the ESO type\r\n\r\n### Description\r\n\r\nThe `getValidId` method was updated to allow consumers of Encrypted\r\nSaved Objects to explicitly opt-out of the enforced random ID\r\nrequirement.\r\n\r\nThis change is added during ESO registration - consumers can now pass a\r\nnew field to opt-out of random UIDs.\r\n\r\nAdditional changes\r\n\r\n- Updated canSpecifyID logic:\r\n- The canSpecifyID condition now also checks if enforceRandomId is\r\nexplicitly set to false.\r\nThis opt-out approach allows specific ESOs to bypass the random ID\r\nenforcement without affecting the default behavior, keeping it secure by\r\ndefault.\r\n\r\n\r\nDuring the registration phase of the saved object, consumers can now\r\nspecify if they'd like to opt-out of the random ID\r\n\r\n```\r\nsavedObjects.registerType({\r\n name: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n});\r\n\r\nencryptedSavedObjects.registerType({\r\n type: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n enforceRandomId: false,\r\n});\r\n\r\n```\r\n\r\n\r\n### Release notes\r\n\r\nImproves Encrypted Saved Objects (ESO) ID validation by adding an\r\nenforceRandomId parameter, allowing consumers to opt out of the default\r\nrandom ID requirement for specific use cases.\r\n\r\n### Checklist\r\n\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [ ] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)\r\n- [ ] This will appear in the **Release Notes** and follow the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <[email protected]>\r\nCo-authored-by: Jeramy Soucy <[email protected]>","sha":"56c0806af5a7f20903e92bfe88dc227e93ca2858","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","backport","Team:Security","v9.0.0","Feature:Security/Encrypted Saved Objects","v8.17.0"],"title":"[ESO] Add flag to allow ESO consumers to opt-out of highly random UIDs","number":198287,"url":"https://github.com/elastic/kibana/pull/198287","mergeCommit":{"message":"[ESO] Add flag to allow ESO consumers to opt-out of highly random UIDs (elastic#198287)\n\nCloses https://github.com/elastic/kibana/issues/194692\r\n\r\n## Summary\r\nAllow consumers of ESOs to explicitly opt out of the strict highly\r\nrandom UID requirements while registering the ESO type\r\n\r\n### Description\r\n\r\nThe `getValidId` method was updated to allow consumers of Encrypted\r\nSaved Objects to explicitly opt-out of the enforced random ID\r\nrequirement.\r\n\r\nThis change is added during ESO registration - consumers can now pass a\r\nnew field to opt-out of random UIDs.\r\n\r\nAdditional changes\r\n\r\n- Updated canSpecifyID logic:\r\n- The canSpecifyID condition now also checks if enforceRandomId is\r\nexplicitly set to false.\r\nThis opt-out approach allows specific ESOs to bypass the random ID\r\nenforcement without affecting the default behavior, keeping it secure by\r\ndefault.\r\n\r\n\r\nDuring the registration phase of the saved object, consumers can now\r\nspecify if they'd like to opt-out of the random ID\r\n\r\n```\r\nsavedObjects.registerType({\r\n name: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n});\r\n\r\nencryptedSavedObjects.registerType({\r\n type: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n enforceRandomId: false,\r\n});\r\n\r\n```\r\n\r\n\r\n### Release notes\r\n\r\nImproves Encrypted Saved Objects (ESO) ID validation by adding an\r\nenforceRandomId parameter, allowing consumers to opt out of the default\r\nrandom ID requirement for specific use cases.\r\n\r\n### Checklist\r\n\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [ ] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)\r\n- [ ] This will appear in the **Release Notes** and follow the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <[email protected]>\r\nCo-authored-by: Jeramy Soucy <[email protected]>","sha":"56c0806af5a7f20903e92bfe88dc227e93ca2858"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198287","number":198287,"mergeCommit":{"message":"[ESO] Add flag to allow ESO consumers to opt-out of highly random UIDs (elastic#198287)\n\nCloses https://github.com/elastic/kibana/issues/194692\r\n\r\n## Summary\r\nAllow consumers of ESOs to explicitly opt out of the strict highly\r\nrandom UID requirements while registering the ESO type\r\n\r\n### Description\r\n\r\nThe `getValidId` method was updated to allow consumers of Encrypted\r\nSaved Objects to explicitly opt-out of the enforced random ID\r\nrequirement.\r\n\r\nThis change is added during ESO registration - consumers can now pass a\r\nnew field to opt-out of random UIDs.\r\n\r\nAdditional changes\r\n\r\n- Updated canSpecifyID logic:\r\n- The canSpecifyID condition now also checks if enforceRandomId is\r\nexplicitly set to false.\r\nThis opt-out approach allows specific ESOs to bypass the random ID\r\nenforcement without affecting the default behavior, keeping it secure by\r\ndefault.\r\n\r\n\r\nDuring the registration phase of the saved object, consumers can now\r\nspecify if they'd like to opt-out of the random ID\r\n\r\n```\r\nsavedObjects.registerType({\r\n name: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n});\r\n\r\nencryptedSavedObjects.registerType({\r\n type: TYPE_WITH_PREDICTABLE_ID,\r\n //...\r\n enforceRandomId: false,\r\n});\r\n\r\n```\r\n\r\n\r\n### Release notes\r\n\r\nImproves Encrypted Saved Objects (ESO) ID validation by adding an\r\nenforceRandomId parameter, allowing consumers to opt out of the default\r\nrandom ID requirement for specific use cases.\r\n\r\n### Checklist\r\n\r\n- [x]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas added for features that require explanation or tutorials\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [ ] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)\r\n- [ ] This will appear in the **Release Notes** and follow the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <[email protected]>\r\nCo-authored-by: Jeramy Soucy <[email protected]>","sha":"56c0806af5a7f20903e92bfe88dc227e93ca2858"}},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Sid <[email protected]>
- Loading branch information
1 parent
d650c38
commit 937aeee