Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DRAFT] Security feature SuperAdmin documentation updates #6927

37 changes: 37 additions & 0 deletions _security/access-control/users-roles.md
Original file line number Diff line number Diff line change
Expand Up @@ -242,3 +242,40 @@ Map the role to your user:
1. Choose the **Mapped users** tab and **Manage mapping**.
1. For **Internal users**, add your bulk access user.
1. Choose **Map**.

## SuperAdmin role

The `superAdmin` role enables adding, updating, and deleting reserved configurations like roles, roles_mapping, internal_users, action_groups, and tenants. Previously, these configurations were loaded from default YAML files. Now, the `superAdmin` role now has the privilege to add, update, and delete by using API calls.

### Example API calls:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we add more examples for roles_mapping, internal_users, action_groups, and tenants as well?

Following are examples of API calls for `superAdmin` actions:

Adding a Reserved Configuration:
```
curl -X PUT https://localhost:9200/_opendistro/_security/api/roles/new_role -k -H 'Content-Type: application/json' -d '{
Copy link
Member

@hardik-k-shah hardik-k-shah Apr 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also don't user need to pass Admin certificate for invoking this API, other than invoking locally from the node?
without identity to this API, system won't know the caller is super admin. And identity for super admin was being passed as client certificate with dn name which is allowlisted in config.yml

Can you verify working of these?

"reserved": true,
"description": "Description of the role",
"cluster_permissions": [],
"index_permissions": [],
"tenant_permissions": []
}'
```
{% include copy.html %}

Updating a Reserved Configuration:
```
curl -X PUT https://localhost:9200/_opendistro/_security/api/roles/new_role -k -H 'Content-Type: application/json' -d '{
"reserved": true,
"description": "Updated description",
"cluster_permissions": [],
"index_permissions": [],
"tenant_permissions": []
}'
```
{% include copy.html %}

Deleting a Reserved Configuration:
```
curl -X DELETE https://localhost:9200/_opendistro/_security/api/roles/new_role -k
```
{% include copy.html %}
Loading