Restrict Connector APIs to manage/monitor_connector privileges #119863
Conversation
…es (elastic#119389)" (elastic#119833) This reverts commit e0cefb8.
jedrazb added :SearchOrg/Extract&Transform 
elasticsearchmachine added the Team:SearchOrg 
| Pinging @elastic/search-eng (Team:SearchOrg) |
| Pinging @elastic/search-extract-and-transform (Team:Search - Extract & Transform) |
| Hi @jedrazb, I've created a changelog YAML for you. |
| Hi @jedrazb, I've updated the changelog YAML for you. Note that since this PR is labelled |
| @elasticmachine merge upstream |
…elasticsearch into adapt-connector-api-roles-again
…206067) ## Summary `viewer` role is not sufficient to call Connector APIs with new change elastic/elasticsearch#119863 Update the FTR tests to use developer role for testing
…lastic#206067) ## Summary `viewer` role is not sufficient to call Connector APIs with new change elastic/elasticsearch#119863 Update the FTR tests to use developer role for testing
| */ | ||
| public ConnectorIndexService(Client client) { | ||
| this.client = client; | ||
| this.clientWithOrigin = new OriginSettingClient(client, CONNECTORS_ORIGIN); |
There was a problem hiding this comment.
if you make this variable reuse the old name, a LOT of the diff goes away
this.client = new OriginSettingClient(client, CONNECTORS_ORIGIN); There was a problem hiding this comment.
(same note for the ConnectorSyncJobIndexService.java)
There was a problem hiding this comment.
I feel like naming OriginSettingClient as clientWithOrigin is established patter in ES https://github.com/search?q=repo%3Aelastic%2Felasticsearch+clientWithOrigin&type=code therefore I prefer to keep it like this so that we are explicit how we access the soon to be system indices
…lastic#206067) ## Summary `viewer` role is not sufficient to call Connector APIs with new change elastic/elasticsearch#119863 Update the FTR tests to use developer role for testing
| @jedrazb is this PR relevant to the serverless changelog? [FYI this question is based on 9.0 breaking changes] |
7 participants
Reapply "Restrict Connector APIs to manage/monitor_connector privileg…es (#119389)" (#119833)
Merge again: #119389 after fixing FTR test in Kibana that would cause issues for serverless
viewerrole this is the fix elastic/kibana#206067Changes
monitor/manage_connectorprivilege for access control to Connector APIsCONNECTORS_ORIGIN) in index service logicRelated dev issue:
Restrict Connector APIs to manage/monitor_connector privileges