Add 'DLS and multiple roles' section to DLS topic #6408

john-eliatra · 2024-02-14T17:49:09Z

Description

A request came in from a user searching for documentation on the dfm_empty_overrides_all setting that was introduced in OpenSearch previously.

Background

The exact setting is plugins.security.dfm_empty_overrides_all, and it caters for when a user with multiple roles has their search results restricted by DLS from one of those roles.

Proposed change to documentation

Added a new section to the Document-level security topic called 'DLS and multiple roles', which describes the situation and how to change it by adding the setting.

Issues Resolved

This PR resolves #6049

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

hdhalter · 2024-02-14T18:52:20Z

Thanks, @john-eliatra !
@scrawfor99 - Can you please review this for technical accuracy? Thanks!

hdhalter · 2024-02-14T22:34:34Z

Hi @rursprung , can you please take a look at this PR to see if it addresses your issue? Thanks!

rursprung · 2024-02-15T07:15:31Z

thanks for documenting this. i think it should more explicitly mention that this also applies to roles which do not grant read access to the documents (e.g. a role granting access to search templates), see opensearch-project/security#3963 for more details.
it might also not hurt if it would give an example.

stephen-crawford

Signing off on technical accuracy.

leanneeliatra · 2024-02-21T14:54:08Z

@rursprung , I have updated the documentation to give an example of the case you mentioned, could you review it please. if you're happy with the changes we should be good to merge.
Thank you.

_security/access-control/document-level-security.md

Naarcha-AWS · 2024-02-22T17:34:22Z

@leanneeliatra: Added some formatting and wording changes.

leanneeliatra · 2024-02-23T10:42:43Z

@leanneeliatra: Added some formatting and wording changes.

Yes thank you for those improvements, they have been integrated.

rursprung · 2024-02-26T13:08:44Z

thanks for the example!

tbh, i kind-of think that two examples would be helpful:

the case for why you would want to have this setting enabled: namely you have two roles granting read access, one with DLS and one without, where the former is e.g. granted to a whole group of users while the latter is granted only to specific users (e.g. an admin user) where you somehow can't filter out the admin user from the group receiving the first (restricted) role, thus requiring the latter to be able to override the former
the case you've now documented which is generally an unintentional consequence of having enabled the setting (which you enabled because you had the first case)

then you can clearly explain:

why/when you'd want to enable it
what you need to be extra careful about when you do need to enable it

_security/access-control/document-level-security.md

leanneeliatra · 2024-02-29T13:30:10Z

I added another example @rursprung and hopefully made the docs clearer.

Could you review and let me know your thoughts please?

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

natebower

@john-eliatra @Naarcha-AWS Please see my comments and changes and let me know if you have any questions. Thanks!

_security/access-control/document-level-security.md

natebower · 2024-03-01T17:35:58Z

_security/access-control/document-level-security.md

+
+## DLS and multiple roles
+
+OpenSearch combines all DLS queries with the logical `OR` operator. However, when a role with DLS is combined with another security role that doesn't use DLS, the query results are filtered to display only documents matching the DLS from the first role. This filter rule also applies to roles which do not grant read documents.


is "grant read documents" correct? (It may be, but it reads a bit oddly to me).

"...grant read document permissions?"

_security/access-control/document-level-security.md

natebower · 2024-03-01T17:48:17Z

_security/access-control/document-level-security.md

+
+When a user has both Role A and Role B permissions, the query results are filtered based on Role A's DLS, even though Role B doesn't use DLS. The DLS settings are held and the returned access is appropriately restricted. 
+
+With the `plugins.security.dfm_empty_overrides_all` is enabled when a user is assigned both Role A and Role B, Role B's permissions will override Role A's restrictions, allowing that user to access all documents. This ensures that the role without DLS takes precedence in the search query response.


Would the first sentence be better as "When a user is assigned both Role A and Role B and the plugins.security.dfm_empty_overrides_all setting is enabled, Role B's permissions..."?

_security/access-control/document-level-security.md

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

_security/access-control/document-level-security.md

* explaination of setting plugins.security.dfm_empty_overrides_all: true Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * datadog grammer corrected in documentation Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * adding more examples of setting for dsl to make it clearer Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * small edits to fix spacing in previous commit Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * reviewdog fixes Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Formatting edits. Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Update document-level-security.md Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Co-authored-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com> (cherry picked from commit 93d07a0) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* explaination of setting plugins.security.dfm_empty_overrides_all: true * datadog grammer corrected in documentation * Update _security/access-control/document-level-security.md * Update _security/access-control/document-level-security.md * Update _security/access-control/document-level-security.md * Update _security/access-control/document-level-security.md * Update _security/access-control/document-level-security.md * adding more examples of setting for dsl to make it clearer * small edits to fix spacing in previous commit * Update _security/access-control/document-level-security.md * reviewdog fixes * Formatting edits. * Update document-level-security.md * Apply suggestions from code review * Apply suggestions from code review --------- (cherry picked from commit 93d07a0) Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Co-authored-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com>

…#6408) * explaination of setting plugins.security.dfm_empty_overrides_all: true Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * datadog grammer corrected in documentation Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * adding more examples of setting for dsl to make it clearer Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * small edits to fix spacing in previous commit Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Update _security/access-control/document-level-security.md Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * reviewdog fixes Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Formatting edits. Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Update document-level-security.md Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Co-authored-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com>

john-eliatra requested review from hdhalter, kolchfa-aws, Naarcha-AWS, vagimeli, AMoo-Miki, natebower and dlvenable as code owners February 14, 2024 17:49

hdhalter assigned Naarcha-AWS Feb 14, 2024

hdhalter added the 3 - Tech review PR: Tech review in progress label Feb 14, 2024

Naarcha-AWS added the security label Feb 16, 2024

stephen-crawford approved these changes Feb 19, 2024

View reviewed changes

leanneeliatra force-pushed the Johnh_dfm_overrides_all branch from 5854091 to a87330d Compare February 21, 2024 20:30

Naarcha-AWS requested changes Feb 22, 2024

View reviewed changes

Naarcha-AWS added 4 - Doc review PR: Doc review in progress and removed 3 - Tech review PR: Tech review in progress labels Feb 22, 2024

Naarcha-AWS approved these changes Feb 26, 2024

View reviewed changes

Naarcha-AWS added 5 - Editorial review PR: Editorial review in progress backport 2.12 PR: Backport label for 2.12 3 - Tech review PR: Tech review in progress and removed 4 - Doc review PR: Doc review in progress 5 - Editorial review PR: Editorial review in progress labels Feb 26, 2024

Naarcha-AWS reviewed Feb 28, 2024

View reviewed changes

_security/access-control/document-level-security.md Outdated Show resolved Hide resolved

leanneeliatra and others added 11 commits March 1, 2024 14:51

explaination of setting plugins.security.dfm_empty_overrides_all: true

ac3586f

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

datadog grammer corrected in documentation

2f80599

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Update _security/access-control/document-level-security.md

823c6c9

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Update _security/access-control/document-level-security.md

e7dbc6d

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Update _security/access-control/document-level-security.md

42cb48f

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Update _security/access-control/document-level-security.md

777d587

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

Update _security/access-control/document-level-security.md

8d8a5b2

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

adding more examples of setting for dsl to make it clearer

55ad61c

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

small edits to fix spacing in previous commit

f7f096a

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Update _security/access-control/document-level-security.md

a79505d

Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com>

reviewdog fixes

190258e

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

leanneeliatra force-pushed the Johnh_dfm_overrides_all branch from 5325a95 to 190258e Compare March 1, 2024 15:30

Naarcha-AWS added 2 commits March 1, 2024 11:06

Formatting edits.

5effd84

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Update document-level-security.md

9b9455f

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Naarcha-AWS added 5 - Editorial review PR: Editorial review in progress and removed 3 - Tech review PR: Tech review in progress labels Mar 1, 2024

natebower reviewed Mar 1, 2024

View reviewed changes

Naarcha-AWS reviewed Mar 1, 2024

View reviewed changes

_security/access-control/document-level-security.md Outdated Show resolved Hide resolved

Naarcha-AWS and others added 3 commits March 1, 2024 12:36

Apply suggestions from code review

f4b40b4

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Apply suggestions from code review

c8fbec3

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Merge branch 'main' into Johnh_dfm_overrides_all

d11c2e0

Naarcha-AWS reviewed Mar 1, 2024

View reviewed changes

_security/access-control/document-level-security.md Outdated Show resolved Hide resolved

Naarcha-AWS merged commit 93d07a0 into opensearch-project:main Mar 1, 2024
3 checks passed

opensearch-trigger-bot bot mentioned this pull request Mar 1, 2024

[Backport 2.12] Add 'DLS and multiple roles' section to DLS topic #6567

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add 'DLS and multiple roles' section to DLS topic #6408

Add 'DLS and multiple roles' section to DLS topic #6408

john-eliatra commented Feb 14, 2024 •

edited by hdhalter

Loading

hdhalter commented Feb 14, 2024

hdhalter commented Feb 14, 2024

rursprung commented Feb 15, 2024

stephen-crawford left a comment

leanneeliatra commented Feb 21, 2024 •

edited

Loading

Naarcha-AWS commented Feb 22, 2024

leanneeliatra commented Feb 23, 2024

rursprung commented Feb 26, 2024

leanneeliatra commented Feb 29, 2024 •

edited

Loading

natebower left a comment

natebower Mar 1, 2024

Naarcha-AWS Mar 1, 2024 •

edited

Loading

natebower Mar 1, 2024


		## DLS and multiple roles

		OpenSearch combines all DLS queries with the logical `OR` operator. However, when a role with DLS is combined with another security role that doesn't use DLS, the query results are filtered to display only documents matching the DLS from the first role. This filter rule also applies to roles which do not grant read documents.


		When a user has both Role A and Role B permissions, the query results are filtered based on Role A's DLS, even though Role B doesn't use DLS. The DLS settings are held and the returned access is appropriately restricted.

		With the `plugins.security.dfm_empty_overrides_all` is enabled when a user is assigned both Role A and Role B, Role B's permissions will override Role A's restrictions, allowing that user to access all documents. This ensures that the role without DLS takes precedence in the search query response.

Add 'DLS and multiple roles' section to DLS topic #6408

Add 'DLS and multiple roles' section to DLS topic #6408

Conversation

john-eliatra commented Feb 14, 2024 • edited by hdhalter Loading

Description

Background

Proposed change to documentation

Issues Resolved

Checklist

hdhalter commented Feb 14, 2024

hdhalter commented Feb 14, 2024

rursprung commented Feb 15, 2024

stephen-crawford left a comment

Choose a reason for hiding this comment

leanneeliatra commented Feb 21, 2024 • edited Loading

Naarcha-AWS commented Feb 22, 2024

leanneeliatra commented Feb 23, 2024

rursprung commented Feb 26, 2024

leanneeliatra commented Feb 29, 2024 • edited Loading

natebower left a comment

Choose a reason for hiding this comment

natebower Mar 1, 2024

Choose a reason for hiding this comment

Naarcha-AWS Mar 1, 2024 • edited Loading

Choose a reason for hiding this comment

natebower Mar 1, 2024

Choose a reason for hiding this comment

john-eliatra commented Feb 14, 2024 •

edited by hdhalter

Loading

leanneeliatra commented Feb 21, 2024 •

edited

Loading

leanneeliatra commented Feb 29, 2024 •

edited

Loading

Naarcha-AWS Mar 1, 2024 •

edited

Loading