Document-level security query failing

[jmcginty (John McGinty)]

Hi,
I want to add a document level filter that uses user metadata. My user metadata is defined as:

"metadata": {
"sids": [1,2,3]
}
}

My role for the user is defined as:

{
"cluster": [
"all"
],
"indices": [
{
"names": [
""
],
"privileges": [
"read"
],
"query": {"term":{"securityIds":"{{_user.metadata.sids}}}}"}}
}
],
"run_as": [
""
],
"metadata": {}
}

When I execute a query I get the error:

failed to create query: {
"term" : {
"securityIds" : {
"value" : "{{_user.metadata.sids}}}}",
"boost" : 1.0
}

I've tried adding the {{#toJson}} as decribed here:

X-Pack Security : Role definition query template with 'terms'

Hi, I am evaluating Elastic 5 beta1 X-Pack document level security. I have user metadata object which has attribute 'groups'. The groups is a list of group names. Assume I have one user who has _user.metadata.groups =["a","b"]. I try to write query template to generate below query: {"template":{"inline":{"terms":{"acl.groups":["a", "b"] }}}} My question is How do I pass variable _user.metadata.groups as "acl.groups' field's value in the template? Another question about X-Pack security l…

But that does work either.

I know that he query works without the _user variable because if I substitute a hard-code value it works, e.g.
"query": {"term":{"securityIds":1}}

I set up the query using filterWithHeader(..) to specify the user.

Any ideas? Thanks.

[jaymode (Jay Modi)]

Heya, I think the missing piece is the template object around the query, see the examples in the docs: https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#templating-role-query

[jmcginty (John McGinty)]

Thank you! That makes _user.metadata.sids resolve.

But now it resolves _user_metadata.sids to a string-wrapped json value. The value in the actual user metadata is:
"sids": [1,2,3]

And the query error is:

caused by: failed to create query: {
"term" : {
"securityIds" : {
"value" : "[1,2,3]",
"boost" : 1.0
}

[jaymode (Jay Modi)]

I think you'll need to add the toJson into the query in the role

[jmcginty (John McGinty)]

Thanks. I've tried it both ways and neither resolves to an array.

1. With "securityIds": "{{_user.metadata.sids}}"
   the error is:
   caused by: failed to create query: {
   "term" : {
   "securityIds" : {
   "value" : "{0=1, 1=2, 2=3}",
   "boost" : 1.0
   }

2. With "securityIds": "{{#toJson}}_user.metadata.sids{{/toJson}}"
   the error is:
   caused by: failed to create query: {
   "term" : {
   "securityIds" : {
   "value" : "[1,2,3]",
   "boost" : 1.0
   }

2 is almost correct, except that it's wrapped in a string.

[jaymode (Jay Modi)]

I think the query needs to be defined as a string like this:

"query": "{\"template\":{\"inline\":\"{\"term\":{\"securityIds\": {{#toJson}}_user.metadata.sids{{/toJson}} }}\"}}"

[jmcginty (John McGinty)]

Thanks. With:
"query": "{ "template":{"inline":"{"term":{"securityIds": {{#toJson}}_user.metadata.sids{{/toJson}} }}"}} }"

I get exception:

aused by: [script] failed to parse object
org.elasticsearch.common.xcontent.ObjectParser.apply(ObjectParser.java:186)
org.elasticsearch.script.Script.parse(Script.java:322)
org.elasticsearch.script.Script.parse(Script.java:231)
org.elasticsearch.xpack.security.authz.accesscontrol.SecurityIndexSearcherWrapper.evaluateTemplate(SecurityIndexSearcherWrapper.java:317)
org.elasticsearch.xpack.security.authz.accesscontrol.SecurityIndexSearcherWrapper.wrap(SecurityIndexSearcherWrapper.java:170)
org.elasticsearch.index.shard.IndexSearcherWrapper.wrap(IndexSearcherWrapper.java:75)
org.elasticsearch.index.shard.IndexShard.acquireSearcher(IndexShard.java:898)
org.elasticsearch.search.SearchService.createSearchContext(SearchService.java:588)
org.elasticsearch.search.SearchService.createContext(SearchService.java:547)
...

caused by: Unexpected character ('t' (code 116)): was expecting comma to separate Object entries
at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@5536ea; line: 1, column: 30]
com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1702)
com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:558)
com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:456)
com.fasterxml.jackson.core.json.UTF8StreamJsonParser.nextToken(UTF8StreamJsonParser.java:761)
org.elasticsearch.common.xcontent.json.JsonXContentParser.nextToken(JsonXContentParser.java:52)
org.elasticsearch.common.xcontent.ObjectParser.parse(ObjectParser.java:157)
org.elasticsearch.common.xcontent.ObjectParser.apply(ObjectParser.java:184)
org.elasticsearch.script.Script.parse(Script.java:322)
org.elasticsearch.script.Script.parse(Script.java:231)
...

[jaymode (Jay Modi)]

Sorry about that, I took this from a working test:

query: {
    "template": {
        "inline": "{\"terms\" : { \"securityIds\" : {{#toJson}}_user.metadata.sids{{/toJson}} } }"
    }
}

[jmcginty (John McGinty)]

@jaymode

"inline": "{"terms" : { "securityIds" : {{#toJson}}_user.metadata.sids{{/toJson}} } }"

Hey Jay, that works - THANK YOU!