How to grant a plugin permissions for updating indices and index templates

kved · May 3, 2022, 6:51pm

I created a plugin to manage index templates and index settings, however I'm seeing an error that

 action [indices:admin/template/get] is unauthorized for user [_system]

I tried adding the superuser role to the _system user, but the error message did not go away. Is there a way to have a plugin run as the elastic user or is there a way to grant the _system user the correct permissions?

Yang_Wang · May 4, 2022, 6:38am

_system user is immutable. For most plugins, the _xpack user is a better choice for performing internal actions.

kved · May 4, 2022, 1:30pm

Makes sense! How can we change the plugin to run / perform actions as the _xpack user? I couldn't find any samples anywhere.

Yang_Wang · May 5, 2022, 1:24am

For now you can use OriginSettingClient with TASKS_ORIGIN as shown in this piece of code:

github.com

elastic/elasticsearch/blob/85bdf0f2d91f67a14d702b20e7354fa71dd7369f/server/src/main/java/org/elasticsearch/action/admin/cluster/node/tasks/get/TransportGetTaskAction.java#L75

      
        
                TransportService transportService,
                ActionFilters actionFilters,
                ClusterService clusterService,
                Client client,
                NamedXContentRegistry xContentRegistry
            ) {
                super(GetTaskAction.NAME, transportService, actionFilters, GetTaskRequest::new);
                this.threadPool = threadPool;
                this.clusterService = clusterService;
                this.transportService = transportService;
                this.client = new OriginSettingClient(client, TASKS_ORIGIN);
                this.xContentRegistry = xContentRegistry;
            }
            
            
@Override
            protected void doExecute(Task thisTask, GetTaskRequest request, ActionListener<GetTaskResponse> listener) {
                if (clusterService.localNode().getId().equals(request.getTaskId().getNodeId())) {
                    getRunningTaskFromNode(thisTask, request, listener);
                } else {
                    runOnNodeWithTaskIfPossible(thisTask, request, listener);
                }

The client will internally issue all requests with the _xpack user.

NB: This approach relies on the internals of ES code. There is no backwards compatibility guarantee at this level. The code can change in any future release and possibly break your plugin.

system · June 2, 2022, 1:24am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.