AccessControlLoggingDecorator still being logged despite verbosity: error on all ACLs

1

Using readonlyrest version 1.33.1 for both Kibana and ES (7.14.0), we are still getting ACL logs even though all ACLs have verbosity: error set. This isn’t the case on systems with ES that don’t have Kibana installed, but for some reason systems WITH Kibana log the request no matter what. The ACL that it seems to hit and log is the one named ::kibana::

ACL looks like this:

readonlyrest:
    access_control_rules:
    - name: "::deny users::" #deny certain users
      type: forbid
      groups: ["deny"]
      verbosity: error

    - name: "::kibana::" #allowed to all
      type: allow
      indices: ["*"]
      kibana_access: rw
      ldap_authentication: "mdvdc1"
      ldap_authorization:
        name: "mdvdc1"
        groups: ["Elasticsearch_readonly","Elasticsearch"]
      verbosity: error

    - name: "::readonly::"
      type: allow
      actions: ["indices:data/read/*"]
      groups: ["readonly" ]
      verbosity: error

    - name: "::readonly_per_env::"
      type: allow
      actions: ["indices:data/read/*"]
      ldap_authentication: "mdvdc1"
      ldap_authorization:
        name: "mdvdc1"
        groups: ["Elasticsearch_readonly","Elasticsearch"]
      verbosity: error

    - name: admin
      type: allow
      ldap_authentication: "mdvdc1"
      ldap_authorization:
        name: "mdvdc1"
        groups: ["Elasticsearch"]
        actions: ["cluster:monitor/*","cluster:*","cluster:monitor/nodes/stats","indices:monitor/stats", "indices:*"]
      verbosity: error
2

I think I saw this bug too, in my case it regards the fact we always log requests to /_readonlyrest/metadata/current_user therefore not honouring the verbosity: error rule.

Did I already flag this as a bug to you @coutoPL? I don’t remember.

Not sure if this is exactly the same with what you observed, @nickmh?

3

@sscarduzio Yes, that sounds like the same issue

4

@coutoPL I found it, it is RORDEV-479. We should bump it up, sounds a quick one.

1 Like
5

it’s fixed. Here is a pre-build

1 Like