ROR ENT 1.70.1 9.4.2 Lens visualization from library in RO mode broken

1

ROR Enterprise: 1.70.1

Elasticsearch: 9.4.2

Situation:
Have a lens visualization saved in visualization library.

Add lens visualization to a dashboard.

Have a user in kibana RO mode.

Get error:

image
image1860×527 18 KB

There is HTTP request:

/s/default/internal/lens/visualizations/84b53bbe-a079-48ca-ac21-b36acf9b46eb

response 403:

{“statusCode”:403,“error”:“Forbidden”,“message”:“Forbidden”}

In kibana logs:

Access to uri [/internal/lens/visualizations/84b53bbe-a079-48ca-ac21-b36acf9b46eb] with method [get] is deprecated

And a request for:

GET /internal/lens/visualizations/84b53bbe-a079-48ca-ac21-b36acf9b46eb

Not much interesting in that GET log.

Checking Elasticsearch logs I didn’t find anything.

In the ROR audit logs I see forbiddens for the user to the /_bulk endpoint:

Allow Kibana main RO access: NOT_MATCHED (AUTHZ_FAIL) -> RULES:[groups_any_of->true
kibana_hide_apps->true
kibana_access->false

Based on block:

  - name: "Allow Kibana main RO access"
    kibana_access: "ro"
    kibana_hide_apps: ["Analytics|Overview", "Observability", "Security", "readonlyrest_kbn", "Management", "Enterprise Search", "ROR Manage Kibana"]
    groups: ["kibana_main_ro"]
    indices: [".kibana", ".reporting.kibana-*", "aaa_dummy_index"]

If I take the URL and force it in the browser and refresh refresh refresh I keep seeing this entry being blocked.

I tried with the ROR 1.71.0 pre-build, same issue.

Users with rw or admin permissions it does work.

Work around found:
Unlink visualization from Library.

Then it works.

No urgent fix needed for this as workaround is available.

2

Hi @ronald.vanboven

Thanks for this report, too.
This is related to the previous one reported by you.

This morning we decided to fix it at the ROR KBN side (so the fix on the ROR ES side will be withdrawn. The patch will include fixing this issue, too.

3

Ok, cool!
Yes, I figured there might be a relation to the other flow, that is why tested with the pre-release.

As that didn’t fix it, I decided to make seperate topic for clarity.

We will await the 1.70.2 release.

Many thanks.

1 Like
4

ROR 1.70.2 with the fix is released!

5

Hi @coutoPL it seems the Elasticsearch 9.4.2 ROR 1.70.2 download link is broken/wrong/defective.

We tried multiple browser, but the zip file loads plain text, it doesn’t download.

Maybe something with content headers or file type that goes wrong?

Could you check?

6

Yes, you are right. I will notify you when it’s fixed

1 Like
8

@ronald.vanboven it works now. Please try again

9

Confirmed, download works again.
We will deploy and test.
I will give final confirmation of resolution in both topics once deployed on production.

Thanks for the help!

1 Like
10

The overall issue (lens visualization in library in RO mode) is confirmed fixed.

The download link also works properly.

Item closed.

1 Like