[BUG] OpenSearch Role with Unlimited Index Permissions Fails to View Indexes

[rootxrishabh]

Describe the bug

When creating a role in OpenSearch with unlimited index permissions and cluster_all permission for the cluster, then creating a user for a separate tenant (e.g., "testing") and assigning this user to the specified role while restricting the index pattern (e.g., test* instead of *), logging in as this user and attempting to view indexes starting with "test" in the UI results in the following error:

[security_exception] no permissions for [indices:monitor/settings/get] and User [name=corporate user, backend_roles=[], requestedTenant=testing]

The issue occurs despite the role having unrestricted index permissions. This suggests that OpenSearch security roles may not be correctly handling index pattern restrictions in conjunction with cluster-level permissions.

FYI: I am able to access indexes with the same role when I specify * index pattern instead of test*

NOTE: Explicitly giving the indices:monitor/settings/get permission also results in the same.

Would appreciate any insights on resolving this.

Related component

Indexing

To Reproduce

Steps to reproduce the behavior:

Create a role in OpenSearch with:

Index permissions: unlimited
Cluster permissions: cluster_all
Create a user and assign it to a separate tenant (e.g., "testing").

Assign the previously created role to this user and specify an index pattern other than , for example, test.

Log in to OpenSearch as the created user, and choose the tenant you attached it to earlier.

Try to view indexes that start with "test" in the OpenSearch UI.

Observe the error:
[security_exception] no permissions for [indices:monitor/settings/get] and User [name=corporate user, backend_roles=[], requestedTenant=testing]

Expected behavior

Should see all indexes starting with test* when logged in as this user.

Additional Details

Screenshots

Host/Environment (please complete the following information):

• OS: GCOS (google container optimized OS)
• Version 2.19.0
  Additional context
  Using opensearch operator deployment on GKE.

[cwperks]

@rootxrishabh Can you share the full role definition corresponding to this:

Create a role in OpenSearch with:

Index permissions: unlimited
Cluster permissions: cluster_all

^ unlimited is an action group and means any action can be performed, but you also need to specify which indices that is applicable to. What index pattern are you entering into the role definition?

[rootxrishabh]

Hi @cwperks , I was using the "test*" index pattern which resulted in this error. However, "*" worked.

[cwperks]

Got it. Can you check in the browser dev tools network tab to see if its any particular API call that gives the error? Looks like this should be transferred to ISM repo.

[cwperks]

Looks same as opensearch-project/index-management#959

[cwperks]

One workaround could be to set do_not_fail_on_forbidden to true: https://opensearch.org/docs/latest/security/access-control/permissions/#do_not_fail_on_forbidden

I think the reason its failing is because _cat/indices is giving a forbidden response when the role is scoped to test*. By setting do_not_fail_on_forbidden to true, _cat/indices will successfully respond but only include the indices visible to the logged in user.

[rootxrishabh]

Not sure, what is meant by "indices visible to the logged in user only". I understand indices are global correct?

[cwperks]

There is a notion of "hidden" indices where they can intentionally be hidden from the output of _cat/indices, but in this case the error arises from the internal implementation of _cat/indices. The API handler for _cat/indices relies on the abilities to get settings for the given index and when the role is scoped to test* one of the index settings calls fails and fails the entire request.

IMO the fix for this is in the ISM dashboards plugin to limit the _cat/indices call to filter being applies. i.e. have the call be _cat/indices/test* instead of _cat/indices

[cwperks]

@nibix I'd be curious to have your thoughts on this as well. I know that DNFOF disabled is default in the security plugin, I'm wondering if we can switch the default to true (at least in some circumstance) like for the indices:monitor/settings/get action.

I think the current behavior is confusing where _cat/indices will fail by default for scoped down roles when it really should succeed.

Relevant section of code: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java#L541

[nibix]

@cwperks I have written a reply to your question at opensearch-project/security#5195 (comment)