Update security deprecation messages #115241

jportner · 2021-10-15T18:01:47Z

Screenshots

(1) and (2), which use the same string templates and are mutually exclusive

(3) and (4), which use the same string templates are mutually exclusive

(5)

(6)

(7)

jportner

Author's notes for reviewers. I already went over these once with @gchaps but will tag her again for a final review.

jportner · 2021-10-15T18:08:27Z

x-pack/plugins/monitoring/server/deprecations.ts

+    // TODO: Add deprecations for "monitoring.ui.elasticsearch.username: elastic" and "monitoring.ui.elasticsearch.username: kibana".
+    // TODO: Add deprecations for using "monitoring.ui.elasticsearch.ssl.certificate" without "monitoring.ui.elasticsearch.ssl.key", and
+    // vice versa.
+    // ^ These deprecations should only be shown if they are explicitly configured for monitoring -- we should not show Monitoring
+    // deprecations for these settings if they are inherited from the Core elasticsearch settings.
+    // See the Core implementation: src/core/server/elasticsearch/elasticsearch_config.ts


The monitoring code had identical deprecations for (1), (2), (3), and (4) in the PR description. It would basically make those deprecations show up twice, which is confusing.

We currently don't have the ability to differentiate if these options were set in the raw Monitoring config (monitoring.ui.elasticsearch.*) or if they were inherited from the Core config (elasticsearch.*). Monitoring should only register config deprecations for actual Monitoring config settings.

Since these are not breaking in 8.0, I think we should remove these Monitoring deprecations completely until we refactor the code and can differentiate between the two.

Since these are not breaking in 8.0, I think we should remove these Monitoring deprecations completely until we refactor the code and can differentiate between the two

Is there a follow up issue for that? Removing deprecations that seem to be duplicates make sense. I just want to make sure we do actually follow up on this a.s.a.p.

I'll make a note to create a follow-up after this merges. I'll add a permalink to this section in the follow up issue's description.

I added a follow-up issue for this: #115597

jportner · 2021-10-15T18:09:52Z

src/core/server/elasticsearch/elasticsearch_config.ts

@@ -8,6 +8,7 @@



I changed Core deprecations here, but these particular ones were added by the Platform Security team, so I thought it would be prudent to update them along with our other deprecations 👍

jportner · 2021-10-15T18:36:04Z

@elasticmachine merge upstream

legrego

Changes look great! I'm about to test locally now, but wanted to leave my minor feedback in the meantime

src/core/server/elasticsearch/elasticsearch_config.ts

legrego · 2021-10-15T18:32:16Z

x-pack/plugins/security/server/config_deprecations.ts

+                'Remove the "xpack.security.authc.providers" setting from kibana.yml.',
+            }),
+            i18n.translate('xpack.security.deprecations.authcProviders.manualSteps2', {
+              defaultMessage: 'Add your authentication providers using the new object format.',


I really wish we had markdown support here. I think we have enough information here to build a correct object-based representation of their array-based configuration, which would make the upgrade process so much nicer.

Agree 100%. It doesn't sound like that will land in 7.16.0, but I think we'd be justified to backport it to 7.16.1 to make the upgrade experience smoother. In that case I'd like to go back and tweak some of these messages that would be better served by markdown

I hear you! Time permitting, we'll try to slot kibana/issues/111068 in. However, there are some gotcha's with i18n and a few other considerations we need to account for that make the task a little more complex.

legrego · 2021-10-15T18:33:26Z

x-pack/plugins/security/server/config_deprecations.ts

        }),
        message: i18n.translate('xpack.security.deprecations.basicAndTokenProvidersMessage', {
          defaultMessage:
-            'Enabling both "basic" and "token" authentication providers in "xpack.security.authc.providers" is deprecated. Login page will only use "token" provider.',
+            'Use only one of these providers. When both providers are set, the login page only uses the "{tokenProvider}" provider.',


Is there a reason to say "the login page", and not "Kibana"? This also technically applies to API consumers, where the login page is not used.

Ah, I wasn't sure, the existing string said "login page" so I left it. @azasypkin do you have any opinion here? Should we just change it to "When both providers are set, Kibana only uses the "token" provider. ?

Tentatively changed in e584ec4 👍

It seems I wanted to be technically correct here since you can hit login endpoint with the specific provider name directly and use that specific provider, login page cannot do this 😆 But yeah, don't have a strong opinion here, Kibana instead of login page sounds good to me as well.

x-pack/plugins/security/server/config_deprecations.ts

src/core/server/elasticsearch/elasticsearch_config.ts

TinaHeiligers

Thanks for updating the deprecation levels here!
A few comments/suggestions and a question about wording.

TinaHeiligers · 2021-10-15T18:58:45Z

x-pack/plugins/security/server/config_deprecations.ts

        }),
        message: i18n.translate('xpack.security.deprecations.basicAndTokenProvidersMessage', {
          defaultMessage:
-            'Enabling both "basic" and "token" authentication providers in "xpack.security.authc.providers" is deprecated. Login page will only use "token" provider.',
+            'Use only one of these providers. When both providers are set, the login page only uses the "{tokenProvider}" provider.',


Suggested change

'Use only one of these providers. When both providers are set, the login page only uses the "{tokenProvider}" provider.',

'Only use one provider. When both providers are set, the login page only uses the "{tokenProvider}" provider.',

I'll defer to @gchaps here, but I worded it this way because the user may have other providers configured too (saml, oidc, etc). So I don't want to suggest that they should remove all but one provider.

phillipb

LGTM

TinaHeiligers

Thanks for the changes!
LGTM

Also fixed a few broken Jest unit tests!

kibanamachine · 2021-10-15T21:40:55Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💔 Build #161587 failed 3913a50

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

jportner · 2021-10-18T12:43:56Z

@elasticmachine merge upstream

legrego

LGTM, thanks for the edits!

Note: I skipped `xpack.security.enabled`, `xpack.spaces.enabled`, and the legacy audit logger because those are being removed in 8.0 / they have their own 7.x-specific PRs to make those changes.

jportner · 2021-10-18T13:33:06Z

I added b409027 to address #115344 👍

kibanamachine · 2021-10-18T15:33:10Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Update security deprecation messages (#115241) * Fix Jest tests that were changed upstream * Add missing deprecation levels for plugins' `enabled` config options For the Security, Spaces, and ESO plugins.

TinaHeiligers · 2021-11-02T18:59:06Z

@jportner we're auditing the kibana.yml file and the deprecations added here mention using a service account token rather than username/password for Kibana <-> ES auth when deprecated values are set (elastic/kibana).

Should we consider removing the kibana username/password config option in the main template or at least mention that it might be deprecated in a future release?
OTOH, with the new make it minor strategy, maybe we shouldn't mention it will be removed in favor of service account tokens.
WDYT?

jportner · 2021-11-02T19:39:34Z

Hey @TinaHeiligers, great question!

I apologize that this isn't super clear, some of this discussion took place over email with the ES Security team and was not captured in GitHub.

To summarize our current state of thinking:

We are not planning to deprecate elasticsearch.username and elasticsearch.password
However, with the new Security On By Default initiative, we want to start guiding users towards using a Service Account Token instead, which is a better paradigm in general for machine-to-machine authentication
Since we deprecated using the "elastic" and "kibana" users to authenticate Kibana to Elasticsearch (e.g., elasticsearch.username: elastic and elasticsearch.username: kibana, respectively), we decided to go ahead and tell affected users to use a Service Account Token in the Upgrade Assistant, because Elasticsearch allows it even without TLS enabled starting in 7.16

The kibana.yml template file already contains elasticsearch.username, elasticsearch.password, and elasticsearch.serviceAccountToken, so I think it's good for now.

I do think we need to make additional changes in the 8.0 Kibana Security docs to make sure they flow well with the 8.0 Elastic Stack Security docs, so I'm glad you brought this up. I created an issue for it here: #117223

Update security deprecations

3913a50

jportner added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.16.0 labels Oct 15, 2021

jportner commented Oct 15, 2021

View reviewed changes

jportner marked this pull request as ready for review October 15, 2021 18:10

jportner requested review from a team as code owners October 15, 2021 18:10

jportner requested review from a team and legrego October 15, 2021 18:10

Merge branch 'master' into update-security-deprecation-messages

ace4b2c

legrego reviewed Oct 15, 2021

View reviewed changes

TinaHeiligers reviewed Oct 15, 2021

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Show resolved Hide resolved

TinaHeiligers reviewed Oct 15, 2021

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Show resolved Hide resolved

TinaHeiligers reviewed Oct 15, 2021

View reviewed changes

src/core/server/elasticsearch/elasticsearch_config.ts Outdated Show resolved Hide resolved

TinaHeiligers reviewed Oct 15, 2021

View reviewed changes

phillipb approved these changes Oct 15, 2021

View reviewed changes

TinaHeiligers self-requested a review October 15, 2021 19:12

TinaHeiligers approved these changes Oct 15, 2021

View reviewed changes

PR review feedback

e584ec4

Also fixed a few broken Jest unit tests!

jportner mentioned this pull request Oct 15, 2021

[Meta] Platform Security team - 8.0 upgrade work #111160

Closed

Merge branch 'master' into update-security-deprecation-messages

2c66a36

jportner requested a review from legrego October 18, 2021 12:44

legrego approved these changes Oct 18, 2021

View reviewed changes

Add deprecation levels for other config deprecations

b409027

Note: I skipped `xpack.security.enabled`, `xpack.spaces.enabled`, and the legacy audit logger because those are being removed in 8.0 / they have their own 7.x-specific PRs to make those changes.

jportner added the buildkite-ci label Oct 18, 2021

jportner merged commit 6792bdf into elastic:master Oct 18, 2021

jportner deleted the update-security-deprecation-messages branch October 18, 2021 15:34

jportner mentioned this pull request Oct 18, 2021

[7.x] Update security deprecation messages (#115241) #115395

Merged

jportner added a commit to jportner/kibana that referenced this pull request Oct 18, 2021

Update security deprecation messages (elastic#115241)

e0e7dd9

jportner mentioned this pull request Oct 18, 2021

Explicitly set level for all registered deprecations #115344

Closed

32 tasks

jportner mentioned this pull request Oct 19, 2021

Monitoring plugin elasticsearch config deprecations #115597

Open

jportner mentioned this pull request Jan 11, 2022

Use "critical" deprecation level for elasticsearch.username: elastic configuration #122704

Closed

jportner mentioned this pull request Feb 4, 2022

Suggestion to create service account tokens using CLI is wrong #124691

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update security deprecation messages #115241

Update security deprecation messages #115241

jportner commented Oct 15, 2021 •

edited

Loading

jportner left a comment

jportner Oct 15, 2021

TinaHeiligers Oct 15, 2021

jportner Oct 15, 2021

jportner Oct 19, 2021

jportner Oct 15, 2021

jportner commented Oct 15, 2021

legrego left a comment

legrego Oct 15, 2021

jportner Oct 15, 2021

TinaHeiligers Oct 15, 2021 •

edited

Loading

legrego Oct 15, 2021

jportner Oct 15, 2021

jportner Oct 15, 2021

azasypkin Oct 18, 2021

TinaHeiligers left a comment

TinaHeiligers Oct 15, 2021

jportner Oct 15, 2021 •

edited

Loading

phillipb left a comment

TinaHeiligers left a comment

kibanamachine commented Oct 15, 2021

jportner commented Oct 18, 2021

legrego left a comment

jportner commented Oct 18, 2021

kibanamachine commented Oct 18, 2021

TinaHeiligers commented Nov 2, 2021 •

edited

Loading

jportner commented Nov 2, 2021 •

edited

Loading

	'Use only one of these providers. When both providers are set, the login page only uses the "{tokenProvider}" provider.',
	'Only use one provider. When both providers are set, the login page only uses the "{tokenProvider}" provider.',

Update security deprecation messages #115241

Update security deprecation messages #115241

Conversation

jportner commented Oct 15, 2021 • edited Loading

Screenshots

jportner left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner commented Oct 15, 2021

legrego left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TinaHeiligers Oct 15, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TinaHeiligers left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner Oct 15, 2021 • edited Loading

Choose a reason for hiding this comment

phillipb left a comment

Choose a reason for hiding this comment

TinaHeiligers left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 15, 2021

💚 Build Succeeded

Metrics [docs]

History

jportner commented Oct 18, 2021

legrego left a comment

Choose a reason for hiding this comment

jportner commented Oct 18, 2021

kibanamachine commented Oct 18, 2021

💚 Build Succeeded

Metrics [docs]

TinaHeiligers commented Nov 2, 2021 • edited Loading

jportner commented Nov 2, 2021 • edited Loading

jportner commented Oct 15, 2021 •

edited

Loading

TinaHeiligers Oct 15, 2021 •

edited

Loading

jportner Oct 15, 2021 •

edited

Loading

TinaHeiligers commented Nov 2, 2021 •

edited

Loading

jportner commented Nov 2, 2021 •

edited

Loading