[FEATURE] Add user level access control based on backend roles

[amitgalitz]

Is your feature request related to a problem?

What we have now:

If users want to send requests to the Flow-Framework plugin to create/get workflows, they should have appropriate permissions to perform the actions. The security plugin has two built-in roles to cover flow-framework use cases: flow_framework_read_access, and flow_framework_full_access.

What solution would you like?

1. Add security-based access control so that only authorized users have access to workflows created/owned by other users. This feature is similar to AD/Alerting plugin resource control where a user can only access the detectors/monitors when at least one of the back-end roles of the user matches with that of the detectors/monitors.

2. Users are mapped to back-end roles based on which we filter the workflows/templates that can be accessed by them. Whenever a user sends an flow-framework API request, along with verifying if they have appropriate permissions, we also check them against authorized back-end roles. Each user can have more than one back-end role.

3. Back-end role-based access control enable an additional layer of security where a user can access only those workflows that are owned by same back-end role users.

4. We should have a setting to enabled filtering by backend role like other plugins have.

We should follow exact same interface as AD has here : https://opensearch.org/docs/latest/observing-your-data/ad/security/#advanced-limit-access-by-backend-role

Task Breakdown

In order to enable access control based on backend role filtering we will need to make modification in all APIs

In summary we want to be checking the backend role of the user making the request and comparing it to the backend role of the user that created the template.

This feature will be enabled/disabled by a new setting: filter_by_backend_roles

Tasks

Tasks 1,2,3 can be done at the same time as task 4 and 5. (4, 5 don't depend on prior tasks)

1. Create common util methods to get a workflow and then compare if requested user has backend role required to access the resource
2. Block creation of workflows if user doesn’t have a backend role
3. Change following APIs with a check to see if user has permission to the resource using common method in task 1: update workflow, get workflow, provision workflow, get workflow status, deprovision workflow and delete workflow
4. Create a common util method to add backend role for search requests (search workflows and search workflow state)
5. Update following API with additional backend role query in search request: search workflows and search workflow states
6. Security Integ tests for all APIs with backend roles considered
7. BWC tests if we make changes to the system index

Additional Consideration:

An additional request that customers have asked for in the past include the ability to change the backend role configured with a particular resource after creation. This is something that hasn’t been implemented in AD but has been implemented in Alerting and ML-Commons through model groups.

Alerting had a solution for this by adding a new field specifying the backend roles and adding logic for admins and other users to either set these fields or update them: opensearch-project/alerting#635 I estimate this will take around 2 weeks to add if we go for the same complexity

ML-Commons has a slightly different solution because they have different concepts of access through the model access groups, where they already had a different field for backendroles.

However if we see ourselves adding the ability to assign backend roles in the near future we might want to add a new backend role field already in our initial implementation.

[owaiskazi19]

1. User alice with odfe backend role

{
  "password": "123alice!",
  "backend_roles": [
    "odfe"
  ],
  "attributes": {}
}

2. User elk with odfe and sysadmin backend roles

{
  "password": "123elk45!",
  "backend_roles": [
    "odfe",
    "hr"
  ],
  "attributes": {}
}

3. User bob with opensearch backend role

{
  "password": "123bob45!",
  "backend_roles": [
    "opensearch"
  ],
  "attributes": {}
}

4. Give all the users flow_framework_all_access and ml_full_access

{
  "backend_roles": [],
  "hosts": [],
  "users": [
    "alice",
    "elk",
    "bob"
  ]
}

5. Enable backend role filtering

6. User alice creates a workflow

7. User elk is able to access the workflow since they have odfe has a common backend role and has all the permissions

8. User bob with no common backend roles tries to access the same workflow created by alice gets the permission error because it doesn't have a same backend role