Admin and Super Admin (security admin) Documentation Update #7069

leanneeliatra · 2024-05-01T09:35:01Z

Description

The addition of supporting documentation to describe the Administration roles and their purposes in OpenSearch. This documentation update will cover the Admin and Super admin role in OpenSearch.

Issues Resolved

Closes [DOC]Add documentation to clarify differences between admin and super admin roles #4646

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

hdhalter · 2024-05-07T22:15:33Z

@leanneeliatra - Is this ready for review?

leanneeliatra · 2024-05-08T09:13:42Z

@leanneeliatra - Is this ready for review?

Hi @hdhalter it is still in progress at the moment, I will be adding some updates to this section of the docs today. Thanks a million.

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

leanneeliatra · 2024-05-15T14:32:00Z

This ticket is now ready for review. cc @hdhalter

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

leanneeliatra · 2024-05-28T19:48:45Z

Apologies if I missed that last capitalisation link @hdhalter. All changes now integrated! Thanks.

hdhalter · 2024-05-28T21:38:17Z

@Naarcha-AWS - Can you please take a final look at this? An editorial request has been submitted. Thanks!

_security/configuration/tls.md

_troubleshoot/security-admin.md

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

_security/access-control/users-roles.md

_security/configuration/tls.md

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

natebower

@leanneeliatra @Naarcha-AWS Please see my comments and changes and tag me for approval on lines 265 and 274 in users-roles.md and 131 and 138 in security-admin.md. Thanks!

_security/access-control/users-roles.md

natebower · 2024-06-05T11:20:38Z

_security/access-control/users-roles.md

+
+#### Authentication of super admin role
+
+Super admins are authenticated through certificates, not passwords. The necessary certificates are defined in the `admin_dn` section of the `opensearch.yml` file and must be signed with the same root CA to verify and connect it to the cluster.


Should this end in a colon? What is being shown in the following example?

natebower · 2024-06-05T11:22:38Z

_security/configuration/tls.md

 ## Configuring admin certificates

-Admin certificates are regular client certificates that have elevated rights to perform administrative tasks. You need an admin certificate to change the Security plugin configuration using [`plugins/opensearch-security/tools/securityadmin.sh`]({{site.url}}{{site.baseurl}}/security/configuration/security-admin/) or the REST API. Admin certificates are configured in `opensearch.yml` by stating their DN(s):
+Super admin certificates are regular client certificates that have elevated rights to perform administrative security and OpenSearch related tasks. You need an admin certificate to change the Security plugin configuration using [`plugins/opensearch-security/tools/securityadmin.sh`]({{site.url}}{{site.baseurl}}/security/configuration/security-admin/) or the REST API. Super admin certificates are configured in `opensearch.yml` by stating their DN(s):


"security and OpenSearch related tasks" is too vague and doesn't work here. Please revise for clarity.

natebower · 2024-06-05T11:23:12Z

_security/configuration/tls.md

 ```

-For security reasons, you can't use wildcards or regular expressions here.
+For security reasons, you cannot use wildcards or regular expressions here. 


Please replace "here" with a more precise expression.

_security/configuration/tls.md

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

_security/configuration/tls.md

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

natebower

@Naarcha-AWS LGTM with one minor change. Thanks!

_security/configuration/tls.md

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

* adding information about the admin and security admin roles Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * reviewdog fixes Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * updating admin priveleges documentation Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * admin and super admin documentation added and made clearer Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * review dog signoff Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * removing extra space Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * added further clarification for superAdmin certs Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Co-authored-by: Heather Halter <HDHALTER@AMAZON.COM> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * reviewdog address Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Co-authored-by: Heather Halter <HDHALTER@AMAZON.COM> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> * calling out super admin where appropriate Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * capitalise linked reference Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com> Signed-off-by: leanneeliatra <131779422+leanneeliatra@users.noreply.github.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Heather Halter <HDHALTER@AMAZON.COM> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com> (cherry picked from commit 7dd0961) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…7300)

adding information about the admin and security admin roles

db0873d

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

leanneeliatra requested review from AMoo-Miki, Naarcha-AWS, dlvenable, epugh, hdhalter, kolchfa-aws, natebower, stephen-crawford and vagimeli as code owners May 1, 2024 09:35

leanneeliatra and others added 2 commits May 1, 2024 15:38

reviewdog fixes

9bb8679

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

Merge branch 'main' into 4646-admin-and-super-admin-roles

f01e1d0

hdhalter added security In progress Issue/PR: The issue or PR is in progress. backport 2.13 PR: Backport label for 2.13 labels May 1, 2024

Merge branch 'main' into 4646-admin-and-super-admin-roles

13df501

hdhalter mentioned this pull request May 7, 2024

[DRAFT] Security feature SuperAdmin documentation updates #6927

Closed

1 task

leanneeliatra and others added 2 commits May 8, 2024 10:13

Merge branch 'main' into 4646-admin-and-super-admin-roles

20eb2f3

updating admin priveleges documentation

c44a0cf

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

hdhalter mentioned this pull request May 8, 2024

[DOC] Missing documentation for security features #433

Closed

admin and super admin documentation added and made clearer

27f0f78

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

leanneeliatra changed the title ~~[DRAFT] Adding information about the admin and security admin roles~~ Admin and Super Admin (security admin) Documentation Update May 15, 2024

Merge branch 'main' into 4646-admin-and-super-admin-roles

a2636c8

leanneeliatra added 2 commits May 15, 2024 15:40

review dog signoff

70ba22b

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

removing extra space

2441b92

Signed-off-by: leanne.laceybyrne@eliatra.com <leanne.laceybyrne@eliatra.com>

hdhalter added Tech review PR: Tech review in progress and removed In progress Issue/PR: The issue or PR is in progress. labels May 15, 2024

Merge branch 'main' into 4646-admin-and-super-admin-roles

295945b

hdhalter assigned Naarcha-AWS and unassigned hdhalter May 28, 2024

Naarcha-AWS reviewed May 29, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Naarcha-AWS reviewed May 29, 2024

View reviewed changes

_troubleshoot/security-admin.md Outdated Show resolved Hide resolved

Naarcha-AWS and others added 2 commits May 29, 2024 13:40

Apply suggestions from code review

9534b29

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Merge branch 'main' into 4646-admin-and-super-admin-roles

49b37ef

Naarcha-AWS reviewed Jun 4, 2024

View reviewed changes

_security/access-control/users-roles.md Outdated Show resolved Hide resolved

Naarcha-AWS reviewed Jun 4, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Apply suggestions from code review

def92af

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Naarcha-AWS added Editorial review PR: Editorial review in progress and removed Doc review PR: Doc review in progress labels Jun 4, 2024

Merge branch 'main' into 4646-admin-and-super-admin-roles

ddcb4a3

natebower requested changes Jun 5, 2024

View reviewed changes

Naarcha-AWS reviewed Jun 5, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Naarcha-AWS reviewed Jun 5, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Apply suggestions from code review

ac2b376

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Naarcha-AWS requested a review from natebower June 5, 2024 16:45

Naarcha-AWS reviewed Jun 5, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Apply suggestions from code review

454ab98

Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

natebower approved these changes Jun 5, 2024

View reviewed changes

_security/configuration/tls.md Outdated Show resolved Hide resolved

Apply suggestions from code review

056095d

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com>

Naarcha-AWS approved these changes Jun 5, 2024

View reviewed changes

Merge branch 'main' into 4646-admin-and-super-admin-roles

91dcf94

Naarcha-AWS merged commit 7dd0961 into opensearch-project:main Jun 5, 2024

opensearch-trigger-bot bot mentioned this pull request Jun 5, 2024

[Backport 2.14] Admin and Super Admin (security admin) Documentation Update #7300

Merged

github-actions bot pushed a commit that referenced this pull request Jun 5, 2024

Admin and Super Admin (security admin) Documentation Update (#7069) (#…

9901b61

…7300)


		#### Authentication of super admin role

		Super admins are authenticated through certificates, not passwords. The necessary certificates are defined in the `admin_dn` section of the `opensearch.yml` file and must be signed with the same root CA to verify and connect it to the cluster.

Admin and Super Admin (security admin) Documentation Update #7069

Admin and Super Admin (security admin) Documentation Update #7069

Uh oh!

Conversation

leanneeliatra commented May 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Checklist

Uh oh!

hdhalter commented May 7, 2024

Uh oh!

leanneeliatra commented May 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leanneeliatra commented May 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leanneeliatra commented May 28, 2024

Uh oh!

hdhalter commented May 28, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natebower left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natebower Jun 5, 2024

Choose a reason for hiding this comment

Uh oh!

natebower Jun 5, 2024

Choose a reason for hiding this comment

Uh oh!

natebower Jun 5, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natebower left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

leanneeliatra commented May 1, 2024 •

edited

Loading

leanneeliatra commented May 8, 2024 •

edited

Loading

leanneeliatra commented May 15, 2024 •

edited

Loading