Skip to content

Commit

Permalink
Switch to chart reference
Browse files Browse the repository at this point in the history
Signed-off-by: Peter Nied <petern@amazon.com>
  • Loading branch information
peternied committed Aug 7, 2023
1 parent 9462c12 commit a4337b0
Showing 1 changed file with 1 addition and 32 deletions.
33 changes: 1 addition & 32 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,38 +120,7 @@ It is common practice to create new transport actions to perform different tasks
2. Register the action in the [OpenSearch Security plugin](https://github.com/opensearch-project/security). Each new action is registered in the plugin as a new permission. Usually, plugins will define different roles for their plugin (e.g., read-only access, write access). Each role will contain a set of permissions. An example of adding a new permission to the `anomaly_read_access` role for the [Anomaly Detection plugin](https://github.com/opensearch-project/anomaly-detection) can be found in [this PR](https://github.com/opensearch-project/security/pull/997/files).
3. Register the action in the [OpenSearch Dashboards Security plugin](https://github.com/opensearch-project/security-dashboards-plugin). This plugin maintains the full list of possible permissions, so users can see all of them when creating new roles or searching permissions via Dashboards. An example of adding different permissions can be found in [this PR](https://github.com/opensearch-project/security-dashboards-plugin/pull/689/files).

```mermaid
sequenceDiagram
participant Client
participant OpenSearch
participant SecurityPlugin
participant Cluster as Plugin
Client->>OpenSearch: Request
OpenSearch->>SecurityPlugin: Request
SecurityPlugin->>SecurityPlugin: Add Auth information to request context
OpenSearch->>Cluster: Client Request
Cluster->>SecurityPlugin: Execute transport layer action
SecurityPlugin->>SecurityPlugin: Check if action is allowed
alt Allowed
SecurityPlugin->>OpenSearch: Continue request
OpenSearch-->>Cluster: Transport layer action result
else Denied
SecurityPlugin-->>OpenSearch: Return 403 Forbidden
OpenSearch-->>Client: 403 Forbidden
end
alt Plugin run outside user context
Cluster->>Cluster: Stash context
Cluster->>SecurityPlugin: Execute transport layer action outside user context
SecurityPlugin-->>SecurityPlugin: Check if action is allowed
SecurityPlugin->>OpenSearch: Continue request
OpenSearch-->>Cluster: Transport layer action result
Cluster->>Cluster: Restore user context
end
Cluster-->>SecurityPlugin: Result
SecurityPlugin-->>OpenSearch: Result
OpenSearch-->>Client: Result
```
See the [plugin-authorization-flows](ARCHITECTURE.md#plugin-authorization-flows) in the ARCHITECTURE.md.

### System Index Protection

Expand Down

0 comments on commit a4337b0

Please sign in to comment.