Conversation
Move ReadonlyREST Kibana configuration into the main ES configuration file and update plugin versions.
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📝 WalkthroughWalkthroughThe showcase now uses Elasticsearch and Kibana 9.5.0. ReadonlyREST contains Keycloak SAML/OIDC and LemonLDAP OIDC settings. Both Kibana image variants package the shared ReadonlyREST configuration. ChangesKibana authentication
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Kibana
participant ReadonlyREST
participant Keycloak
participant LemonLDAP
Kibana->>ReadonlyREST: Load authentication configuration
ReadonlyREST->>Keycloak: Use SAML or OIDC endpoints
ReadonlyREST->>LemonLDAP: Use OIDC endpoints
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ror-demo-cluster/conf/es/readonlyrest.yml`:
- Around line 90-91: Update the groupsParameter setting in the readonlyrest
configuration from Role to memberOf, while leaving usernameParameter unchanged,
so SAML group claims map correctly for ACL assignments.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c1cf036f-3920-489c-a0e4-bb1e0e84fffb
⛔ Files ignored due to path filters (1)
ror-demo-cluster/readonlyrest_kbn_universal-1.71.0-pre4_es9.5.0.zipis excluded by!**/*.zip
📒 Files selected for processing (5)
ror-demo-cluster/.env-showcaseror-demo-cluster/conf/es/readonlyrest.ymlror-demo-cluster/conf/kbn/enterprise-ror-newplatform-kibana.ymlror-demo-cluster/images/kbn/Dockerfile-use-ror-binaries-from-apiror-demo-cluster/images/kbn/Dockerfile-use-ror-binaries-from-file
💤 Files with no reviewable changes (1)
- ror-demo-cluster/conf/kbn/enterprise-ror-newplatform-kibana.yml
Comment on lines
+90
to
+91
| usernameParameter: 'nameID' | ||
| groupsParameter: 'Role' |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
jq '
.clients[]
| select(.clientId == "ror-saml")
| {
defaultClientScopes,
protocolMappers: [
.protocolMappers[]
| {name, protocolMapper, config}
]
}
' ror-demo-cluster/conf/keycloak/ror-realm.json
rg -n -C 3 'groupsParameter|external_group_ids|memberOf|Role' \
ror-demo-cluster/conf/es/readonlyrest.yml \
ror-demo-cluster/conf/keycloak/ror-realm.jsonRepository: beshu-tech/ror-sandbox
Length of output: 7797
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
p = Path("ror-demo-cluster/conf/keycloak/ror-realm.json")
data = json.loads(p.read_text())
client = next(c for c in data["clients"] if c.get("clientId") == "ror-saml")
print("client protocol:", client.get("protocol"))
print("client defaultClientScopes:", client.get("defaultClientScopes"))
print("client protocolMappers:")
for mapper in client.get("protocolMappers", []):
print(json.dumps(mapper, sort_keys=True))
print("\nall protocol mappers mentioning Role, memberOf, or groups:")
for owner, obj in [("client", client)] + [
(f"clientScope:{scope.get('name')}", scope)
for scope in data.get("clientScopes", [])
]:
for mapper in obj.get("protocolMappers", []):
text = json.dumps(mapper, sort_keys=True)
if any(term in text for term in ("Role", "memberOf", "groups")):
print(owner, text)
print("\nuser groups:")
for user in data.get("users", []):
print(user.get("username"), user.get("groups", []))
PY
rg -n -C 4 'groupsParameter|usernameParameter|memberOf|saml-group-membership-mapper|attribute.name.?["'\'']?[ :]?["'\'']?Role|name.?Role' \
--glob '!*.lock' .Repository: beshu-tech/ror-sandbox
Length of output: 12988
Set groupsParameter to memberOf.
The Keycloak SAML mapper emits memberOf, and no mapper emits Role. The current setting prevents group-based ACL assignments for SAML users.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ror-demo-cluster/conf/es/readonlyrest.yml` around lines 90 - 91, Update the
groupsParameter setting in the readonlyrest configuration from Role to memberOf,
while leaving usernameParameter unchanged, so SAML group claims map correctly
for ACL assignments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes