Allow read_slm to call GET /_slm/status (#108333)

Add the ability to access the SLM status api to the read_slm privilege.
elastic · May 9, 2024 · ff20164 · ff20164
1 parent 6ecb295
commit ff20164
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 2 deletions.
diff --git a/docs/changelog/108333.yaml b/docs/changelog/108333.yaml
@@ -0,0 +1,5 @@
+pr: 108333
+summary: Allow `read_slm` to call GET /_slm/status
+area: ILM+SLM
+type: bug
+issues: []
diff --git a/.../java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java b/.../java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java
@@ -53,6 +53,7 @@
 import org.elasticsearch.xpack.core.security.action.user.ProfileHasPrivilegesAction;
 import org.elasticsearch.xpack.core.security.authc.Authentication;
 import org.elasticsearch.xpack.core.security.support.Automatons;
+import org.elasticsearch.xpack.core.slm.action.GetSLMStatusAction;
 import org.elasticsearch.xpack.core.slm.action.GetSnapshotLifecycleAction;
 
 import java.util.Collection;
@@ -165,7 +166,11 @@ public class ClusterPrivilegeResolver {
         ILMActions.STOP.name(),
         GetStatusAction.NAME
     );
-    private static final Set<String> READ_SLM_PATTERN = Set.of(GetSnapshotLifecycleAction.NAME, GetStatusAction.NAME);
+    private static final Set<String> READ_SLM_PATTERN = Set.of(
+        GetSLMStatusAction.NAME,
+        GetSnapshotLifecycleAction.NAME,
+        GetStatusAction.NAME
+    );
 
     private static final Set<String> MANAGE_SEARCH_APPLICATION_PATTERN = Set.of("cluster:admin/xpack/application/search_application/*");
     private static final Set<String> MANAGE_SEARCH_QUERY_RULES_PATTERN = Set.of("cluster:admin/xpack/query_rules/*");

diff --git a/...e/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/PrivilegeTests.java b/...e/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/PrivilegeTests.java
@@ -460,7 +460,12 @@ public void testSlmPrivileges() {
         }
 
         {
-            verifyClusterActionAllowed(ClusterPrivilegeResolver.READ_SLM, "cluster:admin/slm/get", "cluster:admin/ilm/operation_mode/get");
+            verifyClusterActionAllowed(
+                ClusterPrivilegeResolver.READ_SLM,
+                "cluster:admin/slm/get",
+                "cluster:admin/slm/status",
+                "cluster:admin/ilm/operation_mode/get"
+            );
             verifyClusterActionDenied(
                 ClusterPrivilegeResolver.READ_SLM,
                 "cluster:admin/slm/delete",