ACL based on a field value about elasticsearch-readonlyrest-plugin HOT 5 CLOSED

A field in the yaml would basically be a multiline string with a function in JS. Imagine the rule:

name: script rule
type: allow
request_script: >
  function onRequest(reqContext) {
      reqContext.getIndices() ...
     if(reqContext.getAction() == 'blah') {
      return false; // NO_MATCH
     }
    if(reqContext.getOriginAddress() == '127.0.0.1' ) { return true; // MATCH }
  }

But what I'd like to do is also this:

name: script rule
type: allow
request_script: >
  function onRequest() {.....} 
response_script: >
  function onResponse(response) {
    var r = JSON.parse(response);
     r = r.property = { manipulatedProperty: "stuffHere"};
    return r;
  }

Is this too low level? Would it be useful?

from elasticsearch-readonlyrest-plugin.

X-Pack calls this document level security btw and they also offer field level security: https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html
I think having both of these would be very useful and I suppose with the response_script option one could probably use that to filter out certain fields or documents. I think also the request_script looks pretty useful.

from elasticsearch-readonlyrest-plugin.

This is quite advanced, needs a bit of research. But if I recall correctly Search Guard has something similar and I could take some inspiration.

Nice one though, thanks for the cool idea!

#TODO

from elasticsearch-readonlyrest-plugin.

@elvarb I was thinking about supporting a javascript callback where people can apply custom business logic like this one. Would you be interested?

from elasticsearch-readonlyrest-plugin.

How would that work?

from elasticsearch-readonlyrest-plugin.