You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using a nested query from a user with a role containing FLS Includes rules, the query result is empty but I expect the query results to not be empty.
How can one reproduce the bug?
Steps to reproduce the behavior:
Create a role with FLS includes rules using either wildcard (nestedField*) or each field explicitly (nestedField.name). When listing fields explicitly, list nested fields as dot-separated starting from the root.
The text was updated successfully, but these errors were encountered:
cwperks
added
bug
Something isn't working
untriaged
Require the attention of the repository maintainers and may need to be prioritized
labels
May 17, 2024
[Triage] @cwperks thanks for filing this issue. It looks like there is a clear reproduction steps here and the bug seems like a bad user experience. We would gladly accept a PR to address this bug.
derek-ho
added
triaged
Issues labeled as 'Triaged' have been reviewed and are deemed actionable.
and removed
untriaged
Require the attention of the repository maintainers and may need to be prioritized
labels
May 20, 2024
What is the bug?
When using a nested query from a user with a role containing FLS Includes rules, the query result is empty but I expect the query results to not be empty.
How can one reproduce the bug?
Steps to reproduce the behavior:
Create test index
nestedField*
) or each field explicitly (nestedField.name
). When listing fields explicitly, list nested fields as dot-separated starting from the root.Create a role
Create documents
Create script
Search
What is the expected behavior?
The search query should return the matching documents
Do you have any additional context?
FLS with Includes is evaluated different than FLS with Excludes.
Searching with a painless script will use a
__nested_path
metaField behind the scenes which is not currently being tracked as a meta field: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/configuration/SecurityFlsDlsIndexSearcherWrapper.java#L41-L59The text was updated successfully, but these errors were encountered: