[Security Solutions] Add PLI authorisation for Cases Connector

[machadoum]

Summary

• Create a new capability called cases_connectors which will control the access to the cases connector feature. Note that for users to have access to this feature they also need to be authorized for cases feature and actions feature.
• Create a new API tag casesGetConnectorsConfigure to restrict access to the Get Connectors APIs.

Authorization

For the authorization of users we use a) a new UI capability b) a new API access tag and c) the existing Cases RBAC. The Cases feature privilege in Security solution is constructed based on the configuration provided by the security serverless plugin. The UI capability, the API tag, and the cases operations will be added/removed depending on the configuration.

UI capability

We include the CASES_CONNECTORS_CAPABILITY which will be used by the UI to show/hide various UI components responsible for the case connectors feature.

APIs

There are two APIs that use connectors in Cases. The Get Connectors API which returns all supported connectors by Cases and the Push Case API that push a case to an external service.

Get Connectors API

The Get Connectors API does not interact with any of the cases' saved objects. It uses the actionsClient, provided by the actions plugin, to get all connectors and filter out the ones supported by cases. For that reason, an API tag called GET_CONNECTORS_CONFIGURE_API_TAG is added to the API to control access. If the user has access to any of the Cases kibana privilege features (Security, Observability, or Stack) it will have access to the API. This is an expected behavior and in the Security serverless project, only one Case feature will be available.

Push Case API

The Push Case API already authorizes users by using the Cases RBAC. The user should have the push operation set in the Cases Kibana feature privilege to be able to use the API.

Permissions

Cases	Actions	Case Connectors	Outcome
read	all	all	See the connector but cannot edit (current behavior)
read	all	none	Hide the connectors in Cases
read	read	all	See the connector but cannot edit (current behavior)
read	read	none	Hide the connectors in Cases
all	all	all	Full access
all	all	none	Hide the connectors in Cases
all	read	all	Full access
all	read	none	Hide the connectors in Cases

When the Actions is set to none all connector features are hidden

How to test it?

ESS

• Run ESS and check if it still works as expected for all combinations of cases and actions permissions.

Serverless

• Run Serverless with security essentials (serverless.security.yml) and check if it works as expected for all combinations of cases and actions permissions.

xpack.serverless.security.productTypes:
  [
    { product_line: 'security', product_tier: 'essentials' }
  ]

• Run Serverless with security complete (config/serverless.security.yml) and check if it works as expected for all combinations of cases and actions permissions.

xpack.serverless.security.productTypes:
  [
    { product_line: 'security', product_tier: 'complete' },
  ]
 

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)

[mistic]

This PR broke main and I had the need to revert it c4557dd