[skip ci] feedback on approach for token provider

x-pack/plugins/security/server/lib/authentication/providers/token.js

@@ -0,0 +1,215 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { canRedirectRequest } from '../../can_redirect_request';
+import { AuthenticationResult } from '../authentication_result';
+import { DeauthenticationResult } from '../deauthentication_result';
+
+/**
+ * Object that represents available provider options.
+ * @typedef {{
+ *  protocol: string,
+ *  hostname: string,
+ *  port: string,
+ *  basePath: string,
+ *  client: Client,
+ *  log: Function
+ * }} ProviderOptions
+ */
+
+/**
+ * Checks the error returned by Elasticsearch as the result of `authenticate` call and returns `true` if request
+ * has been rejected because of expired token, otherwise returns `false`.
+ * @param {Object} err Error returned from Elasticsearch.
+ * @returns {boolean}
+ */
+function isAccessTokenExpiredError(err) {
+  return err.body
+    && err.body.error
+    && err.body.error.reason === 'token expired';
+}
+
+/**
+ * Provider that supports request authentication via Basic HTTP Authentication.
+ */
+export class TokenAuthenticationProvider {
+  /**
+   * Server options that may be needed by authentication provider.
+   * @type {?ProviderOptions}
+   * @protected
+   */
+  _options = null;
+
+  /**
+   * Instantiates BasicAuthenticationProvider.
+   * @param {ProviderOptions} options Provider options object.
+   */
+  constructor(options) {
+    this._options = options;
+  }
+
+  /**
+   * Performs request authentication using Basic HTTP Authentication.
+   * @param {Hapi.Request} request HapiJS request instance.
+   * @param {Object} [state] Optional state object associated with the provider.
+   * @returns {Promise.<AuthenticationResult>}
+   */
+  async authenticate(request, state) {
+    this._options.log(['debug', 'security', 'token'], `Trying to authenticate user request to ${request.url.path}.`);
+
+    // first try from login payload
+    let authenticationResult = await this._authenticateViaLoginAttempt(request);
+
+    // if there isn't a payload, try basic auth
+    if (authenticationResult.notHandled()) {
+      authenticationResult = await this._authenticateViaHeader(request);
+    }
+
+    // if we still can't attempt auth, try authenticating via state (session token)
+    if (authenticationResult.notHandled()) {
+      authenticationResult = await this._authenticateViaState(request, state);
+      if (authenticationResult.failed() && isAccessTokenExpiredError(authenticationResult.error)) {
+        authenticationResult = this._authenticateViaRefreshToken(request, state);
+      }
+    }
+
+    // finally, if authentication still can not be handled for this
+    // request/state combination, redirect to the login page if appropriate
+    if (authenticationResult.notHandled() && canRedirectRequest(request)) {
+      const nextURL = encodeURIComponent(`${this._options.basePath}${request.url.path}`);
+      return AuthenticationResult.redirectTo(
+        `${this._options.basePath}/login?next=${nextURL}`
+      );
+    }
+
+    return authenticationResult;
+  }
+
+  /**
+   * Redirects user to the login page preserving query string parameters.
+   * @param {Hapi.Request} request HapiJS request instance.
+   * @returns {Promise.<DeauthenticationResult>}
+   */
+  async deauthenticate(request) {
+    // Query string may contain the path where logout has been called or
+    // logout reason that login page may need to know.
+    return DeauthenticationResult.redirectTo(
+      `${this._options.basePath}/login${request.url.search}`
+    );
+  }
+
+  /**
+   * Validates whether request contains `Basic ***` Authorization header and just passes it
+   * forward to Elasticsearch backend.
+   * @param {Hapi.Request} request HapiJS request instance.
+   * @returns {Promise.<AuthenticationResult>}
+   * @private
+   */
+  async _authenticateViaHeader(request) {
+    this._options.log(['debug', 'security', 'token'], 'Trying to authenticate via header.');
+
+    const authorization = request.headers.authorization;
+    if (!authorization) {
+      this._options.log(['debug', 'security', 'token'], 'Authorization header is not presented.');
+      return AuthenticationResult.notHandled();
+    }
+
+    const authenticationSchema = authorization.split(/\s+/)[0];
+    if (authenticationSchema.toLowerCase() !== 'basic') {
+      this._options.log(['debug', 'security', 'token'], `Unsupported authentication schema: ${authenticationSchema}`);
+
+      // It's essential that we fail if non-empty, but unsupported authentication schema
+      // is provided to allow authenticator to consult other authentication providers
+      // that may support that schema.
+      return AuthenticationResult.failed(
+        Boom.badRequest(`Unsupported authentication schema: ${authenticationSchema}`)
+      );
+    }
+
+    try {
+      const user = await this._options.client.callWithRequest(request, 'shield.authenticate');
+
+      this._options.log(['debug', 'security', 'token'], 'Request has been authenticated via header.');
+
+      return AuthenticationResult.succeeded(user, { authorization });
+    } catch(err) {
+      this._options.log(['debug', 'security', 'token'], `Failed to authenticate request via header: ${err.message}`);
+      return AuthenticationResult.failed(err);
+    }
+  }
+
+  /**
+   * @param {Hapi.Request} request HapiJS request instance.
+   * @returns {Promise.<AuthenticationResult>}
+   * @private
+   */
+  async _authenticateViaLoginAttempt(request) {
+    this._options.log(['debug', 'security', 'token'], 'Trying to authenticate via login attempt.');
+
+    const credentials = request.loginAttempt.getCredentials();
+    if (!credentials) {
+      this._options.log(['debug', 'security', 'token'], 'Username and password not found in payload.');
+      return AuthenticationResult.notHandled();
+    }
+
+    request.payload = {
+      ...credentials,
+      grant_type: 'password',
+    };
+
+    try {
+      // todo: actual token auth logic
+      const user = await this._options.client.callWithRequest(request, 'shield.token');
+
+      this._options.log(['debug', 'security', 'token'], 'Request has been authenticated via request payload.');
+
+      return AuthenticationResult.succeeded(user);
+    } catch(err) {
+      this._options.log(['debug', 'security', 'token'], `Failed to authenticate request via state: ${err.message}`);
+
+      return AuthenticationResult.failed(err);
+    }
+  }
+
+  /**
+   * Tries to extract authorization header from the state and adds it to the request before
+   * it's forwarded to Elasticsearch backend.
+   * @param {Hapi.Request} request HapiJS request instance.
+   * @param {Object} state State value previously stored by the provider.
+   * @returns {Promise.<AuthenticationResult>}
+   * @private
+   */
+  async _authenticateViaState(request, { accessToken }) {
+    this._options.log(['debug', 'security', 'token'], 'Trying to authenticate via state.');
+
+    if (!accessToken) {
+      this._options.log(['debug', 'security', 'token'], 'Access token is not found in state.');
+      return AuthenticationResult.notHandled();
+    }
+
+    request.headers.authorization = `Bearer ${accessToken}`;
+
+    try {
+      const user = await this._options.client.callWithRequest(request, 'shield.authenticate');
+
+      this._options.log(['debug', 'security', 'token'], 'Request has been authenticated via state.');
+
+      return AuthenticationResult.succeeded(user);
+    } catch(err) {
+      this._options.log(['debug', 'security', 'token'], `Failed to authenticate request via state: ${err.message}`);
+
+      // Reset `Authorization` header we've just set. We know for sure that it hasn't been defined before,
+      // otherwise it would have been used or completely rejected by the `authenticateViaHeader`.
+      // We can't just set `authorization` to `undefined` or `null`, we should remove this property
+      // entirely, otherwise `authorization` header without value will cause `callWithRequest` to crash if
+      // it's called with this request once again down the line (e.g. in the next authentication provider).
+      delete request.headers.authorization;
+
+      return AuthenticationResult.failed(err);
+    }
+  }
+}

x-pack/plugins/security/server/routes/api/v1/authenticate.js

@@ -7,11 +7,25 @@
 import Boom from 'boom';
 import Joi from 'joi';
 import { wrapError } from '../../../lib/errors';
-import { BasicCredentials } from '../../../../server/lib/authentication/providers/basic';
 import { canRedirectRequest } from '../../../lib/can_redirect_request';
 
 export function initAuthenticateApi(server) {
 
+  server.decorate('request', 'loginAttempt', (route, options) => {
+    let credentials;
+    return {
+      getCredentials() {
+        return credentials;
+      },
+      setCredentials(username, password) {
+        if (credentials) {
+          throw new Error('Credentials for login attempt have already been set');
+        }
+        credentials = { username, password };
+      }
+    };
+  });
+
   server.route({
     method: 'POST',
     path: '/api/security/v1/login',
@@ -31,9 +45,8 @@ export function initAuthenticateApi(server) {
       const { username, password } = request.payload;
 
       try {
-        const authenticationResult = await server.plugins.security.authenticate(
-          BasicCredentials.decorateRequest(request, username, password)
-        );
+        request.loginAttempt.setCredentials(username, password);
+        const authenticationResult = await server.plugins.security.authenticate(request);
 
         if (!authenticationResult.succeeded()) {
           throw Boom.unauthorized(authenticationResult.error);