Add OpenID Connect auth provider #36201

jkakavas · 2019-05-07T15:47:17Z

Summary

The OpenID Connect authProvider is the accompanying authProvider for the OpenID Connect authentication realm in Elasticsearch. This is very similar to the saml authProvider in most ways with three noticeable differences:

We require explicit configuration regarding the Elasticsearch realm name instead of trying to build an environment aware string (like ACS URL in saml) and pass that to Elasticsearch for it to resolve the realm.
We do not support multiple values for the realm specific nonces (state and nonce) as we do with requestId in the SAML realm. Instead if an existing value ( for state and nonce) is present in the user's session, we pass that to Elasticsearch to be reused. The end goal is the same, allow a better UX for users attempting many requests over different tabs in the same browser context.
IDP initiated SSO ( Third Party initiated authentication in OIDC-speak ) is implemented but starts as an unsolicited request to initiate the handshake, instead of an unsolicited request with an authentication response (which is not supported here)

This change also adds a fake plugin named oidc_provider to be used in integration tests for mocking calls to the token and userinfo endpoint of an OpenID Connect Provider

Missing:

Documentation

Limitations

This does not support the OpenID Connect Implicit flow as that depends on fragment handling/processing as described for instance in the spec

Co-Authored-By: Brandon Kobel kobelb@elastic.co

"Release Note: Added support for authenticating using OpenID Connect"

Contrary to what happens in the SAML realm, we do not support consuming unsolicited Responses from OpenID Connect Providers. This means that the only way that a behavior such as the one described in elastic#33644 can be observed is when - a user initiates a login in a tab but stalls in the OP authentication form - user opens a new tab in the same browser and completes authentication - user returns to original tab, submits the OP form and lands in Kibana's oidc endpoint while actually already having a session. Not sure if this is a corner case we need to cater for, so removing this for now.

- Add a fake plugin, used to mock the token endpoint and userinfo endpoint of an OpenID Connect Provider - Add various integration tests for the OIDC auth provider

elasticmachine · 2019-05-07T15:47:20Z

Pinging @elastic/kibana-security

elasticmachine · 2019-05-07T16:32:07Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

elasticmachine · 2019-05-08T07:14:52Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

azasypkin · 2019-05-08T07:27:39Z

Looks like you need to run node scripts/eslint --fix to automatically fix all linter issues.

elasticmachine · 2019-05-08T08:20:17Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

azasypkin · 2019-05-08T08:25:54Z

09:51:48 plugins/security/server/lib/authentication/providers/oidc.ts:8:24 - error TS2307: Cannot find module '../../../../../../../kibana'.
09:51:48 8 import { Legacy } from '../../../../../../../kibana';

Relative paths from x-pack to OSS aren't yet supported in the prod build, so you'd need to use kibana alias instead: import { Legacy } from 'kibana';

elasticmachine · 2019-05-08T11:32:10Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

elasticmachine · 2019-05-08T12:43:17Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

elasticmachine · 2019-05-08T14:54:03Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

azasypkin · 2019-05-08T16:34:46Z

ACK: will take a look tomorrow, I'll skip integration tests for now, but will review them as soon as we solve this nasty CI & server.xsrf.whitelist weirdness.

jkakavas · 2019-05-18T23:09:24Z

This fails because

00:29:18 plugins/security/server/lib/authentication/authenticator.ts:34:3 - error TS2345: Argument of type '([string, typeof BasicAuthenticationProvider] | [string, typeof SAMLAuthenticationProvider] | [string, typeof TokenAuthenticationProvider] | [string, typeof OIDCAuthenticationProvider])[]' is not assignable to parameter of type 'ReadonlyArray<[string, new (options: AuthenticationProviderOptions) => BaseAuthenticationProvider<AuthenticationProviderOptions>]>'.
00:29:18   Type '[string, typeof BasicAuthenticationProvider] | [string, typeof SAMLAuthenticationProvider] | [string, typeof TokenAuthenticationProvider] | [string, typeof OIDCAuthenticationProvider]' is not assignable to type '[string, new (options: AuthenticationProviderOptions) => BaseAuthenticationProvider<AuthenticationProviderOptions>]'.
00:29:18     Type '[string, typeof OIDCAuthenticationProvider]' is not assignable to type '[string, new (options: AuthenticationProviderOptions) => BaseAuthenticationProvider<AuthenticationProviderOptions>]'.
00:29:18       Type 'typeof OIDCAuthenticationProvider' is not assignable to type 'new (options: AuthenticationProviderOptions) => BaseAuthenticationProvider<AuthenticationProviderOptions>'.
00:29:18         Types of parameters 'options' and 'options' are incompatible.
00:29:18           Property 'realm' is missing in type 'AuthenticationProviderOptions' but required in type 'OIDCProviderOptions'.
00:29:18 
00:29:18  34 >([
00:29:18       ~
00:29:18  35   ['basic', BasicAuthenticationProvider],
00:29:18     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
00:29:18 ... 
00:29:18  38   ['oidc', OIDCAuthenticationProvider],
00:29:18     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
00:29:18  39 ]);
00:29:18     ~
00:29:18 
00:29:18   plugins/security/server/lib/authentication/providers/oidc.ts:71:3
00:29:18     71   realm: string;
00:29:18          ~~~~~
00:29:18     'realm' is declared here.
00:29:18 
00:29:18 
00:29:18 Found 1 error.

if I make the realm parameter optional in the authProvider , i.e.

/**
 * Defines the realm specific properties
 */
interface OIDCProviderOptions extends AuthenticationProviderOptions {
  realm?: string;
}

then calling something like

return this.initiateOIDCAuthentication(request, { realm: this.options.realm });

also fails as this.options.realm can be string or undefined.

Any suggestions on what is the proper way to handle this @azasypkin ?

azasypkin · 2019-05-19T16:38:36Z

Hey @jkakavas!

I'll be off next week and won't be able to do the second review pass till May 27th. If it can't wait till then, please, feel free to forward review request to someone else on @elastic/kibana-security team.

jkakavas · 2019-05-19T16:46:05Z

Understood @azasypkin , I hope Brandon or Larry can lend a pair of eyes over the next few days !

kobelb · 2019-05-20T14:44:51Z

@jkakavas I'll take a look a bit later today.

kobelb · 2019-05-20T16:48:29Z

@kobelb do you remember why we made LoginAttempt tightly coupled to basic/token auth provider (depends on username and password)? I thought we could use it for SAML or OIDC login attempts as well to not rely just on query string or payload parameter names.

Based on #25431 (comment), this is something that you recommended initially but we held off on doing so because we wanted to see if this was a commonality between all SSO providers.

Use provider specific settings

elasticmachine · 2019-05-21T17:04:21Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

The OpenID Connect authProvider is the accompanying authProvider for the OpenID Connect authentication realm in Elasticsearch. This is very similar to the saml authProvider in most ways with three noticeable differences: - We require explicit configuration regarding the Elasticsearch realm name instead of trying to build an environment aware string (like ACS URL in saml) and pass that to Elasticsearch for it to resolve the realm. - We do not support multiple values for the realm specific nonces (state and nonce) as we do with requestId in the SAML realm. Instead if an existing value ( for state and nonce) is present in the user's session, we pass that to Elasticsearch to be reused. The end goal is the same, allow a better UX for users attempting many requests over different tabs in the same browser context. - IDP initiated SSO ( Third Party initiated authentication in OIDC-speak ) is implemented but starts as an unsolicited request to initiate the handshake, instead of an unsolicited request with an authentication response (which is not supported here) This change also adds a fake plugin named oidc_provider to be used in integration tests for mocking calls to the token and userinfo endpoint of an OpenID Connect Provider This does not support the OpenID Connect Implicit flow as that depends on fragment handling/processing as described for instance in the spec Co-Authored-By: Brandon Kobel <kobelb@elastic.co>

elasticmachine · 2019-05-21T19:41:35Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

The OpenID Connect authProvider is the accompanying authProvider for the OpenID Connect authentication realm in Elasticsearch. This is very similar to the saml authProvider in most ways with three noticeable differences: - We require explicit configuration regarding the Elasticsearch realm name instead of trying to build an environment aware string (like ACS URL in saml) and pass that to Elasticsearch for it to resolve the realm. - We do not support multiple values for the realm specific nonces (state and nonce) as we do with requestId in the SAML realm. Instead if an existing value ( for state and nonce) is present in the user's session, we pass that to Elasticsearch to be reused. The end goal is the same, allow a better UX for users attempting many requests over different tabs in the same browser context. - IDP initiated SSO ( Third Party initiated authentication in OIDC-speak ) is implemented but starts as an unsolicited request to initiate the handshake, instead of an unsolicited request with an authentication response (which is not supported here) This change also adds a fake plugin named oidc_provider to be used in integration tests for mocking calls to the token and userinfo endpoint of an OpenID Connect Provider This does not support the OpenID Connect Implicit flow as that depends on fragment handling/processing as described for instance in the spec Co-Authored-By: Brandon Kobel <kobelb@elastic.co>

jkakavas added 8 commits May 7, 2019 18:22

Add OpenID Connect auth provider and unit tests

30e28c9

Address feedback

bc44f5a

add a subset of api integration tests

a8493ec

Convert provider to typescript

82d8e0d

Fix tests

b12f0da

fix tests

d3a36e1

Add OpenID Connect integration tests

eac2720

- Add a fake plugin, used to mock the token endpoint and userinfo endpoint of an OpenID Connect Provider - Add various integration tests for the OIDC auth provider

jkakavas added review Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! labels May 7, 2019

jkakavas requested review from kobelb and azasypkin May 7, 2019 15:47

jkakavas requested a review from a team as a code owner May 7, 2019 15:47

jkakavas mentioned this pull request May 7, 2019

Add OpenID Connect auth provider #29943

Closed

7 tasks

Fix behavior for 3rd party initiated logins

ee62c3c

lint fixes

ba05360

fix import

ee8b25b

debug CI xsrf params

c6c6d32

Fix properties and reenable CI jobs

7d07bd5

Merge remote-tracking branch 'origin/master' into oidc-auth-provider2

dbbf430

jkakavas requested a review from legrego May 20, 2019 15:06

kobelb and others added 10 commits May 20, 2019 11:35

Making ProviderSpecificOptions a separate argument

91be8e1

Removing provider specific options from base mock

a1c828e

Adding .default so authc and oidc are always objects

881baf7

Making oidc realm required when using oidc auth provider

ea41784

Working around limitation of config.has and Joi's alternatives

ef7b9d7

Revising comment, no longer merged

629198f

Removing generic parameter we aren't using anymore

e9ea111

No longer using a default for authc

0ed1955

Merge pull request #1 from kobelb/oidc-auth-provider2

ca0e89b

Use provider specific settings

Merge remote-tracking branch 'origin/master' into oidc-auth-provider2

9c90e8a

kobelb approved these changes May 21, 2019

View reviewed changes

jkakavas merged commit e569fba into elastic:master May 21, 2019

legrego mentioned this pull request May 21, 2019

[7.x] Add OpenID Connect auth provider (#36201) #36807

Closed

legrego added release_note:enhancement v7.2.0 v8.0.0 and removed review labels May 21, 2019

kobelb mentioned this pull request May 21, 2019

[7.x] Add OpenID Connect auth provider (#36201) #36838

Merged

legrego mentioned this pull request Jun 8, 2020

OAuth Realm #18189

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OpenID Connect auth provider #36201

Add OpenID Connect auth provider #36201

jkakavas commented May 7, 2019 •

edited by kobelb

Loading

elasticmachine commented May 7, 2019

elasticmachine commented May 7, 2019

elasticmachine commented May 8, 2019

azasypkin commented May 8, 2019

elasticmachine commented May 8, 2019

azasypkin commented May 8, 2019

elasticmachine commented May 8, 2019

elasticmachine commented May 8, 2019

elasticmachine commented May 8, 2019

azasypkin commented May 8, 2019

jkakavas commented May 18, 2019

azasypkin commented May 19, 2019

jkakavas commented May 19, 2019

kobelb commented May 20, 2019

kobelb commented May 20, 2019

elasticmachine commented May 21, 2019

elasticmachine commented May 21, 2019

Add OpenID Connect auth provider #36201

Add OpenID Connect auth provider #36201

Conversation

jkakavas commented May 7, 2019 • edited by kobelb Loading

Summary

Limitations

elasticmachine commented May 7, 2019

elasticmachine commented May 7, 2019

💔 Build Failed

elasticmachine commented May 8, 2019

💔 Build Failed

azasypkin commented May 8, 2019

elasticmachine commented May 8, 2019

💔 Build Failed

azasypkin commented May 8, 2019

elasticmachine commented May 8, 2019

💔 Build Failed

elasticmachine commented May 8, 2019

💔 Build Failed

elasticmachine commented May 8, 2019

💔 Build Failed

azasypkin commented May 8, 2019

jkakavas commented May 18, 2019

azasypkin commented May 19, 2019

jkakavas commented May 19, 2019

kobelb commented May 20, 2019

kobelb commented May 20, 2019

elasticmachine commented May 21, 2019

💚 Build Succeeded

elasticmachine commented May 21, 2019

💚 Build Succeeded

jkakavas commented May 7, 2019 •

edited by kobelb

Loading