server: require web login if an env var is set #25057

vilterp · 2018-04-24T20:14:43Z

This PR introduces the temporary environment variable COCKROACH_EXPERIMENTAL_REQUIRE_WEB_LOGIN to enable testing login functionality before a fully functional login/logout UI is merged. Supersedes #24944, which hardcoded this.

Once we have a functional login/logout UI, we will probably hardcode this variable to true, so that login will always be required when the cluster is in secure mode.

Before this change:

Admin server endpoints don't care whether there is a logged-in user or not, even in secure mode; they always run as the root user (server: Run API requests as authenticated user #8767)
There is no way to log in — the /_auth/v1/login endpoint 404s

After this change:

secure mode
- with env var COCKROACH_EXPERIMENTAL_REQUIRE_WEB_LOGIN=true:
  - Admin server endpoints require some user to be logged in, although they still run queries (e.g. against crdb_internal) as the root user.
  - /_auth/v1/login is exposed, allowing clients such as the admin UI to log in.
- else:
  - no auth (same as before)
insecure mode
- no auth (same as before)

cockroach-teamcity · 2018-04-24T20:14:48Z

This change is

mrtracy

One thing to consider: there is an interaction with the "insecure" flag which is called out in the RFC for web session logins. Once login is released, it will be on by default for secure servers, but disabled for insecure servers. This is important because, in turn, it allows our frontend to detect whether or not authentication is enabled simply by checking the protocol (HTTP vs HTTPS). Otherwise, you need an additional mechanism to communicate this setting to the frontend so that it knows whether or not to require a login.

In other words: I think the system for enabling/disabling login is more complicated than is expressed here, i'm not sure we should be checking anything in until its fully considered.

mrtracy · 2018-04-24T20:26:56Z

pkg/server/config.go

@@ -386,7 +386,7 @@ func MakeConfig(ctx context.Context, st *cluster.Settings) Config {
 		ScanInterval:                   defaultScanInterval,
 		ScanMaxIdleTime:                defaultScanMaxIdleTime,
 		EventLogEnabled:                defaultEventLogEnabled,
-		EnableWebSessionAuthentication: defaultEnableWebSessionAuthentication,
+		EnableWebSessionAuthentication: envutil.EnvOrDefaultBool("COCKROACH_REQUIRE_WEB_LOGIN", false),


Move this to a top-level var and reference it here.

vilterp · 2018-04-24T20:45:46Z

@mrtracy the env var only applies if we're in secure mode. Just updated the description to reflect that.

It's true that this is just to avoid myself, @couchand, and anyone else who is trying to test login having to twiddle a hardcoded boolean over the next couple months, so we can do that if necessary.

mrtracy · 2018-04-25T04:55:21Z

LGTM

couchand

As I mentioned to you yesterday, I'm not sure this is worth it. It's doesn't seem to make things that much easier for us, and there's a risk involved.

Changing a line of code screams "this really isn't done yet". Adding an env var (even one with EXPERIMENTAL in the name) seems like maybe it's okay to do.

couchand · 2018-04-25T15:28:29Z

pkg/server/config.go

@@ -376,6 +375,8 @@ func MakeConfig(ctx context.Context, st *cluster.Settings) Config {
 		panic(err)
 	}

+	requireWebLogin := envutil.EnvOrDefaultBool("COCKROACH_REQUIRE_WEB_LOGIN", false)


If this is added it should definitely have EXPERIMENTAL in the name.

Release note (admin ui change): require web login if the environment variable COCKROACH_REQUIRE_WEB_LOGIN is set to true.

vilterp · 2018-04-25T22:23:18Z

Changed to COCKROACH_EXPERIMENTAL_REQUIRE_WEB_LOGIN.

bors r+

craig · 2018-04-25T22:44:38Z

Build failed

GitHub CI (Cockroach)

vilterp · 2018-04-26T01:12:11Z

bors r+

25057: server: require web login if an env var is set r=vilterp a=vilterp This PR introduces the temporary environment variable `COCKROACH_REQUIRE_LOGIN` to enable testing login functionality before a fully functional login/logout UI is merged. Supersedes #24944, which hardcoded this. Once we have a functional login/logout UI, we will probably hardcode this variable to true, so that login will always be required when the cluster is in secure mode. Before this change: - Admin server endpoints don't care whether there is a logged-in user or not, even in secure mode; they always run as the root user (#8767) - There is no way to log in — the `/_auth/v1/login` endpoint 404s After this change: - secure mode - with env var `COCKROACH_REQUIRE_LOGIN=true`: - Admin server endpoints require _some user_ to be logged in, although they still run queries (e.g. against `crdb_internal`) as the root user. - `/_auth/v1/login` is exposed, allowing clients such as the admin UI to log in. - else: - no auth (same as before) - insecure mode - no auth (same as before) Co-authored-by: Pete Vilter <[email protected]>

craig · 2018-04-26T01:32:41Z

Build succeeded

GitHub CI (Cockroach)

25005: ui: add top-level LoginContainer: require login before rendering anything r=couchand a=vilterp Depends on #25057 Touches #24939 ![](https://user-images.githubusercontent.com/7341/39150096-38b4cd28-470f-11e8-9d67-e1832d35a211.gif) Shown above: 1. go to admin UI; see login screen 2. error message when you type in the wrong password 3. you can't hit an authenticated endpoint because you don't have a valid session (this checking is turned on by #24944, only in secure mode) 4. once you login with the right password, you can see the UI (the temporary "connection lost" banner shouldn't be there) 5. now you (and the UI itself) can hit endpoints, because you have a valid session Todos: - [ ] redirect to login page instead of current wrapper component switching thing - [ ] logout - [ ] logout button (make API call; redirect to login & blow away redux store) - [ ] log out other tabs (if they get a 403, redirect to login & blow away redux store) - [ ] styling Release note: None 25628: distsql: support lookup join on secondary index r=solongordon a=solongordon joinReader now supports lookup joins on secondary indexes. This was a trivial change for queries where all the output columns are included in the secondary index. I just modified the physical planner to specify the secondary index in the JoinReaderSpec and removed checks which prevented secondary indexes from being used. The more complicated situation is when we want to do a lookup join against a non-covering index. In this case, the logical planner plans an index join before the inner join, but we want to perform the lookup join first. We now handle this by only planning the lookup join during physical planning, not the index join. During execution, the joinReader detects that there are output columns not covered by the secondary index, and it performs primary index lookups as necessary to retrieve the additional columns. Fixes #25431 Co-authored-by: Pete Vilter <[email protected]> Co-authored-by: Andrew Couch <[email protected]> Co-authored-by: Solon Gordon <[email protected]>

vilterp requested review from couchand, mrtracy and a team April 24, 2018 20:14

vilterp mentioned this pull request Apr 24, 2018

[DNM] server: require web login by default in secure mode #24944

Closed

vilterp force-pushed the require-login-env-var branch from d7eca5c to 7541d77 Compare April 24, 2018 20:28

mrtracy reviewed Apr 24, 2018

View reviewed changes

vilterp force-pushed the require-login-env-var branch from 7541d77 to c8e0305 Compare April 24, 2018 20:48

vilterp mentioned this pull request Apr 24, 2018

ui: add top-level LoginContainer: require login before rendering anything #25005

Merged

5 tasks

couchand reviewed Apr 25, 2018

View reviewed changes

server: require web login if an env var is set

a35b8d3

Release note (admin ui change): require web login if the environment variable COCKROACH_REQUIRE_WEB_LOGIN is set to true.

vilterp force-pushed the require-login-env-var branch from c8e0305 to a35b8d3 Compare April 25, 2018 22:22

vilterp requested a review from a team April 25, 2018 22:22

craig bot merged commit a35b8d3 into cockroachdb:master Apr 26, 2018

vilterp deleted the require-login-env-var branch April 26, 2018 01:57

couchand mentioned this pull request May 15, 2018

Web UI Authn & Authz (Tracking Issue) #25529

Closed

Amruta-Ranade mentioned this pull request May 17, 2018

User authentication in the Admin UI cockroachdb/docs#1582

Closed

vilterp mentioned this pull request May 31, 2018

Release notes for v2.1.0-alpha.20180604 cockroachdb/docs#3201

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

server: require web login if an env var is set #25057

server: require web login if an env var is set #25057

vilterp commented Apr 24, 2018 •

edited

Loading

cockroach-teamcity commented Apr 24, 2018

mrtracy left a comment

mrtracy Apr 24, 2018

vilterp Apr 24, 2018

vilterp commented Apr 24, 2018

mrtracy commented Apr 25, 2018

couchand left a comment

couchand Apr 25, 2018

vilterp commented Apr 25, 2018

craig bot commented Apr 25, 2018

vilterp commented Apr 26, 2018

craig bot commented Apr 26, 2018

server: require web login if an env var is set #25057

server: require web login if an env var is set #25057

Conversation

vilterp commented Apr 24, 2018 • edited Loading

cockroach-teamcity commented Apr 24, 2018

mrtracy left a comment

Choose a reason for hiding this comment

mrtracy Apr 24, 2018

Choose a reason for hiding this comment

vilterp Apr 24, 2018

Choose a reason for hiding this comment

vilterp commented Apr 24, 2018

mrtracy commented Apr 25, 2018

couchand left a comment

Choose a reason for hiding this comment

couchand Apr 25, 2018

Choose a reason for hiding this comment

vilterp commented Apr 25, 2018

craig bot commented Apr 25, 2018

Build failed

vilterp commented Apr 26, 2018

craig bot commented Apr 26, 2018

Build succeeded

vilterp commented Apr 24, 2018 •

edited

Loading