Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XPack: active_directory ssl.truststore.password (docs vs code) #41663

Closed
chriswhite199 opened this issue Apr 30, 2019 · 1 comment · Fixed by #42336
Closed

XPack: active_directory ssl.truststore.password (docs vs code) #41663

chriswhite199 opened this issue Apr 30, 2019 · 1 comment · Fixed by #42336
Assignees
@tvernum
Labels
>bug :Security/Security Security issues without another label

Comments

@chriswhite199
Copy link

Bug Report:

Elasticsearch version 7.0.0
Plugins installed: []
JVM version (java -version):
OS version (uname -a if on a Unix-like system):
Description of the problem including expected versus actual behavior:

The docs note that to use a truststore paired with active_directory authentication realm, you should use the configuration suffix ssl.truststore.password, but this errors with unknown setting [xpack.security.authc.realms.active_directory.myrealm.ssl.truststore.password]

Instead, inspection of the code, and testing, shows that the property looked for is truststore.password, as can be seen at https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/SSLConfigurationSettings.java#L119:

public static final Function<String, Setting.AffixSetting<SecureString>> LEGACY_TRUST_STORE_PASSWORD_REALM = realmType ->
            Setting.affixKeySetting("xpack.security.authc.realms." + realmType + ".", "truststore.password",
                    LEGACY_TRUSTSTORE_PASSWORD_TEMPLATE);

The corresponding ssl.truststore.path can be seen to use the ssl prefix in the code (line 107):

public static final Function<String, Setting.AffixSetting<Optional<String>>> TRUST_STORE_PATH_REALM = realmType ->
            Setting.affixKeySetting("xpack.security.authc.realms." + realmType + ".", "ssl.truststore.path", TRUST_STORE_PATH_TEMPLATE);

Steps to reproduce:

  1. Configure an active_directory realm with a truststore + password, as detailed using the documentation properties
xpack.security.authc.realms.active_directory.myrealm:
  ssl:
    verification_mode: full
    truststore:
      path: certs/cacerts.jks
      password: changeit
  1. Where as currently, 7.0.0 requires this setup instead (contradictory to the docs), but then there is an error loading the keystore (password verification failed), which i can only assume is because the password is not being picked up - manual keytool verification works)
xpack.security.authc.realms.active_directory.myrealm:
  ssl:
    verification_mode: full
    truststore:
      path: certs/cacerts.jks
  truststore:
    password: changeit
@colings86 colings86 added the :Security/Security Security issues without another label label Apr 30, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@tvernum tvernum self-assigned this May 22, 2019
@tvernum tvernum added the >bug label May 22, 2019
tvernum added a commit to tvernum/elasticsearch that referenced this issue May 22, 2019
@tvernum
Fix settings prefix for realm truststore password
3d7e7b3 
As part of elastic#30241 realm settings were changed to be true affix
settings. In the process of this change, the "ssl." prefix was lost
from the realm truststore password. It should be:

    xpack.security.authc.realms.<type>.<name>.ssl.truststore.password

Due to a mismatch between the way we define SSL settings and  load SSL
contexts, there was no way to define this legacy password setting in a
realm config.

The settings validation would reject "ssl.truststore.password" but the
SSL service would ignore "truststore.password"

Resolves: elastic#41663
@tvernum tvernum mentioned this issue May 22, 2019
Merged
tvernum added a commit that referenced this issue May 22, 2019
@tvernum
Fix settings prefix for realm truststore password (#42336)
dcf2929 
As part of #30241 realm settings were changed to be true affix
settings. In the process of this change, the "ssl." prefix was lost
from the realm truststore password. It should be:

    xpack.security.authc.realms.<type>.<name>.ssl.truststore.password

Due to a mismatch between the way we define SSL settings and  load SSL
contexts, there was no way to define this legacy password setting in a
realm config.

The settings validation would reject "ssl.truststore.password" but the
SSL service would ignore "truststore.password"

Resolves: #41663
tvernum added a commit to tvernum/elasticsearch that referenced this issue May 23, 2019
@tvernum
Fix settings prefix for realm truststore password
de767d4 
As part of elastic#30241 realm settings were changed to be true affix
settings. In the process of this change, the "ssl." prefix was lost
from the realm truststore password. It should be:

    xpack.security.authc.realms.<type>.<name>.ssl.truststore.password

Due to a mismatch between the way we define SSL settings and  load SSL
contexts, there was no way to define this legacy password setting in a
realm config.

The settings validation would reject "ssl.truststore.password" but the
SSL service would ignore "truststore.password"

Resolves: elastic#41663

Backport of: elastic#42336
tvernum added a commit to tvernum/elasticsearch that referenced this issue May 23, 2019
@tvernum
Fix settings prefix for realm truststore password
290f0da 
As part of elastic#30241 realm settings were changed to be true affix
settings. In the process of this change, the "ssl." prefix was lost
from the realm truststore password. It should be:

    xpack.security.authc.realms.<type>.<name>.ssl.truststore.password

Due to a mismatch between the way we define SSL settings and  load SSL
contexts, there was no way to define this legacy password setting in a
realm config.

The settings validation would reject "ssl.truststore.password" but the
SSL service would ignore "truststore.password"

Resolves: elastic#41663

Backport of: elastic#42336
@tvernum tvernum mentioned this issue May 23, 2019
Merged
gurkankaymak pushed a commit to gurkankaymak/elasticsearch that referenced this issue May 27, 2019
@tvernum
Fix settings prefix for realm truststore password (elastic#42336)
a971602 
As part of elastic#30241 realm settings were changed to be true affix
settings. In the process of this change, the "ssl." prefix was lost
from the realm truststore password. It should be:

    xpack.security.authc.realms.<type>.<name>.ssl.truststore.password

Due to a mismatch between the way we define SSL settings and  load SSL
contexts, there was no way to define this legacy password setting in a
realm config.

The settings validation would reject "ssl.truststore.password" but the
SSL service would ignore "truststore.password"

Resolves: elastic#41663
@codebrain codebrain mentioned this issue Aug 5, 2019
Closed
37 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tvernum tvernum

Labels
>bug :Security/Security Security issues without another label
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix settings prefix for realm truststore password tvernum/elasticsearch
4 participants
@colings86 @chriswhite199 @tvernum @elasticmachine