Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Audit security APIs for public/internal access #189833

Closed
45 tasks done
legrego opened this issue Aug 2, 2024 · 1 comment
Closed
45 tasks done

Audit security APIs for public/internal access #189833

legrego opened this issue Aug 2, 2024 · 1 comment
Assignees
@jeramysoucy
Labels
blocker chore Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v9.0.0

Comments

@legrego
Copy link
Member

legrego commented Aug 2, 2024 •
edited by jeramysoucy
Loading

This is a subset of #186781, focused on the APIs owned by @elastic/kibana-security.

Access to internal APIs is restricted in Serverless. With v9, we have an opportunity to make the breaking change in ESS and on-prem and restrict internal APIs by default.

What this means to users & stack components:
Access to internal APIs is blocked by default. Access to public APIs remains.

Call to Action:

What this means to Kibana and solution devs:

  • As of 8.9, all Kibana APIs default to internal. All teams must ensure that their public routes have the access route configuration option explicitly set to "public".
  • Integrations consuming internal Kibana APIs must migrate to public counterparts.

Confirm correct access:
Historically, Kibana only used a naming convention to distinguish between internal (/internal) and public (/api) routes. This distinction no longer applies.

Teams should confirm that their APIs have the intended access configuration, especially in cases where:

  • path: "/api/foo...", access: internal
  • path: "/internal/bar..." and access: public

Logging config:

logging:
  appenders:
    file:
      type: file
      fileName: /<full_path_to_file>/route_access.log
      layout:
        type: json
  loggers:
    - name: http.server.Kibana.options
      level: debug
      appenders: [file] <--- recommended

Public routes prefixed with /internal/:

@elastic/kibana-security

  • "access [public] [GET] for path [/internal/security/reset_session_page.js]", (registered with httpResources - undocumented public endpoint)
  • "access [public] [GET] for path [/internal/security/capture-url]", (registered with httpResources - undocumented public endpoint)

Internal routes prefixed by /api/:

Routes that should be excluded from OAS:
@legrego legrego added blocker chore Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v9.0.0 labels Aug 2, 2024
@jeramysoucy jeramysoucy self-assigned this Oct 2, 2024
@jeramysoucy jeramysoucy mentioned this issue Oct 14, 2024
Merged
@jeramysoucy
Copy link
Contributor

See "Security HTTP APIs - Access Audit" Google spreadsheet

jeramysoucy added a commit that referenced this issue Oct 16, 2024
@jeramysoucy
Sets explicit access for public platform security endpoints (#195099)
8d77cd4 
Related issue: #189833

## Summary

This PR explicitly sets the access level for platform security HTTP API
endpoints. This is to address restriction of internal endpoints in v9.
For details, see #189833.

Additionally, this PR sets the `excludeFromOAS` option where applicable,
in order to refrain from generating documentation for endpoints which
are public but should either remain undocumented, or should be
documented as part of a specific topic (e.g. external authentication
flow).

Note: the invalidate sessions API has been changed to internal in
serverless

Endpoints excluded from OAS:
- GET /api/security/logout
- GET /api/security/v1/logout
- /api/security/oidc/implicit
- /api/security/v1/oidc/implicit
- /internal/security/oidc/implicit.js
- GET /api/security/oidc/callback
- GET /api/security/v1/oidc
- POST /api/security/oidc/initiate_login
- POST /api/security/v1/oidc
- GET /api/security/oidc/initiate_login
- POST /api/security/saml/callback
- /internal/security/reset_session_page.js
- /security/access_agreement
- /security/account
- /internal/security/capture-url
- /security/logged_out
- /login
- /logout
- /security/overwritten_session
- /spaces/space_selector
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Oct 16, 2024
@jeramysoucy
Sets explicit access for public platform security endpoints (elastic#…
8299082 
…195099)

Related issue: elastic#189833

## Summary

This PR explicitly sets the access level for platform security HTTP API
endpoints. This is to address restriction of internal endpoints in v9.
For details, see elastic#189833.

Additionally, this PR sets the `excludeFromOAS` option where applicable,
in order to refrain from generating documentation for endpoints which
are public but should either remain undocumented, or should be
documented as part of a specific topic (e.g. external authentication
flow).

Note: the invalidate sessions API has been changed to internal in
serverless

Endpoints excluded from OAS:
- GET /api/security/logout
- GET /api/security/v1/logout
- /api/security/oidc/implicit
- /api/security/v1/oidc/implicit
- /internal/security/oidc/implicit.js
- GET /api/security/oidc/callback
- GET /api/security/v1/oidc
- POST /api/security/oidc/initiate_login
- POST /api/security/v1/oidc
- GET /api/security/oidc/initiate_login
- POST /api/security/saml/callback
- /internal/security/reset_session_page.js
- /security/access_agreement
- /security/account
- /internal/security/capture-url
- /security/logged_out
- /login
- /logout
- /security/overwritten_session
- /spaces/space_selector

(cherry picked from commit 8d77cd4)
kibanamachine added a commit that referenced this issue Oct 16, 2024
@kibanamachine @jeramysoucy
[8.x] Sets explicit access for public platform security endpoints (#1…
44eb0ca 
…95099) (#196547)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Sets explicit access for public platform security endpoints
(#195099)](#195099)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Jeramy
Soucy","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-16T13:11:25Z","message":"Sets
explicit access for public platform security endpoints
(#195099)\n\nRelated issue: #189833\r\n\r\n## Summary\r\n\r\nThis PR
explicitly sets the access level for platform security HTTP
API\r\nendpoints. This is to address restriction of internal endpoints
in v9.\r\nFor details, see
https://github.com/elastic/kibana/issues/189833.\r\n\r\nAdditionally,
this PR sets the `excludeFromOAS` option where applicable,\r\nin order
to refrain from generating documentation for endpoints which\r\nare
public but should either remain undocumented, or should be\r\ndocumented
as part of a specific topic (e.g. external
authentication\r\nflow).\r\n\r\nNote: the invalidate sessions API has
been changed to internal in\r\nserverless\r\n\r\nEndpoints excluded from
OAS:\r\n- GET /api/security/logout\r\n- GET /api/security/v1/logout\r\n-
/api/security/oidc/implicit\r\n- /api/security/v1/oidc/implicit\r\n-
/internal/security/oidc/implicit.js\r\n- GET
/api/security/oidc/callback\r\n- GET /api/security/v1/oidc\r\n- POST
/api/security/oidc/initiate_login\r\n- POST /api/security/v1/oidc\r\n-
GET /api/security/oidc/initiate_login\r\n- POST
/api/security/saml/callback\r\n-
/internal/security/reset_session_page.js\r\n-
/security/access_agreement\r\n- /security/account\r\n-
/internal/security/capture-url\r\n- /security/logged_out\r\n-
/login\r\n- /logout\r\n- /security/overwritten_session\r\n-
/spaces/space_selector","sha":"8d77cd49996281e746a0a7138c7624867c047053","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Security","release_note:skip","v9.0.0","backport:prev-minor"],"title":"Sets
explicit access for public platform security
endpoints","number":195099,"url":"https://github.com/elastic/kibana/pull/195099","mergeCommit":{"message":"Sets
explicit access for public platform security endpoints
(#195099)\n\nRelated issue: #189833\r\n\r\n## Summary\r\n\r\nThis PR
explicitly sets the access level for platform security HTTP
API\r\nendpoints. This is to address restriction of internal endpoints
in v9.\r\nFor details, see
https://github.com/elastic/kibana/issues/189833.\r\n\r\nAdditionally,
this PR sets the `excludeFromOAS` option where applicable,\r\nin order
to refrain from generating documentation for endpoints which\r\nare
public but should either remain undocumented, or should be\r\ndocumented
as part of a specific topic (e.g. external
authentication\r\nflow).\r\n\r\nNote: the invalidate sessions API has
been changed to internal in\r\nserverless\r\n\r\nEndpoints excluded from
OAS:\r\n- GET /api/security/logout\r\n- GET /api/security/v1/logout\r\n-
/api/security/oidc/implicit\r\n- /api/security/v1/oidc/implicit\r\n-
/internal/security/oidc/implicit.js\r\n- GET
/api/security/oidc/callback\r\n- GET /api/security/v1/oidc\r\n- POST
/api/security/oidc/initiate_login\r\n- POST /api/security/v1/oidc\r\n-
GET /api/security/oidc/initiate_login\r\n- POST
/api/security/saml/callback\r\n-
/internal/security/reset_session_page.js\r\n-
/security/access_agreement\r\n- /security/account\r\n-
/internal/security/capture-url\r\n- /security/logged_out\r\n-
/login\r\n- /logout\r\n- /security/overwritten_session\r\n-
/spaces/space_selector","sha":"8d77cd49996281e746a0a7138c7624867c047053"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195099","number":195099,"mergeCommit":{"message":"Sets
explicit access for public platform security endpoints
(#195099)\n\nRelated issue: #189833\r\n\r\n## Summary\r\n\r\nThis PR
explicitly sets the access level for platform security HTTP
API\r\nendpoints. This is to address restriction of internal endpoints
in v9.\r\nFor details, see
https://github.com/elastic/kibana/issues/189833.\r\n\r\nAdditionally,
this PR sets the `excludeFromOAS` option where applicable,\r\nin order
to refrain from generating documentation for endpoints which\r\nare
public but should either remain undocumented, or should be\r\ndocumented
as part of a specific topic (e.g. external
authentication\r\nflow).\r\n\r\nNote: the invalidate sessions API has
been changed to internal in\r\nserverless\r\n\r\nEndpoints excluded from
OAS:\r\n- GET /api/security/logout\r\n- GET /api/security/v1/logout\r\n-
/api/security/oidc/implicit\r\n- /api/security/v1/oidc/implicit\r\n-
/internal/security/oidc/implicit.js\r\n- GET
/api/security/oidc/callback\r\n- GET /api/security/v1/oidc\r\n- POST
/api/security/oidc/initiate_login\r\n- POST /api/security/v1/oidc\r\n-
GET /api/security/oidc/initiate_login\r\n- POST
/api/security/saml/callback\r\n-
/internal/security/reset_session_page.js\r\n-
/security/access_agreement\r\n- /security/account\r\n-
/internal/security/capture-url\r\n- /security/logged_out\r\n-
/login\r\n- /logout\r\n- /security/overwritten_session\r\n-
/spaces/space_selector","sha":"8d77cd49996281e746a0a7138c7624867c047053"}}]}]
BACKPORT-->

Co-authored-by: Jeramy Soucy <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jeramysoucy jeramysoucy

Labels
blocker chore Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v9.0.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@legrego @jeramysoucy