[DONT MERGE] Allow Kibana authentication via JWT for the predefined set of routes. #159117

azasypkin · 2023-06-06T12:44:39Z

Summary

In this PoC, I introduce the conditional xpack.security.authc.http.jwt.restrictToPaths configuration (available only in the serverless context) that restricts usage of the JWT credentials only to a set of pre-configured Kibana paths:

xpack.security.authc:
  http:
    jwt.restrictToPaths: ["/internal/security/me", "/api/status"]

Alternatively can move this logic from authentication layer to the authorization layer with something like this:

xpack.security.authz:
  jwt.enabled: true

router.get({
  path: '/api/status',
  options: {
    // If the client is using JWT credentials, the JWT `scope` claim must
    // include `metrics` in order to access the route. Routes without the
    // `jwt:` tag aren't available if JWT credentials are used. 
    tags: ['api', 'jwt:scope:metrics'],
  },
  ...
});

Testing

Generate keys

NOTE: Test keys mentioned here aren't secret and already publicly exposed.

openssl genrsa 2048 > jwks_private.pem
openssl rsa -in jwks_private.pem -pubout > jwks_public.pem

## https://github.com/dannycoates/pem-jwk
pem-jwk jwks_public.pem > jwks.json

JWKS (pkc_jwkset_path)

{
  "keys": [
    {
      "kty": "RSA",
      "e": "AQAB",
      "use": "sig",
      "n": "v9-88aGdE4E85PuEycxTA6LkM3TBvNScoeP6A-dd0Myo6-LfBlp1r7BPBWmvi_SC6Zam3U1LE3AekDMwqJg304my0pvh8wOwlmRpgKXDXjvj4s59vdeVNhCB9doIthUABd310o9lyb55fWc_qQYE2LK9AyEjicJswafguH6txV4IwSl13ieZAxni0Ca4CwdzXO1Oi34XjHF8F5x_0puTaQzHn5bPG4fiIJN-pwie0Ba4VEDPO5ca4lLXWVi1bn8xMDTAULrBAXJwDaDdS05KMbc4sPlyQPhtY1gcYvUbozUPYxSWwA7fZgFzV_h-uy_oXf1EXttOxSgog1z3cJzf6Q"
    }
  ]
}

Public key

Private key

Generate JWT

Go to https://jwt.io/
Use the following header

{
  "alg": "RS256",
  "typ": "JWT"
}

Use the following payload

{
  "iss": "https://kibana.elastic.co/jwt/",
  "sub": "[email protected]",
  "aud": "elasticsearch",
  "name": "Aleh Zasypkin",
  "iat": 946684800,
  "exp": 4070908800
}

For signature use the private and public keys defined in the previous section
Use generated token for authentication, e.g. eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJhbGVoLnphc3lwa2luQGVsYXN0aWMuY28iLCJhdWQiOiJlbGFzdGljc2VhcmNoIiwibmFtZSI6IkFsZWggWmFzeXBraW4iLCJpYXQiOjk0NjY4NDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.LBwLDK4CCYHjtmWZ_J0IwKP6BQjH-8LbKUu1Obj2bUAtZcGVrnO_pY1JXCG582BLegq8_RrlxZ0C8GKN-kvuFt7okPEkMqfT6yCi_gt271Xzlbe01IT6DX5WRm7nT6mjNI4USndemquxl0NxHCm07azKD4MUsYIlgp_YW14ZKmHn4fJW0qgDgt4CeRkLQm5QE--rZ7VnlOFvaAsIlC7bLHHvhj_ntMSraFJEXc1JE7va8QX_D6cXpHbszGjnm9G928gJ24XVjUqXuR23yDNcc6socTPbq8WO9tj67cknCZG1An1wtefDOOKiqMKhrHPvBz9eT1CnOm57l63K8LvulQ

Run ES

$ yarn es snapshot --license trial \
    -E xpack.security.authc.token.enabled=true \
    -E xpack.security.authc.realms.native.native1.order=0 \
    -E xpack.security.authc.realms.jwt.jwt1.order=1 \
    -E xpack.security.authc.realms.jwt.jwt1.token_type=access_token \
    -E xpack.security.authc.realms.jwt.jwt1.client_authentication.type=shared_secret \
    -E xpack.security.authc.realms.jwt.jwt1.client_authentication.shared_secret=my_super_secret \
    -E xpack.security.authc.realms.jwt.jwt1.allowed_issuer=https://kibana.elastic.co/jwt/ \
    -E xpack.security.authc.realms.jwt.jwt1.allowed_subjects=aleh.zasypkin@elastic.co \
    -E xpack.security.authc.realms.jwt.jwt1.allowed_audiences=elasticsearch \
    -E xpack.security.authc.realms.jwt.jwt1.allowed_signature_algorithms=[RS256] \
    -E xpack.security.authc.realms.jwt.jwt1.claims.principal=sub \
    -E xpack.security.authc.realms.jwt.jwt1.pkc_jwkset_path=/.../jwks.json

Run Kibana

yarn start --serverless \
    --elasticsearch.requestHeadersWhitelist='["authorization", "ES-Client-Authentication"]' \
    --xpack.security.authc.http.jwt.restrictToPaths='["/internal/security/me"]'

Authenticate with JWT

Elasticsearch endpoint

GET http://localhost:9200/_security/_authenticate
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJhbGVoLnphc3lwa2luQGVsYXN0aWMuY28iLCJhdWQiOiJlbGFzdGljc2VhcmNoIiwibmFtZSI6IkFsZWggWmFzeXBraW4iLCJpYXQiOjk0NjY4NDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.LBwLDK4CCYHjtmWZ_J0IwKP6BQjH-8LbKUu1Obj2bUAtZcGVrnO_pY1JXCG582BLegq8_RrlxZ0C8GKN-kvuFt7okPEkMqfT6yCi_gt271Xzlbe01IT6DX5WRm7nT6mjNI4USndemquxl0NxHCm07azKD4MUsYIlgp_YW14ZKmHn4fJW0qgDgt4CeRkLQm5QE--rZ7VnlOFvaAsIlC7bLHHvhj_ntMSraFJEXc1JE7va8QX_D6cXpHbszGjnm9G928gJ24XVjUqXuR23yDNcc6socTPbq8WO9tj67cknCZG1An1wtefDOOKiqMKhrHPvBz9eT1CnOm57l63K8LvulQ
ES-Client-Authentication: SharedSecret my_super_secret
Accept: application/json

{
  "username": "[email protected]",
  "roles": [],
  "full_name": null,
  "email": null,
  "metadata": {
    "jwt_claim_aud": [
      "elasticsearch"
    ],
    "jwt_claim_name": "Aleh Zasypkin",
    "jwt_claim_iss": "https://kibana.elastic.co/jwt/",
    "jwt_token_type": "access_token",
    "jwt_claim_sub": "[email protected]"
  },
  "enabled": true,
  "authentication_realm": {
    "name": "jwt1",
    "type": "jwt"
  },
  "lookup_realm": {
    "name": "jwt1",
    "type": "jwt"
  },
  "authentication_type": "realm"
}

Kibana endpoint

GET http://localhost:5601/internal/security/me
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJhbGVoLnphc3lwa2luQGVsYXN0aWMuY28iLCJhdWQiOiJlbGFzdGljc2VhcmNoIiwibmFtZSI6IkFsZWggWmFzeXBraW4iLCJpYXQiOjk0NjY4NDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.LBwLDK4CCYHjtmWZ_J0IwKP6BQjH-8LbKUu1Obj2bUAtZcGVrnO_pY1JXCG582BLegq8_RrlxZ0C8GKN-kvuFt7okPEkMqfT6yCi_gt271Xzlbe01IT6DX5WRm7nT6mjNI4USndemquxl0NxHCm07azKD4MUsYIlgp_YW14ZKmHn4fJW0qgDgt4CeRkLQm5QE--rZ7VnlOFvaAsIlC7bLHHvhj_ntMSraFJEXc1JE7va8QX_D6cXpHbszGjnm9G928gJ24XVjUqXuR23yDNcc6socTPbq8WO9tj67cknCZG1An1wtefDOOKiqMKhrHPvBz9eT1CnOm57l63K8LvulQ
ES-Client-Authentication: SharedSecret my_super_secret
Accept: application/json

{
  "username": "[email protected]",
  "roles": [],
  "full_name": null,
  "email": null,
  "metadata": {
    "jwt_token_type": "access_token",
    "jwt_claim_iss": "https://kibana.elastic.co/jwt/",
    "jwt_claim_name": "Aleh Zasypkin",
    "jwt_claim_aud": [
      "elasticsearch"
    ],
    "jwt_claim_sub": "[email protected]"
  },
  "enabled": true,
  "authentication_realm": {
    "name": "jwt1",
    "type": "jwt"
  },
  "lookup_realm": {
    "name": "jwt1",
    "type": "jwt"
  },
  "authentication_type": "realm",
  "authentication_provider": {
    "type": "http",
    "name": "__http__"
  },
  "elastic_cloud_user": false
}

Try not allowed endpoint:

GET http://localhost:5601/api/status
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJhbGVoLnphc3lwa2luQGVsYXN0aWMuY28iLCJhdWQiOiJlbGFzdGljc2VhcmNoIiwibmFtZSI6IkFsZWggWmFzeXBraW4iLCJpYXQiOjk0NjY4NDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.LBwLDK4CCYHjtmWZ_J0IwKP6BQjH-8LbKUu1Obj2bUAtZcGVrnO_pY1JXCG582BLegq8_RrlxZ0C8GKN-kvuFt7okPEkMqfT6yCi_gt271Xzlbe01IT6DX5WRm7nT6mjNI4USndemquxl0NxHCm07azKD4MUsYIlgp_YW14ZKmHn4fJW0qgDgt4CeRkLQm5QE--rZ7VnlOFvaAsIlC7bLHHvhj_ntMSraFJEXc1JE7va8QX_D6cXpHbszGjnm9G928gJ24XVjUqXuR23yDNcc6socTPbq8WO9tj67cknCZG1An1wtefDOOKiqMKhrHPvBz9eT1CnOm57l63K8LvulQ
ES-Client-Authentication: SharedSecret my_super_secret
Accept: application/json

[2023-06-07T12:00:46.233+02:00][ERROR][plugins.security.http] Attempted to authenticate with JWT credentials against /api/status, but it's not allowed.

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Unauthorized"
}

Related: #153720

azasypkin · 2023-07-27T12:30:41Z

Closing in favor of the issue for the proper implementation #162632

…tes only. (#163806) ## Summary Allow Kibana to restrict the usage of JWT for a predefined set of routes only in Serverless environment by default. This capability is not available in non-Serverless environment. Any route that needs to be accessed in Serverless environemnt using JWT as a means of authentication should include `security:acceptJWT` tag. ## How to test If you'd like to generate your own JWT to test the PR, please follow the steps outlined in #159117 (comment) or just run functional test server and use static JWT from the Serverless test. This PR also generated a Serverless Docker image that you can use in your Dev/QA MKI cluster. - [x] Implementation functionality and add unit tests - [x] Update metrics/status routes to include new `security:acceptJWT` tag - [x] Update serverless test suite to include a test for `security:acceptJWT` __Fixes: https://github.com/elastic/kibana/issues/162632__ --------- Co-authored-by: kibanamachine <[email protected]>

## Summary In this PR we: * Allow using JWT credentials to grant API keys * Extend default value of `elasticsearch.requestHeadersWhitelist` to include both `authorization` and `es-client-authentication` to support JWT with required client authentication _by default_. See https://www.elastic.co/guide/en/elasticsearch/reference/8.11/jwt-auth-realm.html#jwt-realm-configuration * Add API integration tests for both JWTs with client authentication and without it __NOTE:__ We're not gating this functionality with the config flag (`xpack.security.authc.http.jwt.taggedRoutesOnly`) as we did for the Serverless offering. It'd be a breaking change as we already implicitly support JWT authentication without client authentication, and to be honest, it's not really necessary anyway. ## Testing Refer to the `Testing` section in this PR description: #159117. Or run already pre-configured Kibana functional test server: 1. `node scripts/functional_tests_server.js --config x-pack/test/security_api_integration/api_keys.config.ts` 2. Create a role mapping for JWT user: ```bash curl -X POST --location "http://localhost:9220/_security/role_mapping/jwt" \ -H "Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d "{ \"roles\": [ \"superuser\" ], \"enabled\": true, \"rules\": { \"all\": [{\"field\" : { \"realm.name\" : \"jwt_with_secret\" }}] } }" ``` 3. Send any Kibana API request with the following credentials: ```bash curl -X POST --location "xxxx" -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJlbGFzdGljLWFnZW50IiwiYXVkIjoiZWxhc3RpY3NlYXJjaCIsIm5hbWUiOiJFbGFzdGljIEFnZW50IiwiaWF0Ijo5NDY2ODQ4MDAsImV4cCI6NDA3MDkwODgwMH0.P7RHKZlLskS5DfVRqoVO4ivoIq9rXl2-GW6hhC9NvTSkwphYivcjpTVcyENZvxTTvJJNqcyx6rF3T-7otTTIHBOZIMhZauc5dob-sqcN_mT2htqm3BpSdlJlz60TBq6diOtlNhV212gQCEJMPZj0MNj7kZRj_GsECrTaU7FU0A3HAzkbdx15vQJMKZiFbbQCVI7-X2J0bZzQKIWfMHD-VgHFwOe6nomT-jbYIXtCBDd6fNj1zTKRl-_uzjVqNK-h8YW1h6tE4xvZmXyHQ1-9yNKZIWC7iEaPkBLaBKQulLU5MvW3AtVDUhzm6--5H1J85JH5QhRrnKYRon7ZW5q1AQ' -H 'ES-Client-Authentication: SharedSecret my_super_secret' ....for example.... curl -X GET --location "http://localhost:5620/internal/security/me" \ -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJlbGFzdGljLWFnZW50IiwiYXVkIjoiZWxhc3RpY3NlYXJjaCIsIm5hbWUiOiJFbGFzdGljIEFnZW50IiwiaWF0Ijo5NDY2ODQ4MDAsImV4cCI6NDA3MDkwODgwMH0.P7RHKZlLskS5DfVRqoVO4ivoIq9rXl2-GW6hhC9NvTSkwphYivcjpTVcyENZvxTTvJJNqcyx6rF3T-7otTTIHBOZIMhZauc5dob-sqcN_mT2htqm3BpSdlJlz60TBq6diOtlNhV212gQCEJMPZj0MNj7kZRj_GsECrTaU7FU0A3HAzkbdx15vQJMKZiFbbQCVI7-X2J0bZzQKIWfMHD-VgHFwOe6nomT-jbYIXtCBDd6fNj1zTKRl-_uzjVqNK-h8YW1h6tE4xvZmXyHQ1-9yNKZIWC7iEaPkBLaBKQulLU5MvW3AtVDUhzm6--5H1J85JH5QhRrnKYRon7ZW5q1AQ' \ -H 'ES-Client-Authentication: SharedSecret my_super_secret' \ -H "Accept: application/json" ---- { "username": "elastic-agent", "roles": [ "superuser" ], "full_name": null, "email": null, "metadata": { "jwt_claim_sub": "elastic-agent", "jwt_token_type": "access_token", "jwt_claim_iss": "https://kibana.elastic.co/jwt/", "jwt_claim_name": "Elastic Agent", "jwt_claim_aud": [ "elasticsearch" ] }, "enabled": true, "authentication_realm": { "name": "jwt_with_secret", "type": "jwt" }, "lookup_realm": { "name": "jwt_with_secret", "type": "jwt" }, "authentication_type": "realm", "authentication_provider": { "type": "http", "name": "__http__" }, "elastic_cloud_user": false } ``` __Fixes:__ #171522 ---- Release note: The default value of the `elasticsearch.requestHeadersWhitelist` configuration option has been expanded to include the `es-client-authentication` HTTP header, in addition to `authorization`. --------- Co-authored-by: kibanamachine <[email protected]>

azasypkin added skip-ci ci:no-auto-commit Disable auto-committing changes on CI labels Jun 6, 2023

azasypkin self-assigned this Jun 6, 2023

azasypkin force-pushed the issue-xxx-jwt-poc branch from bd53102 to ab9040c Compare June 7, 2023 09:50

Allow Kibana authentication via JWT for the predefined set of routes.

15f21e0

azasypkin force-pushed the issue-xxx-jwt-poc branch from ab9040c to 15f21e0 Compare June 8, 2023 09:06

azasypkin mentioned this pull request Jul 27, 2023

Allow Kibana to restrict the usage of JWT for a predefined set of routes only #162632

Closed

azasypkin closed this Jul 27, 2023

azasypkin deleted the issue-xxx-jwt-poc branch August 14, 2023 11:28

azasypkin mentioned this pull request Aug 17, 2023

Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

Merged

3 tasks

azasypkin mentioned this pull request Dec 4, 2023

Allow using JWT credentials to grant API keys. #172444

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DONT MERGE] Allow Kibana authentication via JWT for the predefined set of routes. #159117

[DONT MERGE] Allow Kibana authentication via JWT for the predefined set of routes. #159117

azasypkin commented Jun 6, 2023 •

edited

Loading

azasypkin commented Jul 27, 2023

[DONT MERGE] Allow Kibana authentication via JWT for the predefined set of routes. #159117

[DONT MERGE] Allow Kibana authentication via JWT for the predefined set of routes. #159117

Conversation

azasypkin commented Jun 6, 2023 • edited Loading

Summary

Testing

Generate keys

JWKS (pkc_jwkset_path)

Public key

Private key

Generate JWT

Run ES

Run Kibana

Authenticate with JWT

Elasticsearch endpoint

Kibana endpoint

azasypkin commented Jul 27, 2023

azasypkin commented Jun 6, 2023 •

edited

Loading