-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Enterprise Search] Fix users being logged out of Kibana if Enterprise Search returns a 401 #80757
Conversation
apiResponse.url.endsWith('/login') || | ||
apiResponse.url.endsWith('/ent/select') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@orhantoy Let me know if you think we can remove redirect checks going forward - I might leave it in for now just in case users are somehow using mismatched Enterprise Search / Kibana versions, but would be good to potentially clean up down the road
if (apiResponse.url.endsWith('/login') || apiResponse.url.endsWith('/ent/select')) { | ||
// Handle unauthenticated users / authentication redirects | ||
if ( | ||
apiResponse.status === 401 || |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is destructured above, we can get rid of apiResponse.
here. I'd also submit that you can also destructure url
and clan this up a bit below
EDIT: I see that url
is already declared in scope. Perhaps:
const { status, url: responseUrl } = apiResponse;
...
responseUrl.endsWith('/login') ||
responseUrl.endsWith('/ent/select')
... but that doesn't really help much
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Left a nit comment but feel free to ignore if you like
Ahhh thanks for that scotty. I actually don't even know why I moved the destructure up above since I'm not even using it lol 🤦♀️ I'm gonna move it back down but leave it un-destructured for now, I'm hoping eventually we can clean up our if statement for unauthenticated users anyway if/when @orhantoy confirms that we'll likely never run into redirects from Kibana going forward. |
…f redirect - apparently this changed at some point between 7.9 and 7.10
💚 Build SucceededMetrics [docs]
History
To update your PR or re-run it, just comment with: |
…f redirect (elastic#80757) - apparently this changed at some point between 7.9 and 7.10
* master: (43 commits) [ML] Transforms: Fix tab ids for expanded row. (elastic#80666) server logs config paths to use for runner (elastic#52980) Fix audit logger logging to console even when disabled (elastic#80928) skip flaky suite (elastic#80929) Added Enterprise Search config to kibana-docker (elastic#80872) skip flaky suite (elastic#80914) [keystore_cli] parse values as JSON before adding to keystore (elastic#80848) [Ingest Manager] Fix for comparing versions with -SNAPSHOT suffix (elastic#80742) ECS audit logging (elastic#74640) [Uptime] Add client-side unit tests for remaining synthetics code (elastic#80215) [Security_Solution][Resolver] Promote z-index on node labels (elastic#80854) Move renderHeaderActions back into mount useEffect + update tests (elastic#80861) [Reporting] Document Network Policy configuration (elastic#80431) [Reporting] Add contextual documentation for CSV Max Bytes setting (elastic#80782) Add catch for Enterprise Search sending back a 401 response instead of redirect (elastic#80757) [Actions] Back Button on Add Connector Flyout (elastic#80160) removing `kibana_datatable` in favor of `datatable` (elastic#80548) [Alerting UI] Updating 'Add new' wording (elastic#80509) [Docs] Document Encrypted Saved Objects functionality. (elastic#80183) [Discover] fix auto-refresh (elastic#80635) ...
* master: (23 commits) [ML] Transforms: Fix tab ids for expanded row. (elastic#80666) server logs config paths to use for runner (elastic#52980) Fix audit logger logging to console even when disabled (elastic#80928) skip flaky suite (elastic#80929) Added Enterprise Search config to kibana-docker (elastic#80872) skip flaky suite (elastic#80914) [keystore_cli] parse values as JSON before adding to keystore (elastic#80848) [Ingest Manager] Fix for comparing versions with -SNAPSHOT suffix (elastic#80742) ECS audit logging (elastic#74640) [Uptime] Add client-side unit tests for remaining synthetics code (elastic#80215) [Security_Solution][Resolver] Promote z-index on node labels (elastic#80854) Move renderHeaderActions back into mount useEffect + update tests (elastic#80861) [Reporting] Document Network Policy configuration (elastic#80431) [Reporting] Add contextual documentation for CSV Max Bytes setting (elastic#80782) Add catch for Enterprise Search sending back a 401 response instead of redirect (elastic#80757) [Actions] Back Button on Add Connector Flyout (elastic#80160) removing `kibana_datatable` in favor of `datatable` (elastic#80548) [Alerting UI] Updating 'Add new' wording (elastic#80509) [Docs] Document Encrypted Saved Objects functionality. (elastic#80183) [Discover] fix auto-refresh (elastic#80635) ...
Summary
At some point between 7.9 and 7.10, Enterprise Search started returning 401 responses (instead of /login redirects) when users were unauthenticated or did not exist (e.g. standard auth).
We need to expand our
handleAuthenticationError
catch to check for 401 responses as well so we don't pass them back to Kibana - Kibana responds to 401 status codes by logging the user out of Kibana, which we don't want to do in this case.QA
elastic
user[error][enterpriseSearch][plugins] Cannot authenticate Enterprise Search user
message in the Kibana terminal logsChecklist