Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Enterprise Search] Fix users being logged out of Kibana if Enterprise Search returns a 401 #80757

Merged
merged 1 commit into from
Oct 16, 2020

Conversation

cee-chen
Copy link
Member

@cee-chen cee-chen commented Oct 15, 2020

Summary

At some point between 7.9 and 7.10, Enterprise Search started returning 401 responses (instead of /login redirects) when users were unauthenticated or did not exist (e.g. standard auth).

We need to expand our handleAuthenticationError catch to check for 401 responses as well so we don't pass them back to Kibana - Kibana responds to 401 status codes by logging the user out of Kibana, which we don't want to do in this case.

QA

  • Start Enterprise Search on standard auth
  • Log in to Kibana as the elastic user
  • Attempt to access App Search or Workplace Search
  • Confirm that you are:
    • NOT logged out / see an error connecting screen
    • See a [error][enterpriseSearch][plugins] Cannot authenticate Enterprise Search user message in the Kibana terminal logs

Checklist

@cee-chen cee-chen added bug Fixes for quality problems that affect the customer experience Feature:Plugins v7.10.0 v7.11.0 labels Oct 15, 2020
@cee-chen cee-chen requested a review from a team October 15, 2020 21:09
@cee-chen cee-chen added the release_note:skip Skip the PR/issue when compiling release notes label Oct 15, 2020
apiResponse.url.endsWith('/login') ||
apiResponse.url.endsWith('/ent/select')
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@orhantoy Let me know if you think we can remove redirect checks going forward - I might leave it in for now just in case users are somehow using mismatched Enterprise Search / Kibana versions, but would be good to potentially clean up down the road

if (apiResponse.url.endsWith('/login') || apiResponse.url.endsWith('/ent/select')) {
// Handle unauthenticated users / authentication redirects
if (
apiResponse.status === 401 ||
Copy link
Contributor

@scottybollinger scottybollinger Oct 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is destructured above, we can get rid of apiResponse. here. I'd also submit that you can also destructure url and clan this up a bit below

EDIT: I see that url is already declared in scope. Perhaps:

const { status, url: responseUrl } = apiResponse;
...
responseUrl.endsWith('/login') ||
responseUrl.endsWith('/ent/select')

... but that doesn't really help much

Copy link
Contributor

@scottybollinger scottybollinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Left a nit comment but feel free to ignore if you like

@cee-chen
Copy link
Member Author

Ahhh thanks for that scotty. I actually don't even know why I moved the destructure up above since I'm not even using it lol 🤦‍♀️ I'm gonna move it back down but leave it un-destructured for now, I'm hoping eventually we can clean up our if statement for unauthenticated users anyway if/when @orhantoy confirms that we'll likely never run into redirects from Kibana going forward.

…f redirect

- apparently this changed at some point between 7.9 and 7.10
@kibanamachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

  • 💚 Build #82036 succeeded bf851afce46bb5e2c54ea904d360a278410d8c41

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@cee-chen cee-chen merged commit 7f27841 into elastic:master Oct 16, 2020
@cee-chen cee-chen deleted the catch-401 branch October 16, 2020 17:27
cee-chen pushed a commit to cee-chen/kibana that referenced this pull request Oct 16, 2020
…f redirect (elastic#80757)

- apparently this changed at some point between 7.9 and 7.10
cee-chen pushed a commit that referenced this pull request Oct 16, 2020
…f redirect (#80757) (#80880)

- apparently this changed at some point between 7.9 and 7.10
cee-chen pushed a commit that referenced this pull request Oct 16, 2020
…f redirect (#80757) (#80879)

- apparently this changed at some point between 7.9 and 7.10
gmmorris added a commit to gmmorris/kibana that referenced this pull request Oct 19, 2020
* master: (43 commits)
  [ML] Transforms: Fix tab ids for expanded row. (elastic#80666)
  server logs config paths to use for runner (elastic#52980)
  Fix audit logger logging to console even when disabled (elastic#80928)
  skip flaky suite (elastic#80929)
  Added Enterprise Search config to kibana-docker (elastic#80872)
  skip flaky suite (elastic#80914)
  [keystore_cli] parse values as JSON before adding to keystore (elastic#80848)
  [Ingest Manager] Fix for comparing versions with -SNAPSHOT suffix (elastic#80742)
  ECS audit logging (elastic#74640)
  [Uptime] Add client-side unit tests for remaining synthetics code (elastic#80215)
  [Security_Solution][Resolver] Promote z-index on node labels (elastic#80854)
  Move renderHeaderActions back into mount useEffect + update tests (elastic#80861)
  [Reporting] Document Network Policy configuration (elastic#80431)
  [Reporting] Add contextual documentation for CSV Max Bytes setting (elastic#80782)
  Add catch for Enterprise Search sending back a 401 response instead of redirect (elastic#80757)
  [Actions] Back Button on Add Connector Flyout (elastic#80160)
  removing `kibana_datatable` in favor of `datatable`  (elastic#80548)
  [Alerting UI] Updating 'Add new' wording (elastic#80509)
  [Docs] Document Encrypted Saved Objects functionality. (elastic#80183)
  [Discover] fix auto-refresh (elastic#80635)
  ...
gmmorris added a commit to gmmorris/kibana that referenced this pull request Oct 19, 2020
* master: (23 commits)
  [ML] Transforms: Fix tab ids for expanded row. (elastic#80666)
  server logs config paths to use for runner (elastic#52980)
  Fix audit logger logging to console even when disabled (elastic#80928)
  skip flaky suite (elastic#80929)
  Added Enterprise Search config to kibana-docker (elastic#80872)
  skip flaky suite (elastic#80914)
  [keystore_cli] parse values as JSON before adding to keystore (elastic#80848)
  [Ingest Manager] Fix for comparing versions with -SNAPSHOT suffix (elastic#80742)
  ECS audit logging (elastic#74640)
  [Uptime] Add client-side unit tests for remaining synthetics code (elastic#80215)
  [Security_Solution][Resolver] Promote z-index on node labels (elastic#80854)
  Move renderHeaderActions back into mount useEffect + update tests (elastic#80861)
  [Reporting] Document Network Policy configuration (elastic#80431)
  [Reporting] Add contextual documentation for CSV Max Bytes setting (elastic#80782)
  Add catch for Enterprise Search sending back a 401 response instead of redirect (elastic#80757)
  [Actions] Back Button on Add Connector Flyout (elastic#80160)
  removing `kibana_datatable` in favor of `datatable`  (elastic#80548)
  [Alerting UI] Updating 'Add new' wording (elastic#80509)
  [Docs] Document Encrypted Saved Objects functionality. (elastic#80183)
  [Discover] fix auto-refresh (elastic#80635)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Plugins release_note:skip Skip the PR/issue when compiling release notes v7.10.0 v7.11.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants