Expose session invalidation API.

x-pack/plugins/security/server/routes/session_management/delete_all.test.ts

@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ObjectType } from '@kbn/config-schema';
+import type { PublicMethodsOf } from '@kbn/utility-types';
+import type { SecurityRequestHandlerContext, SecurityRouter } from '../../types';
+import {
+  kibanaResponseFactory,
+  RequestHandler,
+  RouteConfig,
+} from '../../../../../../src/core/server';
+import type { Session } from '../../session_management';
+import { defineDeleteAllSessionsRoutes } from './delete_all';
+
+import { httpServerMock } from '../../../../../../src/core/server/mocks';
+import { routeDefinitionParamsMock } from '../index.mock';
+import { sessionMock } from '../../session_management/session.mock';
+
+describe('Delete all sessions routes', () => {
+  let router: jest.Mocked<SecurityRouter>;
+  let session: jest.Mocked<PublicMethodsOf<Session>>;
+  beforeEach(() => {
+    const routeParamsMock = routeDefinitionParamsMock.create();
+    router = routeParamsMock.router;
+
+    session = sessionMock.create();
+    routeParamsMock.getSession.mockReturnValue(session);
+
+    defineDeleteAllSessionsRoutes(routeParamsMock);
+  });
+
+  describe('delete sessions', () => {
+    let routeHandler: RequestHandler<any, any, any, SecurityRequestHandlerContext>;
+    let routeConfig: RouteConfig<any, any, any, any>;
+    beforeEach(() => {
+      const [extendRouteConfig, extendRouteHandler] = router.delete.mock.calls.find(
+        ([{ path }]) => path === '/internal/security/session/_all'
+      )!;
+
+      routeConfig = extendRouteConfig;
+      routeHandler = extendRouteHandler;
+    });
+
+    it('correctly defines route.', () => {
+      expect(routeConfig.options).toEqual({ tags: ['access:sessionManagement'] });
+
+      const querySchema = (routeConfig.validate as any).query as ObjectType;
+      expect(() =>
+        querySchema.validate({ providerName: 'basic1' })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"[request query.providerType]: expected value of type [string] but got [undefined]"`
+      );
+      expect(() => querySchema.validate({ username: 'user' })).toThrowErrorMatchingInlineSnapshot(
+        `"[request query.providerType]: expected value of type [string] but got [undefined]"`
+      );
+      expect(() =>
+        querySchema.validate({ providerName: 'basic1', username: 'user' })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"[request query.providerType]: expected value of type [string] but got [undefined]"`
+      );
+
+      expect(querySchema.validate(undefined)).toBeUndefined();
+      expect(querySchema.validate({})).toEqual({});
+      expect(querySchema.validate({ providerType: 'basic' })).toEqual({ providerType: 'basic' });
+      expect(querySchema.validate({ providerType: 'basic', providerName: 'basic1' })).toEqual({
+        providerType: 'basic',
+        providerName: 'basic1',
+      });
+      expect(querySchema.validate({ providerType: 'basic', username: 'user' })).toEqual({
+        providerType: 'basic',
+        username: 'user',
+      });
+      expect(
+        querySchema.validate({ providerType: 'basic', providerName: 'basic1', username: 'user' })
+      ).toEqual({
+        providerType: 'basic',
+        providerName: 'basic1',
+        username: 'user',
+      });
+    });
+
+    it('uses query string to construct filter.', async () => {
+      session.clearAll.mockResolvedValue(30);
+
+      const mockRequest = httpServerMock.createKibanaRequest({
+        query: { providerType: 'basic', providerName: 'basic1', username: 'user' },
+      });
+      await expect(
+        routeHandler(
+          ({} as unknown) as SecurityRequestHandlerContext,
+          mockRequest,
+          kibanaResponseFactory
+        )
+      ).resolves.toEqual({
+        status: 200,
+        options: { body: { total: 30 } },
+        payload: { total: 30 },
+      });
+
+      expect(session.clearAll).toHaveBeenCalledTimes(1);
+      expect(session.clearAll).toHaveBeenCalledWith(mockRequest, {
+        provider: { type: 'basic', name: 'basic1' },
+        username: 'user',
+      });
+    });
+
+    it('does not specify filter if it is not specified in the query.', async () => {
+      session.clearAll.mockResolvedValue(30);
+
+      const mockRequest = httpServerMock.createKibanaRequest();
+      await expect(
+        routeHandler(
+          ({} as unknown) as SecurityRequestHandlerContext,
+          mockRequest,
+          kibanaResponseFactory
+        )
+      ).resolves.toEqual({
+        status: 200,
+        options: { body: { total: 30 } },
+        payload: { total: 30 },
+      });
+
+      expect(session.clearAll).toHaveBeenCalledTimes(1);
+      expect(session.clearAll).toHaveBeenCalledWith(mockRequest, undefined);
+    });
+  });
+});

x-pack/plugins/security/server/routes/session_management/delete_all.ts

@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import typeDetect from 'type-detect';
+import { schema } from '@kbn/config-schema';
+import { RouteDefinitionParams } from '..';
+
+/**
+ * Defines routes required for the deleting of all sessions.
+ */
+export function defineDeleteAllSessionsRoutes({ router, getSession }: RouteDefinitionParams) {
+  router.delete(
+    {
+      path: '/internal/security/session/_all',
+      validate: {
+        query: schema.maybe(
+          schema.object(
+            {
+              // `providerType` is actually required when any other options are specified, but such schema isn't
+              // currently supported by the Core for `query` string parameters. To workaround that we mark this property
+              // as optional and do custom validation instead: https://github.com/elastic/kibana/issues/92201
+              providerType: schema.maybe(schema.string()),
+              providerName: schema.maybe(schema.string()),
+              username: schema.maybe(schema.string()),
+            },
+            {
+              validate(value) {
+                if (typeof value?.providerType !== 'string' && Object.keys(value).length > 0) {
+                  return `[request query.providerType]: expected value of type [string] but got [${typeDetect(
+                    value?.providerType
+                  )}]`;
+                }
+              },
+            }
+          )
+        ),
+      },
+      options: { tags: ['access:sessionManagement'] },
+    },
+    async (_context, request, response) => {
+      return response.ok({
+        body: {
+          total: await getSession().clearAll(
+            request,
+            request.query?.providerType
+              ? {
+                  provider: { type: request.query.providerType, name: request.query.providerName },
+                  username: request.query.username,
+                }
+              : undefined
+          ),
+        },
+      });
+    }
+  );
+}

x-pack/plugins/security/server/routes/session_management/index.ts

@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { defineDeleteAllSessionsRoutes } from './delete_all';
 import { defineSessionExtendRoutes } from './extend';
 import { defineSessionInfoRoutes } from './info';
-import { RouteDefinitionParams } from '..';
+import type { RouteDefinitionParams } from '..';
 
 export function defineSessionManagementRoutes(params: RouteDefinitionParams) {
   defineSessionInfoRoutes(params);
   defineSessionExtendRoutes(params);
+  defineDeleteAllSessionsRoutes(params);
 }

x-pack/plugins/security/server/session_management/session.mock.ts

@@ -7,7 +7,7 @@
 
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { mockAuthenticatedUser } from '../../common/model/authenticated_user.mock';
-import { Session, SessionValue } from './session';
+import type { Session, SessionValue } from './session';
 import { sessionIndexMock } from './session_index.mock';
 
 export const sessionMock = {
@@ -18,6 +18,7 @@ export const sessionMock = {
     update: jest.fn(),
     extend: jest.fn(),
     clear: jest.fn(),
+    clearAll: jest.fn(),
   }),
 
   createValue: (sessionValue: Partial<SessionValue> = {}): SessionValue => ({

x-pack/plugins/security/server/session_management/session.test.ts

@@ -807,4 +807,61 @@ describe('Session', () => {
       expect(mockSessionCookie.clear).toHaveBeenCalledWith(mockRequest);
     });
   });
+
+  describe('#clearAll', () => {
+    beforeEach(() => {
+      mockSessionCookie.get.mockResolvedValue(sessionCookieMock.createValue());
+      mockSessionIndex.clearAll.mockResolvedValue(10);
+    });
+
+    it('clears all sessions even if current initiator request does not have a session', async () => {
+      mockSessionCookie.get.mockResolvedValue(null);
+
+      await expect(session.clearAll(httpServerMock.createKibanaRequest())).resolves.toBe(10);
+
+      expect(mockSessionCookie.clear).not.toHaveBeenCalled();
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledTimes(1);
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledWith(undefined);
+    });
+
+    it('properly forwards filter with the provider type to the session index', async () => {
+      await expect(
+        session.clearAll(httpServerMock.createKibanaRequest(), { provider: { type: 'basic' } })
+      ).resolves.toBe(10);
+
+      expect(mockSessionCookie.clear).not.toHaveBeenCalled();
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledTimes(1);
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledWith({ provider: { type: 'basic' } });
+    });
+
+    it('properly forwards filter with the provider type and provider name to the session index', async () => {
+      await expect(
+        session.clearAll(httpServerMock.createKibanaRequest(), {
+          provider: { type: 'basic', name: 'basic1' },
+        })
+      ).resolves.toBe(10);
+
+      expect(mockSessionCookie.clear).not.toHaveBeenCalled();
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledTimes(1);
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledWith({
+        provider: { type: 'basic', name: 'basic1' },
+      });
+    });
+
+    it('properly forwards filter with the provider type, provider name, and username hash to the session index', async () => {
+      await expect(
+        session.clearAll(httpServerMock.createKibanaRequest(), {
+          provider: { type: 'basic', name: 'basic1' },
+          username: 'elastic',
+        })
+      ).resolves.toBe(10);
+
+      expect(mockSessionCookie.clear).not.toHaveBeenCalled();
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledTimes(1);
+      expect(mockSessionIndex.clearAll).toHaveBeenCalledWith({
+        provider: { type: 'basic', name: 'basic1' },
+        usernameHash: 'eb28536c8ead72bf81a0a9226e38fc9bad81f5e07c2081bb801b2a5c8842924e',
+      });
+    });
+  });
 });

x-pack/plugins/security/server/session_management/session.ts

@@ -76,6 +76,22 @@ export interface SessionValueContentToEncrypt {
   state: unknown;
 }
 
+/**
+ * Parameters provided for the `SessionIndex.clearAll` method that determine which session index
+ * values should be cleared (removed from the index).
+ */
+export interface ClearAllSessionFilter {
+  /**
+   * Descriptor of the authentication provider that created sessions that should be cleared. Provider
+   * name is optional.
+   */
+  provider: { type: string; name?: string };
+  /**
+   * Optional name of the user whose sessions should be cleared.
+   */
+  username?: string;
+}
+
 /**
  * The SIDs and AAD must be unpredictable to prevent guessing attacks, where an attacker is able to
  * guess or predict the ID of a valid session through statistical analysis techniques. That's why we
@@ -375,6 +391,37 @@ export class Session {
     sessionLogger.debug('Successfully invalidated session.');
   }
 
+  /**
+   * Clears all existing session values.
+   * @param request Request instance to clear session value for.
+   * @param [filter] Filter that narrows down the list of the sessions that should be cleared.
+   */
+  async clearAll(request: KibanaRequest, filter?: ClearAllSessionFilter) {
+    // For this case method we don't require request to have the associated session, but nevertheless
+    // we still want to log the SID if session is available.
+    const sessionCookieValue = await this.options.sessionCookie.get(request);
+    const sessionLogger = this.getLoggerForSID(sessionCookieValue?.sid);
+    sessionLogger.debug('Invalidating sessions.');
+
+    const clearIndexFilter = filter?.username
+      ? {
+          provider: filter.provider,
+          usernameHash: createHash('sha3-256').update(filter.username).digest('hex'),
+        }
+      : filter;
+
+    // There are two things to be aware of here:
+    // 1. We don't clear the cookie for the current session as we cannot be sure that we removed the
+    // session index value for this session, but it's not a big deal since it will be automatically
+    // cleared as soon as it's reused anyway.
+    // 2. We only remove session index values and don't invalidate any Elasticsearch tokens that
+    // may have been stored there since we cannot decrypt the session content. To decrypt it we need
+    // AAD string that is separately stored in the user browser cookie.
+    const invalidatedSessionsCount = await this.options.sessionIndex.clearAll(clearIndexFilter);
+    sessionLogger.debug(`Successfully invalidated ${invalidatedSessionsCount} session(s).`);
+    return invalidatedSessionsCount;
+  }
+
   private calculateExpiry(
     provider: AuthenticationProvider,
     currentLifespanExpiration?: number | null
@@ -411,9 +458,9 @@ export class Session {
 
   /**
    * Creates logger scoped to a specified session ID.
-   * @param sid Session ID to create logger for.
+   * @param [sid] Session ID to create logger for.
    */
-  private getLoggerForSID(sid: string) {
-    return this.options.logger.get(sid?.slice(-10));
+  private getLoggerForSID(sid?: string) {
+    return this.options.logger.get(sid?.slice(-10) ?? 'x'.repeat(10));
   }
 }

x-pack/plugins/security/server/session_management/session_index.mock.ts

@@ -6,14 +6,15 @@
  */
 
 import type { PublicMethodsOf } from '@kbn/utility-types';
-import { SessionIndex, SessionIndexValue } from './session_index';
+import type { SessionIndex, SessionIndexValue } from './session_index';
 
 export const sessionIndexMock = {
   create: (): jest.Mocked<PublicMethodsOf<SessionIndex>> => ({
     get: jest.fn(),
     create: jest.fn(),
     update: jest.fn(),
     clear: jest.fn(),
+    clearAll: jest.fn(),
     initialize: jest.fn(),
     cleanUp: jest.fn(),
   }),