Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes anonymous auth flow to work with SAML #1817

Closed
wants to merge 10 commits into from
Closed

Fixes anonymous auth flow to work with SAML #1817

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
199683c
Fixes anonymous auth flow to work with SAML
DarshitChanpura Mar 6, 2024
cbdf7a6
Adds hardcoded credentials for anonymous user
DarshitChanpura Mar 11, 2024
a0f2db4
Updates basic auth header to be a config constant
DarshitChanpura Mar 11, 2024
3c0c2f9
Removes unneeded usage of anonymous auth header constant
DarshitChanpura Mar 11, 2024
8322a23
Updates logic to display anonymous auth login button
DarshitChanpura Mar 11, 2024
f331377
Adds test to check whether anonymous auth login button is displayed c…
DarshitChanpura Mar 11, 2024
63abb41
Fixes integrationtests
DarshitChanpura Mar 12, 2024
5492d2a
Adds integration tests for anonymous auth login with basic authorizat…
DarshitChanpura Mar 12, 2024
9d47261
Generates random password for anonymous user
DarshitChanpura Mar 12, 2024
d682701
Fixes lint errors
DarshitChanpura Mar 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion public/apps/login/login-page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ export function LoginPage(props: LoginPageDeps) {
</EuiFormRow>
);

if (authOpts.length > 1) {
if (authOpts.length > 0) {
DarshitChanpura marked this conversation as resolved.
Show resolved Hide resolved
if (props.config.auth.anonymous_auth_enabled) {
const anonymousConfig = props.config.ui[AuthType.ANONYMOUS].login;
formBody.push(
Expand Down
11 changes: 11 additions & 0 deletions server/auth/types/authentication_type.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,12 @@ export abstract class AuthenticationType implements IAuthenticationType {
const authHeaders = {};
let cookie: SecuritySessionCookie | null | undefined;
let authInfo: any | undefined;

if (this.config.auth.anonymous_auth_enabled) {
const anonymousAuthHeaders = { _auth_request_type_: 'anonymous' };
Object.assign(authHeaders, anonymousAuthHeaders);
}

// if this is an REST API call, suppose the request includes necessary auth header
// see https://www.elastic.co/guide/en/opensearch-dashboards/master/using-api.html
if (this.requestIncludesAuthInfo(request)) {
Expand Down Expand Up @@ -153,10 +159,14 @@ export abstract class AuthenticationType implements IAuthenticationType {
if (request.url.pathname && request.url.pathname.startsWith('/bundles/')) {
return toolkit.notHandled();
}
console.log('Request is unauthorized');
console.log(request.url);
console.log(request.route);

// send to auth workflow
return this.handleUnauthedRequest(request, response, toolkit);
}
console.log('we have a cookie: ' + JSON.stringify(cookie));

// extend session expiration time
if (this.config.session.keepalive) {
Expand Down Expand Up @@ -211,6 +221,7 @@ export abstract class AuthenticationType implements IAuthenticationType {
}
if (!authInfo) {
authInfo = await this.securityClient.authinfo(request, authHeaders);
console.log(authInfo);
}
authState.authInfo = authInfo;

Expand Down
22 changes: 7 additions & 15 deletions server/auth/types/basic/basic_auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,21 +111,13 @@ export class BasicAuthentication extends AuthenticationType {
request,
this.coreSetup.http.basePath.serverBasePath
);
if (this.config.auth.anonymous_auth_enabled) {
const redirectLocation = `${this.coreSetup.http.basePath.serverBasePath}${ANONYMOUS_AUTH_LOGIN}?${nextUrlParam}`;
return response.redirected({
headers: {
location: `${redirectLocation}`,
},
});
} else {
Comment on lines -114 to -121
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This if block caused all logout requests to be redirected to the anonymous login page when anonymous auth is enabled. This is incorrect. All logout requests should redirect to login page. (Similar change below for multi_auth.ts)

const redirectLocation = `${this.coreSetup.http.basePath.serverBasePath}${LOGIN_PAGE_URI}?${nextUrlParam}`;
return response.redirected({
headers: {
location: `${redirectLocation}`,
},
});
}

const redirectLocation = `${this.coreSetup.http.basePath.serverBasePath}${LOGIN_PAGE_URI}?${nextUrlParam}`;
return response.redirected({
headers: {
location: `${redirectLocation}`,
},
});
} else {
return response.unauthorized({
body: `Authentication required`,
Expand Down
7 changes: 6 additions & 1 deletion server/auth/types/basic/routes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,9 @@ export class BasicAuthRoutes {
}
context.security_plugin.logger.info('The Redirect Path is ' + redirectUrl);
try {
user = await this.securityClient.authenticateWithHeaders(request, {});
user = await this.securityClient.authenticateWithHeaders(request, {
_auth_request_type_: 'anonymous',
DarshitChanpura marked this conversation as resolved.
Show resolved Hide resolved
});
Copy link
Member Author

@DarshitChanpura DarshitChanpura Mar 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Out of scope of this PR, but code between lines 214-228 is dead-code because multi_tenancy is never set upon receiving auth response from backend.

The dead-code:

security-dashboards-plugin/server/auth/types/basic/routes.ts

Lines 214 to 227 in 3c0c2f9

if (user.multitenancy_enabled) {
const selectTenant = resolveTenant({
request,
username: user.username,
roles: user.roles,
availableTenants: user.tenants,
config: this.config,
cookie: sessionStorage,
multitenancyEnabled: user.multitenancy_enabled,
privateTenantEnabled: user.private_tenant_enabled,
defaultTenant: user.default_tenant,
});
sessionStorage.tenant = selectTenant;
}

this is the reason:

security-dashboards-plugin/server/backend/opensearch_security_client.ts

Lines 98 to 104 in 3c0c2f9

return {
username: esResponse.user_name,
roles: esResponse.roles,
backendRoles: esResponse.backend_roles,
tenants: esResponse.tenants,
selectedTenant: esResponse.user_requested_tenant,
};

as we can see that the property multi_tenancy for user object is never set, hence the if condition is never true.

} catch (error) {
context.security_plugin.logger.error(
`Failed authentication: ${error}. Redirecting to Login Page`
Expand All @@ -200,6 +202,8 @@ export class BasicAuthRoutes {
});
}

console.log('Anon user: ' + JSON.stringify(user));

this.sessionStorageFactory.asScoped(request).clear();
const sessionStorage: SecuritySessionCookie = {
username: user.username,
Expand All @@ -209,6 +213,7 @@ export class BasicAuthRoutes {
};

if (user.multitenancy_enabled) {
request.headers._auth_request_type_ = 'anonymous';
const selectTenant = resolveTenant({
request,
username: user.username,
Expand Down
9 changes: 1 addition & 8 deletions server/auth/types/multiple/multi_auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,20 +166,13 @@ export class MultipleAuthentication extends AuthenticationType {
this.coreSetup.http.basePath.serverBasePath
);

if (this.config.auth.anonymous_auth_enabled) {
const redirectLocation = `${this.coreSetup.http.basePath.serverBasePath}${ANONYMOUS_AUTH_LOGIN}?${nextUrlParam}`;
return response.redirected({
headers: {
location: `${redirectLocation}`,
},
});
}
return response.redirected({
headers: {
location: `${this.coreSetup.http.basePath.serverBasePath}${LOGIN_PAGE_URI}?${nextUrlParam}`,
},
});
} else {
console.log('not a page request');
return response.unauthorized();
}
}
Expand Down
Loading