Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CEL Filebeat input] Enhance the CEL input to support HTTP Digest Authentication #35514

Closed
milan-elastic opened this issue May 19, 2023 · 3 comments · Fixed by #36932
Closed
Assignees

Comments

@milan-elastic
Copy link

Describe the enhancement:
Filebeat CEL input does not have support for HTTP Digest Authentication. Digest Authentication is designed to be more secure than traditional basic authentication schemes. Many products expose their metrics on endpoints that use digest authentication, which can't be accessed using the current CEL input module, Internally Digest authentication is using MD5 hash algorithm for the authentication that is also not supported in CEL to pass the hashed creds in Header.

Describe a specific use case for the enhancement or feature:

To create an elastic/integrations#3744 we need to access endpoints that require HTTP Digest Authentication.
For example, if we try to access following endpoint GET https://cloud.mongodb.com/api/atlas/v1.0/groups/{GROUP-ID}/processes/{HOST}:{PORT}/measurements we get the following error.

{"detail": "You are not authorized for this resource.", "error": 401, "reason": "Unauthorized"}

To access this endpoint we can perform the following curl command.

curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --header "Content-Type: application/json" \ --include \ --request GET "https://cloud.mongodb.com/api/atlas/v1.0/groups/{GROUP-ID}/processes/{HOST}:{PORT}/measurements?granularity=PT1M&period=PT1M&pretty=true"

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 19, 2023
@kush-elastic kush-elastic added enhancement Filebeat Filebeat and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 19, 2023
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 19, 2023
@efd6
Copy link
Contributor

efd6 commented May 19, 2023

@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@andrewkroh
Copy link
Member

@efd6 and I talked about this feature. One idea I had was to move the digest auth handling into the HTTP transport code. For the most part the CEL program would not need to be concerned with it authentication. The user would add the digest creds to the input config.

I found some discussion about this http.Transport approach in golang/go#29409.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants