Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

azasypkin · 2023-08-14T13:07:47Z

Summary

Allow Kibana to restrict the usage of JWT for a predefined set of routes only in Serverless environment by default. This capability is not available in non-Serverless environment.

Any route that needs to be accessed in Serverless environemnt using JWT as a means of authentication should include security:acceptJWT tag.

How to test

If you'd like to generate your own JWT to test the PR, please follow the steps outlined in #159117 (comment) or just run functional test server and use static JWT from the Serverless test.

This PR also generated a Serverless Docker image that you can use in your Dev/QA MKI cluster.

Implementation functionality and add unit tests
Update metrics/status routes to include new security:acceptJWT tag
Update serverless test suite to include a test for security:acceptJWT

Fixes: #162632

azasypkin · 2023-08-15T08:00:29Z

packages/core/status/core-status-server-internal/src/routes/status.ts

+        // The `api` tag ensures that unauthenticated calls receive a 401 rather than a 302 redirect to login page.
+        // The `security:acceptJWT` tag allows route to be accessed with JWT credentials. It points to
+        // ROUTE_TAG_ACCEPT_JWT from '@kbn/security-plugin/server' that cannot be imported here directly.
+        tags: ['api', 'security:acceptJWT'],


note: I couldn't find a way to not hard-code string defined in x-pack security plugin here apart from moving these constants to a dedicated package or common (but logically it's not common so ..)?

…tes only.

azasypkin · 2023-08-15T15:21:37Z

Hey @legrego, I don't have integration tests yet, so it's not ready for a full review. However, it would be great to hear your thoughts on the approach in general. Thank you!

legrego

General approach LGTM, I left a couple of questions below

legrego · 2023-08-15T16:21:15Z

x-pack/plugins/security/server/authentication/providers/http.ts

+      // If Kibana is configured to restrict JWT authentication only to selected routes, ensure that the route is marked
+      // with the `ROUTE_TAG_ACCEPT_JWT` tag to bypass that restriction.
+      if (
+        user.authentication_realm.type === JWT_REALM_TYPE &&
+        this.jwt?.taggedRoutesOnly &&
+        !request.route.options.tags.includes(ROUTE_TAG_ACCEPT_JWT)
+      ) {
+        this.logger.error(
+          `Attempted to authenticate with JWT credentials against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +
+            `Ensure that the route is defined with the "${ROUTE_TAG_ACCEPT_JWT}" tag.`
+        );
+        return AuthenticationResult.notHandled();
+      }


I'm torn on the location & timing of this check. This will allow a user to attempt JWT auth for disallowed routes, incurring unnecessary overhead (which may or may not matter). It also gives us different behavior in the failure scenario where the user presents an invalid JWT (catch block below), as we are relying on the successful auth attempt to detect if it should be allowed or not.

Performing this check earlier in the lifecycle would require us to inspect the shape of the Bearer token that we receive, to see if it looks like a JWT or not. That feels more fragile to me, but it eliminates the round-trip to ES. The fragility might be tolerable since this is scoped only to serverless, where we have full control over the types of values we accept in the Authorization header; In serverless, it'll only ever be one of [API Key, ES Token, JWT], whereas on-prem may be configured with a custom realm that we aren't equipped to detect.

I don't have a definitive opinion at this point, but I wanted to start a discussion to see how you/the team felt.

This will allow a user to attempt JWT auth for disallowed routes, incurring unnecessary overhead (which may or may not matter)

I'm not particularly concerned about this aspect. If someone truly wishes to introduce overhead to the cluster, they can already achieve that by using a custom SAMLResponse XML document, which could be large and/or expensive to decode. Unfortunately, there's not much we can do to mitigate this.

In fact, I can even see the benefit. This way, we'll catch all (expected and unexpected) authentication attempts in the Elasticsearch audit logs, together with all other authentication related audit logs. It might help us to spot this suspicious activity early on. What do you think?

It also gives us different behavior in the failure scenario where the user presents an invalid JWT (catch block below), as we are relying on the successful auth attempt to detect if it should be allowed or not.

I believe we'll only have different logs, the user will get the same 401 Unauthorized in both cases, or do you mean something else?

In fact, I can even see the benefit. This way, we'll catch all (expected and unexpected) authentication attempts in the Elasticsearch audit logs, together with all other authentication related audit logs. It might help us to spot this suspicious activity early on. What do you think?

I think you've convinced me. Sounds good!

I believe we'll only have different logs, the user will get the same 401 Unauthorized in both cases, or do you mean something else?

Correct, just different logs

I think you've convinced me. Sounds good!

Great, thanks!

legrego · 2023-08-15T16:22:42Z

x-pack/plugins/security/server/authentication/providers/http.ts

+          `Attempted to authenticate with JWT credentials against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +
+            `Ensure that the route is defined with the "${ROUTE_TAG_ACCEPT_JWT}" tag.`


question What do you think about logging a small portion of the JWT in this message? Thinking about supportability, it might be nice to know if a specific token is being used, and having a fragment of that token in the log message could help with this.

Yeah, it's a good idea, I can log some port of the signature (n-last characters, since n-first characters, header, will be the same most of the time).

azasypkin · 2023-08-17T08:04:11Z

.github/CODEOWNERS

@@ -594,7 +594,7 @@ packages/kbn-search-api-panels @elastic/enterprise-search-frontend
 examples/search_examples @elastic/kibana-data-discovery
 packages/kbn-search-response-warnings @elastic/kibana-data-discovery
 x-pack/plugins/searchprofiler @elastic/platform-deployment-management
-x-pack/test/security_api_integration/packages/helpers @elastic/kibana-core
+x-pack/test/security_api_integration/packages/helpers @elastic/kibana-security


note: not sure why the Core team owned this initially...

azasypkin · 2023-08-17T08:06:56Z

x-pack/plugins/security/server/authentication/providers/http.ts

+        // Log a portion of the JWT signature to make debugging easier.
+        const jwtExcerpt = authorizationHeader.credentials.slice(-10);
+        this.logger.error(
+          `Attempted to authenticate with JWT credentials (${jwtExcerpt}…) against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +


note to myself: it should be

Suggested change

`Attempted to authenticate with JWT credentials (${jwtExcerpt}…) against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +

`Attempted to authenticate with JWT credentials (…${jwtExcerpt}) against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +

azasypkin · 2023-08-17T08:08:57Z

x-pack/test_serverless/api_integration/test_suites/common/security_authentication_http.ts

+  describe('#security/authentication/http', function () {
+    it('allows JWT HTTP authentication only for selected routes', async () => {
+      const jsonWebToken =
+        'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpYmFuYS5lbGFzdGljLmNvL2p3dC8iLCJzdWIiOiJlbGFzdGljLWFnZW50IiwiYXVkIjoiZWxhc3RpY3NlYXJjaCIsIm5hbWUiOiJFbGFzdGljIEFnZW50IiwiaWF0Ijo5NDY2ODQ4MDAsImV4cCI6NDA3MDkwODgwMH0.P7RHKZlLskS5DfVRqoVO4ivoIq9rXl2-GW6hhC9NvTSkwphYivcjpTVcyENZvxTTvJJNqcyx6rF3T-7otTTIHBOZIMhZauc5dob-sqcN_mT2htqm3BpSdlJlz60TBq6diOtlNhV212gQCEJMPZj0MNj7kZRj_GsECrTaU7FU0A3HAzkbdx15vQJMKZiFbbQCVI7-X2J0bZzQKIWfMHD-VgHFwOe6nomT-jbYIXtCBDd6fNj1zTKRl-_uzjVqNK-h8YW1h6tE4xvZmXyHQ1-9yNKZIWC7iEaPkBLaBKQulLU5MvW3AtVDUhzm6--5H1J85JH5QhRrnKYRon7ZW5q1AQ';


note: this test token will expire on Jan 01, 2099 (you can check at https://jwt.io/).

azasypkin · 2023-08-17T08:11:03Z

x-pack/test_serverless/api_integration/test_suites/common/security_authentication_http.ts

+        '/api/status',
+        '/api/stats',
+        '/api/task_manager/_background_task_utilization',
+        '/internal/task_manager/_background_task_utilization',
+        '/api/task_manager/metrics',


question: @elastic/kibana-core @elastic/response-ops are these the only endpoints that need to be accessed in MKI by our o11y services?

elasticmachine · 2023-08-17T08:11:13Z

Pinging @elastic/kibana-security (Team:Security)

azasypkin · 2023-08-17T08:11:47Z

x-pack/test_serverless/shared/config.base.ts

+        'xpack.security.authc.realms.file.file1.order=-100',
+
+        'xpack.security.authc.realms.native.native1.order=-99',
+
+        'xpack.security.authc.realms.jwt.jwt1.order=-98',


note: copied order from the actual order we use for these realms in MKI, just in case.

pgayvallet

tags on core owned routes LGTM

pheyos

Serverless test area changes LGTM

pmuellr

ResponseOps changes LGTM

kc13greiner

LGTM! Just one JWT question, but my test may be invalid

x-pack/test_serverless/api_integration/test_suites/common/security_authentication_http.ts

kibana-ci · 2023-08-23T11:35:06Z

💚 Build Succeeded

Buildkite Build
Commit: 9be952d
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-163806-9be952d7ab4c

Metrics [docs]

Canvas Sharable Runtime

The Canvas "shareable runtime" is an bundle produced to enable running Canvas workpads outside of Kibana. This bundle is included in third-party webpages that embed canvas and therefor should be as slim as possible.

id	before	after	diff
`module count`	-	5578	+5578
`total size`	-	6.1MB	+6.1MB

History

💚 Build #152329 succeeded da74429
💚 Build #151058 succeeded 57df1f1
💚 Build #150421 succeeded 120de73
💔 Build #150412 failed e7fa68b633a01cc1f5eada5b23bc5e266770c264
💔 Build #150089 failed 0a41a33064ed425bf452601207ae920dcb7ee7e0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @azasypkin

kc13greiner

LGTM!

…t of routes only. (elastic#163806)" This reverts commit 5aee5da.

…fined set of routes only. (elastic#163806)"" This reverts commit 033fbbd.

azasypkin force-pushed the issue-162632-restrict-jwt branch 2 times, most recently from 0a41a33 to e7fa68b Compare August 15, 2023 07:56

azasypkin self-assigned this Aug 15, 2023

azasypkin commented Aug 15, 2023

View reviewed changes

Allow Kibana to restrict the usage of JWT for a predefined set of rou…

120de73

…tes only.

azasypkin force-pushed the issue-162632-restrict-jwt branch from e7fa68b to 120de73 Compare August 15, 2023 08:24

azasypkin requested a review from legrego August 15, 2023 15:20

legrego reviewed Aug 15, 2023

View reviewed changes

azasypkin and others added 4 commits August 16, 2023 11:09

Merge branch 'main' into issue-162632-restrict-jwt

f8af741

Review#1: log excerpt of JWT in error message, add more tests.

865b242

Merge branch 'main' into issue-162632-restrict-jwt

4fabe03

[CI] Auto-commit changed files from 'node scripts/generate codeowners'

57df1f1

azasypkin commented Aug 17, 2023

View reviewed changes

azasypkin marked this pull request as ready for review August 17, 2023 08:11

azasypkin requested review from a team as code owners August 17, 2023 08:11

azasypkin commented Aug 17, 2023

View reviewed changes

pgayvallet approved these changes Aug 21, 2023

View reviewed changes

azasypkin added 2 commits August 22, 2023 14:08

Merge branch 'main' into issue-162632-restrict-jwt

46fceda

Merge upstream changes.

da74429

pheyos approved these changes Aug 22, 2023

View reviewed changes

kc13greiner self-requested a review August 22, 2023 15:34

pmuellr approved these changes Aug 22, 2023

View reviewed changes

kc13greiner reviewed Aug 22, 2023

View reviewed changes

x-pack/test_serverless/api_integration/test_suites/common/security_authentication_http.ts Outdated Show resolved Hide resolved

azasypkin requested a review from kc13greiner August 23, 2023 08:35

Merge branch 'main' into issue-162632-restrict-jwt

9be952d

kc13greiner approved these changes Aug 23, 2023

View reviewed changes

azasypkin merged commit 5aee5da into elastic:main Aug 23, 2023

azasypkin deleted the issue-162632-restrict-jwt branch August 23, 2023 12:57

kibanamachine added the v8.11.0 label Aug 23, 2023

mistic added a commit to Ikuni17/kibana that referenced this pull request Aug 24, 2023

Revert "Allow Kibana to restrict the usage of JWT for a predefined se…

033fbbd

…t of routes only. (elastic#163806)" This reverts commit 5aee5da.

mistic added a commit to Ikuni17/kibana that referenced this pull request Aug 25, 2023

Revert "Revert "Allow Kibana to restrict the usage of JWT for a prede…

584e666

…fined set of routes only. (elastic#163806)"" This reverts commit 033fbbd.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

azasypkin commented Aug 14, 2023 •

edited

Loading

azasypkin Aug 15, 2023 •

edited

Loading

azasypkin commented Aug 15, 2023

legrego left a comment

legrego Aug 15, 2023

azasypkin Aug 16, 2023

legrego Aug 16, 2023

azasypkin Aug 16, 2023

legrego Aug 15, 2023

azasypkin Aug 16, 2023

azasypkin Aug 17, 2023

azasypkin Aug 17, 2023

azasypkin Aug 17, 2023 •

edited

Loading

azasypkin Aug 17, 2023

elasticmachine commented Aug 17, 2023

azasypkin Aug 17, 2023

pgayvallet left a comment

pheyos left a comment

pmuellr left a comment

kc13greiner left a comment

kibana-ci commented Aug 23, 2023 •

edited

Loading

kc13greiner left a comment

		`Attempted to authenticate with JWT credentials against ${request.url.pathname}${request.url.search}, but it's not allowed. ` +
		`Ensure that the route is defined with the "${ROUTE_TAG_ACCEPT_JWT}" tag.`

Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

Allow Kibana to restrict the usage of JWT for a predefined set of routes only. #163806

Conversation

azasypkin commented Aug 14, 2023 • edited Loading

Summary

How to test

azasypkin Aug 15, 2023 • edited Loading

Choose a reason for hiding this comment

azasypkin commented Aug 15, 2023

legrego left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin Aug 17, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Aug 17, 2023

Choose a reason for hiding this comment

pgayvallet left a comment

Choose a reason for hiding this comment

pheyos left a comment

Choose a reason for hiding this comment

pmuellr left a comment

Choose a reason for hiding this comment

kc13greiner left a comment

Choose a reason for hiding this comment

kibana-ci commented Aug 23, 2023 • edited Loading

💚 Build Succeeded

Metrics [docs]

Canvas Sharable Runtime

History

kc13greiner left a comment

Choose a reason for hiding this comment

azasypkin commented Aug 14, 2023 •

edited

Loading

azasypkin Aug 15, 2023 •

edited

Loading

azasypkin Aug 17, 2023 •

edited

Loading

kibana-ci commented Aug 23, 2023 •

edited

Loading