github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

fix(security, http): expose authentication headers in the authentication result when HTTP authentication is used (#190998)

Browse source 
## Summary

When Kibana tries to authenticate a request that already has an
`Authorization` header (not a cookie, client certificate, or Kerberos
ticket), the authentication is performed by the [HTTP authentication
provider](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#http-authentication).

Unlike session/Kerberos/PKI providers, this provider returns an
authentication result that doesn't explicitly tell Core which
authorization headers should be used (e.g., `t.authenticated({ state:
authenticationResult.user, --> requestHeaders:
authenticationResult.authHeaders <-- ... });`), assuming that Core will
just use the headers from the request. The `Authorization` header is
forwarded to Elasticsearch by default, no additional configuration is
required.

This worked well previously, but I think with the introduction of the
the
[`getSecondaryAuthHeaders`](https://github.com/elastic/kibana/pull/184901)
method this is the first time where this assumption doesn't hold.
Internally, this method tries to reuse authentication headers that were
provided to Core by the authentication provider during the request
authentication stage — headers that the HTTP authentication provider
never provided before.

This PR makes the HTTP authentication provider behave consistently with
the rest of the providers we support today.
This commit is contained in:
Aleh Zasypkin 2024-08-22 09:48:35 +02:00 • committed by GitHub
parent 29a45fc645
commit 3ac931fb79
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 21 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

32
x-pack/plugins/security/server/authentication/providers/http.test.ts
View file

@ -133,10 +133,10 @@ describe('HTTPAuthenticationProvider', () => {
});
await expect(provider.authenticate(request)).resolves.toEqual(
AuthenticationResult.succeeded({
...user,
authentication_provider: { type: 'http', name: 'http' },
})
AuthenticationResult.succeeded(
{ ...user, authentication_provider: { type: 'http', name: 'http' } },
{ authHeaders: { authorization: header } }
)
);
expectAuthenticateCall(mockOptions.client, { headers: { authorization: header } });
@ -160,10 +160,10 @@ describe('HTTPAuthenticationProvider', () => {
});
await expect(provider.authenticate(request)).resolves.toEqual(
AuthenticationResult.succeeded({
...user,
authentication_provider: { type: 'http', name: 'http' },
})
AuthenticationResult.succeeded(
{ ...user, authentication_provider: { type: 'http', name: 'http' } },
{ authHeaders: { authorization: header } }
)
);
expectAuthenticateCall(mockOptions.client, { headers: { authorization: header } });
@ -187,10 +187,10 @@ describe('HTTPAuthenticationProvider', () => {
});
await expect(provider.authenticate(request)).resolves.toEqual(
AuthenticationResult.succeeded({
...user,
authentication_provider: { type: 'http', name: 'http' },
})
AuthenticationResult.succeeded(
{ ...user, authentication_provider: { type: 'http', name: 'http' } },
{ authHeaders: { authorization: header } }
)
);
expectAuthenticateCall(mockOptions.client, { headers: { authorization: header } });
@ -217,10 +217,10 @@ describe('HTTPAuthenticationProvider', () => {
});
await expect(provider.authenticate(request)).resolves.toEqual(
AuthenticationResult.succeeded({
...user,
authentication_provider: { type: 'http', name: 'http' },
})
AuthenticationResult.succeeded(
{ ...user, authentication_provider: { type: 'http', name: 'http' } },
{ authHeaders: { authorization: header } }
)
);
expectAuthenticateCall(mockOptions.client, { headers: { authorization: header } });

6
x-pack/plugins/security/server/authentication/providers/http.ts
View file

@ -113,7 +113,11 @@ export class HTTPAuthenticationProvider extends BaseAuthenticationProvider {
return AuthenticationResult.notHandled();
}
return AuthenticationResult.succeeded(user);
return AuthenticationResult.succeeded(user, {
// Even though the `Authorization` header is already present in the HTTP headers of the original request,
// we still need to expose it to the Core authentication service for consistency.
authHeaders: { authorization: authorizationHeader.toString() },
});
} catch (err) {
this.logger.debug(
() =>