github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

Adjust validation for OIDC endpoint (#37304)

Browse source 
This change adjusts validation of query parameters in the
/api/security/v1/oidc endpoint. It was discovered during manual
testing that Google's OP is sending extra parameters than the ones
identified in https://tools.ietf.org/html/rfc6749#section-4.1.2
which is refernced by
https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
(for instance auth_user and session_state). The existing validation
rules only allowed the expected query parameters but this
means that Kibana wouldn't be able to complete OpenID Connect
authentication with Google acting as the OP.
As dictated in the standard (RFC6749), "The client MUST ignore
unrecognized response parameters." so we should allow but discard
any extra parameters we do not recognize and not throw an error.
Furthermore, it adds stricter validation for the issuer and all
pararameters of type URI when these are present.
This commit is contained in:
Ioannis Kakavas 2019-05-29 09:30:58 +03:00 • committed by GitHub
parent 5a66d9b225
commit 8234b566bc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

48
x-pack/plugins/security/server/routes/api/v1/authenticate.js
View file

@ -72,21 +72,22 @@ export function initAuthenticateApi(server) {
});
server.route({
method: 'GET',
// POST is only allowed for Third Party initiated authentication
method: ['GET', 'POST'],
path: '/api/security/v1/oidc',
config: {
auth: false,
validate: {
query: Joi.object().keys({
iss: Joi.string(),
iss: Joi.string().uri({ scheme: 'https' }),
login_hint: Joi.string(),
target_link_uri: Joi.string(),
target_link_uri: Joi.string().uri(),
code: Joi.string(),
error: Joi.string(),
error_description: Joi.string(),
error_uri: Joi.string(),
error_uri: Joi.string().uri(),
state: Joi.string()
})
}).unknown()
}
},
async handler(request, h) {
@ -112,43 +113,6 @@ export function initAuthenticateApi(server) {
}
});
server.route({
// POST is only allowed for Third Party initiated authentication
method: 'POST',
path: '/api/security/v1/oidc',
config: {
auth: false,
validate: {
query: Joi.object().keys({
iss: Joi.string(),
login_hint: Joi.string(),
target_link_uri: Joi.string()
})
}
},
async handler(request, h) {
try {
// We handle the fact that the user might get redirected to Kibana while already having an session
// in the same exact manner as with saml. Return an error notifying the user they are already logged in.
const authenticationResult = await server.plugins.security.authenticate(request);
if (authenticationResult.succeeded()) {
return Boom.forbidden(
'Sorry, you already have an active Kibana session. ' +
'If you want to start a new one, please logout from the existing session first.'
);
}
if (authenticationResult.redirected()) {
return h.redirect(authenticationResult.redirectURL);
}
throw Boom.unauthorized(authenticationResult.error);
} catch (err) {
throw wrapError(err);
}
}
});
server.route({
method: 'GET',
path: '/api/security/v1/logout',