From 8234b566bcba55b3486021ba5fb076bc0a3232d4 Mon Sep 17 00:00:00 2001
From: Ioannis Kakavas <ioannis@elastic.co>
Date: Wed, 29 May 2019 09:30:58 +0300
Subject: [PATCH] Adjust validation for OIDC endpoint (#37304)

This change adjusts validation of query parameters in the
/api/security/v1/oidc endpoint. It was discovered during manual
testing that Google's OP is sending extra parameters than the ones
identified in https://tools.ietf.org/html/rfc6749#section-4.1.2
which is refernced by
https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
(for instance auth_user and session_state). The existing validation
rules only allowed the expected query parameters but this
means that Kibana wouldn't be able to complete OpenID Connect
authentication with Google acting as the OP.
As dictated in the standard (RFC6749), "The client MUST ignore
unrecognized response parameters." so we should allow but discard
any extra parameters we do not recognize and not throw an error.
Furthermore, it adds stricter validation for the issuer and all
pararameters of type URI when these are present.
---
 .../server/routes/api/v1/authenticate.js      | 48 +++----------------
 1 file changed, 6 insertions(+), 42 deletions(-)

diff --git a/x-pack/plugins/security/server/routes/api/v1/authenticate.js b/x-pack/plugins/security/server/routes/api/v1/authenticate.js
index b9423c3ec2d8..e24b31039b9c 100644
--- a/x-pack/plugins/security/server/routes/api/v1/authenticate.js
+++ b/x-pack/plugins/security/server/routes/api/v1/authenticate.js
@@ -72,21 +72,22 @@ export function initAuthenticateApi(server) {
   });
 
   server.route({
-    method: 'GET',
+    // POST is only allowed for Third Party initiated authentication
+    method: ['GET', 'POST'],
     path: '/api/security/v1/oidc',
     config: {
       auth: false,
       validate: {
         query: Joi.object().keys({
-          iss: Joi.string(),
+          iss: Joi.string().uri({ scheme: 'https' }),
           login_hint: Joi.string(),
-          target_link_uri: Joi.string(),
+          target_link_uri: Joi.string().uri(),
           code: Joi.string(),
           error: Joi.string(),
           error_description: Joi.string(),
-          error_uri: Joi.string(),
+          error_uri: Joi.string().uri(),
           state: Joi.string()
-        })
+        }).unknown()
       }
     },
     async handler(request, h) {
@@ -112,43 +113,6 @@ export function initAuthenticateApi(server) {
     }
   });
 
-  server.route({
-    // POST is only allowed for Third Party initiated authentication
-    method: 'POST',
-    path: '/api/security/v1/oidc',
-    config: {
-      auth: false,
-      validate: {
-        query: Joi.object().keys({
-          iss: Joi.string(),
-          login_hint: Joi.string(),
-          target_link_uri: Joi.string()
-        })
-      }
-    },
-    async handler(request, h) {
-      try {
-        // We handle the fact that the user might get redirected to Kibana while already having an session
-        // in the same exact manner as with saml. Return an error notifying the user they are already logged in.
-        const authenticationResult = await server.plugins.security.authenticate(request);
-        if (authenticationResult.succeeded()) {
-          return Boom.forbidden(
-            'Sorry, you already have an active Kibana session. ' +
-            'If you want to start a new one, please logout from the existing session first.'
-          );
-        }
-
-        if (authenticationResult.redirected()) {
-          return h.redirect(authenticationResult.redirectURL);
-        }
-
-        throw Boom.unauthorized(authenticationResult.error);
-      } catch (err) {
-        throw wrapError(err);
-      }
-    }
-  });
-
   server.route({
     method: 'GET',
     path: '/api/security/v1/logout',