github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Sets logout and saml callback APIs as public in serverless (#162523)

Browse source 
Subset of #161337
Unblocks #162149

## Summary

This PR uses the access 'public' option when registering the `GET
/api/security/logout` and `POST /api/security/saml/callback` APIs. This
will ensure they have public access in serverless, while all other APIs
will default to internal. PR #161672 changes default access of
registered endpoints to 'internal', meaning that API owners have to
explicitly set access: public to pass the API protection restriction.

This PR also adds internal headers to the existing serverless Spaces API
tests. This unblocks the PR to enable API protection in serverless
(#162149).

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Jeramy Soucy 2023-07-26 08:51:02 -04:00 • committed by GitHub
parent 32b5903f92
commit e8a705e454
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
x-pack/plugins/security/server/routes/authentication/common.test.ts
View file

@ -66,6 +66,7 @@ describe('Common authentication routes', () => {
it('correctly defines route.', async () => {
expect(routeConfig.options).toEqual({
access: 'public',
authRequired: false,
tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
});

6
x-pack/plugins/security/server/routes/authentication/common.ts
View file

@ -41,7 +41,11 @@ export function defineCommonRoutes({
// Allow unknown query parameters as this endpoint can be hit by the 3rd-party with any
// set of query string parameters (e.g. SAML/OIDC logout request/response parameters).
validate: { query: schema.object({}, { unknowns: 'allow' }) },
options: { authRequired: false, tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW] },
options: {
access: 'public',
authRequired: false,
tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],
},
},
async (context, request, response) => {
const serverBasePath = basePath.serverBasePath;

1
x-pack/plugins/security/server/routes/authentication/saml.test.ts
View file

@ -54,6 +54,7 @@ describe('SAML authentication routes', () => {
it('correctly defines route.', () => {
expect(routeConfig.options).toEqual({
access: 'public',
authRequired: false,
xsrfRequired: false,
tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],

1
x-pack/plugins/security/server/routes/authentication/saml.ts
View file

@ -32,6 +32,7 @@ export function defineSAMLRoutes({
),
},
options: {
access: 'public',
authRequired: false,
xsrfRequired: false,
tags: [ROUTE_TAG_CAN_REDIRECT, ROUTE_TAG_AUTH_FLOW],

9
x-pack/test_serverless/api_integration/services/svl_common_api.ts
View file

@ -13,12 +13,21 @@ const COMMON_REQUEST_HEADERS = {
'kbn-xsrf': 'some-xsrf-token',
};
const INTERNAL_REQUEST_HEADERS = {
...COMMON_REQUEST_HEADERS,
'x-elastic-internal-origin': 'kibana',
};
export function SvlCommonApiServiceProvider({}: FtrProviderContext) {
return {
getCommonRequestHeader() {
return COMMON_REQUEST_HEADERS;
},
getInternalRequestHeader() {
return INTERNAL_REQUEST_HEADERS;
},
assertResponseStatusCode(expectedStatus: number, actualStatus: number, responseBody: object) {
expect(actualStatus).to.eql(
expectedStatus,

4
x-pack/test_serverless/api_integration/test_suites/common/spaces.ts
View file

@ -16,7 +16,7 @@ export default function ({ getService }: FtrProviderContext) {
it('rejects request to create a space', async () => {
const { body, status } = await supertest
.post('/api/spaces/space')
.set(svlCommonApi.getCommonRequestHeader())
.set(svlCommonApi.getInternalRequestHeader())
.send({
id: 'custom',
name: 'Custom',
@ -36,7 +36,7 @@ export default function ({ getService }: FtrProviderContext) {
it('rejects request to update a space with disabledFeatures', async () => {
const { body, status } = await supertest
.put('/api/spaces/space/default')
.set(svlCommonApi.getCommonRequestHeader())
.set(svlCommonApi.getInternalRequestHeader())
.send({
id: 'custom',
name: 'Custom',