github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 01:13:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

Change token auth provider usage of created to invaliated_tokens (#27614)

Browse source
This commit is contained in:
Brandon Kobel 2019-01-10 10:23:59 -08:00 • committed by GitHub
parent 8361b82f4f
commit ff5b0e8dfb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
x-pack/plugins/security/server/lib/authentication/providers/__tests__/token.js
View file

@ -424,7 +424,7 @@ describe('TokenAuthenticationProvider', () => {
callWithInternalUser
.withArgs('shield.deleteAccessToken', { body: { token: accessToken } })
.returns({ created: true });
.returns({ invalidated_tokens: 1 });
const failureReason = new Error('failed to delete token');
callWithInternalUser
@ -451,11 +451,11 @@ describe('TokenAuthenticationProvider', () => {
callWithInternalUser
.withArgs('shield.deleteAccessToken', { body: { token: accessToken } })
.returns({ created: true });
.returns({ invalidated_tokens: 1 });
callWithInternalUser
.withArgs('shield.deleteAccessToken', { body: { refresh_token: refreshToken } })
.returns({ created: true });
.returns({ invalidated_tokens: 1 });
const authenticationResult = await provider.deauthenticate(request, { accessToken, refreshToken });

20
x-pack/plugins/security/server/lib/authentication/providers/token.js
View file

@ -119,27 +119,35 @@ export class TokenAuthenticationProvider {
try {
// First invalidate the access token.
const { created: deletedAccessToken } = await this._options.client.callWithInternalUser(
const { invalidated_tokens: invalidatedAccessTokensCount } = await this._options.client.callWithInternalUser(
'shield.deleteAccessToken',
{ body: { token: state.accessToken } }
);
if (deletedAccessToken) {
if (invalidatedAccessTokensCount === 0) {
this._options.log(['debug', 'security', 'token'], 'User access token was already invalidated.');
} else if (invalidatedAccessTokensCount === 1) {
this._options.log(['debug', 'security', 'token'], 'User access token has been successfully invalidated.');
} else {
this._options.log(['debug', 'security', 'token'], 'User access token was already invalidated.');
this._options.log(['debug', 'security', 'token'],
`${invalidatedAccessTokensCount} user access tokens were invalidated, this is unexpected.`
);
}
// Then invalidate the refresh token.
const { created: deletedRefreshToken } = await this._options.client.callWithInternalUser(
const { invalidated_tokens: invalidatedRefreshTokensCount } = await this._options.client.callWithInternalUser(
'shield.deleteAccessToken',
{ body: { refresh_token: state.refreshToken } }
);
if (deletedRefreshToken) {
if (invalidatedRefreshTokensCount === 0) {
this._options.log(['debug', 'security', 'token'], 'User refresh token was already invalidated.');
} else if (invalidatedRefreshTokensCount === 1) {
this._options.log(['debug', 'security', 'token'], 'User refresh token has been successfully invalidated.');
} else {
this._options.log(['debug', 'security', 'token'], 'User refresh token was already invalidated.');
this._options.log(['debug', 'security', 'token'],
`${invalidatedRefreshTokensCount} user refresh tokens were invalidated, this is unexpected.`
);
}
return DeauthenticationResult.redirectTo(