Add REST handler for PKI delegation #44561

albertzaharovits · 2019-07-18T12:19:03Z

Adds a REST action for the TransportDelegatePkiAuthenticationAction,

EDITED:
the corresponding HL Rest client methods (with tests) and a certificate chain for tests.

EDITED 2:
Please review #44767 before this one.

Follow-up of #44106
Relates #34396

elasticmachine · 2019-07-18T12:19:05Z

Pinging @elastic/es-security

bizybot

LGTM, Thank you.

...n/java/org/elasticsearch/xpack/security/action/TransportDelegatePkiAuthenticationAction.java

albertzaharovits · 2019-07-22T22:34:43Z

client/rest-high-level/build.gradle

  from({ zipTree(configurations.restSpec.singleFile) }) {
    include 'rest-api-spec/api/**'
  }
+  from(project(':client:rest-high-level').file('src/test/resources'))


I have added a certificate chain ( testClient.crt, testIntermediateCA.crt and testRootCA.crt files) as resources to these two projects.

client/rest-high-level/src/main/java/org/elasticsearch/client/SecurityClient.java

albertzaharovits · 2019-07-22T22:40:10Z

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java

+    }

-    private X509Certificate[] certificates;
+    private List<X509Certificate> certificateChain;


made it a list instead of an array.

albertzaharovits · 2019-07-22T22:42:27Z

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java

+ * The request object for {@code TransportDelegatePkiAuthenticationAction} containing the certificate chain for the target subject
+ * distinguished name to be granted an access token.
+ */
+public final class DelegatePkiAuthenticationRequest extends ActionRequest implements ToXContentObject {


Implements ToXContentObject because it is easier on tests (instead of parsing it as a map, and iterating over an array).

…ler-2

albertzaharovits · 2019-07-23T19:59:06Z

Please review #44767 before this one :)

…ler-2

albertzaharovits · 2019-07-24T13:07:08Z

@elasticmachine run elasticsearch-ci/2

(Failure is legit but is handled in #44767)

…ler-2

bizybot

Overall LGTM.
It would have been better if we took HLRC changes in separate PR, just something that we can do in the future. Thank you.

client/rest-high-level/src/main/java/org/elasticsearch/client/SecurityClient.java

...n/java/org/elasticsearch/xpack/security/action/TransportDelegatePkiAuthenticationAction.java

docs/java-rest/high-level/security/delegate-pki-authentication.asciidoc

bizybot · 2019-07-26T00:25:30Z

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java

+    private static final ParseField X509_CERTIFICATE_CHAIN_FIELD = new ParseField("x509_certificate_chain");
+
+    public static final ConstructingObjectParser<DelegatePkiAuthenticationRequest, Void> PARSER = new ConstructingObjectParser<>(
+            "delegate_pki_request", true, a -> {


we are parsing request here which accepts unknown field. We should be generally not accepting unknown fields for request, is there a reason to accept unknown fields?

I was not aware that we have reached a guideline on this matter. My impression is we should always ignore unknown fields, unless there is a problem with it. Maybe @hub-cap is up to date with the recommendation, and can help us decide.

In the interest of time, I have pushed the changes as suggested, because I do not see the reason to ignore unknown fields, in the absence of a general imposition.

My understanding was for the request we do not ignore unknown fields but for the response(ex. in HLRC) we would ignore unknown fields.

bizybot · 2019-07-26T00:26:31Z

...src/test/java/org/elasticsearch/xpack/core/action/DelegatePkiAuthenticationRequestTests.java

+
+    @Override
+    protected boolean supportsUnknownFields() {
+        return true;


as per my comment on accepting unknown fields in the request, if it need not be true then this would become false.

Subsumed by #44561 (comment)

….asciidoc Co-Authored-By: Yogesh Gaikwad <[email protected]>

…ler-2

albertzaharovits · 2019-07-29T10:46:56Z

@bizybot I have addressed your reviews. Thanks!
@tvernum may you please take a look as well?

albertzaharovits · 2019-07-29T12:01:40Z

@elasticmachine run elasticsearch-ci/1

bizybot

LGTM, other than nits. Thank you.

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java

...curity/src/main/java/org/elasticsearch/xpack/security/authc/pki/X509AuthenticationToken.java

...-level/src/main/java/org/elasticsearch/client/security/DelegatePkiAuthenticationRequest.java

...high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java

...-high-level/src/test/resources/org/elasticsearch/client/security/delegate_pki/testClient.csr

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java

tvernum · 2019-07-31T08:40:30Z

...n/java/org/elasticsearch/xpack/security/rest/action/RestDelegatePkiAuthenticationAction.java

+
+    public RestDelegatePkiAuthenticationAction(Settings settings, RestController controller, XPackLicenseState xPackLicenseState) {
+        super(settings, xPackLicenseState);
+        controller.registerHandler(POST, "/_security/delegate_pki", this);


Is there any background to your choice of URL here?
It seems a bit weird to me, I'd expect something with a bit more structure to it so that we have space to add additional endpoints in the future.

No serious thought, I admit. But I don't think it can be rooted under existing namespaces.
Rather than trying to anticipate future similar endpoints that this can be namespaced with, we can deprecate this endpoint path and add a new path once we know the namespace. What do you think? I don't really have a preference for this one either.

Fair enough. I think /_security/pki/delegate would be neater, but you're right that it's likely that Kibana would be the only major client of this API so deprecate & replace could be a simple solution when we need it.

...n/java/org/elasticsearch/xpack/security/rest/action/RestDelegatePkiAuthenticationAction.java

albertzaharovits · 2019-07-31T13:26:29Z

Thanks for the detailed review!
I have addressed all your points @tvernum , so this is ready for another round.

albertzaharovits · 2019-07-31T13:28:53Z

didn't update the UI after my last push. I hope it comes to its senses.

…ler-2

albertzaharovits added >feature :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Jul 18, 2019

albertzaharovits self-assigned this Jul 18, 2019

albertzaharovits requested review from bizybot and tvernum July 18, 2019 12:19

REST handler & javadoc

9758afb

albertzaharovits force-pushed the security-pki-delegation-add-rest-handler branch from 0f361c9 to 9758afb Compare July 18, 2019 12:28

@code not @link between projects

9d6eac1

albertzaharovits mentioned this pull request Jul 18, 2019

PKI Authentication Delegation in new endpoint #43796

Closed

Nits

b178f63

bizybot approved these changes Jul 19, 2019

View reviewed changes

...n/java/org/elasticsearch/xpack/security/action/TransportDelegatePkiAuthenticationAction.java Outdated Show resolved Hide resolved

albertzaharovits added 13 commits July 19, 2019 16:40

X509 chain

05b5209

Delegate PKI request and response

48e439c

DelegatePkiAuthenticationRequestTests

56591f5

PkiAuthDelegationIntegTests

d18b34f

PkiAuthnDeleg nits

f251bb2

Rest high level WIP

b5a52ed

WIP

91a034a

DelegatePkiAuthenticationRequestTests

e9df4a4

DelegatePkiAuthenticationResponseTests

edac26a

Remaining SecurityDocumentationIT

1ec439c

Checkstyle

47931a9

Checkstyle

6592b08

Mark SecurityClient javadocs as TODO

bd85324

albertzaharovits commented Jul 22, 2019

View reviewed changes

client/rest-high-level/src/main/java/org/elasticsearch/client/SecurityClient.java Show resolved Hide resolved

albertzaharovits commented Jul 22, 2019

View reviewed changes

albertzaharovits requested a review from bizybot July 22, 2019 22:46

albertzaharovits added 3 commits July 23, 2019 20:01

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

5f5eac7

…ler-2

Adjustment after Streamable is gone

b0b7020

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

0686267

…ler-2

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

20ac395

…ler-2

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

49d3ffa

…ler-2

This was referenced Jul 24, 2019

Enforce PKI realm with delegation to require token service enabled #44821

Merged

Cluster privilege for proxied PKI #44862

Merged

Add pki_delegatee to User metadata #44873

Merged

bizybot suggested changes Jul 26, 2019

View reviewed changes

albertzaharovits and others added 3 commits July 29, 2019 12:57

Update docs/java-rest/high-level/security/delegate-pki-authentication…

be88872

….asciidoc Co-Authored-By: Yogesh Gaikwad <[email protected]>

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

adbc1ed

…ler-2

Review

84798ec

albertzaharovits requested a review from bizybot July 29, 2019 10:45

bizybot approved these changes Jul 31, 2019

View reviewed changes

...main/java/org/elasticsearch/xpack/core/security/action/DelegatePkiAuthenticationRequest.java Outdated Show resolved Hide resolved

...curity/src/main/java/org/elasticsearch/xpack/security/authc/pki/X509AuthenticationToken.java Show resolved Hide resolved

tvernum reviewed Jul 31, 2019

View reviewed changes

Tim's review

6ecddd2

Nit

db63b86

albertzaharovits requested a review from tvernum July 31, 2019 13:33

albertzaharovits added 2 commits July 31, 2019 19:30

Test

3423df7

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

12e9d58

…ler-2

tvernum approved these changes Aug 1, 2019

View reviewed changes

Merge branch 'proxied-pki' into security-pki-delegation-add-rest-hand…

faa81db

…ler-2

albertzaharovits merged commit f71cd90 into elastic:proxied-pki Aug 1, 2019

albertzaharovits deleted the security-pki-delegation-add-rest-handler branch August 1, 2019 10:34

Add REST handler for PKI delegation #44561

Add REST handler for PKI delegation #44561

Uh oh!

Conversation

albertzaharovits commented Jul 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Jul 18, 2019

Uh oh!

bizybot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

albertzaharovits commented Jul 23, 2019

Uh oh!

albertzaharovits commented Jul 24, 2019

Uh oh!

bizybot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

albertzaharovits commented Jul 29, 2019

Uh oh!

albertzaharovits commented Jul 29, 2019

Uh oh!

bizybot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

albertzaharovits commented Jul 31, 2019

Uh oh!

albertzaharovits commented Jul 31, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

albertzaharovits commented Jul 18, 2019 •

edited

Loading