Skip to content

X509AuthnToken cache key change for proxied-PKI #44810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
albertzaharovits merged 7 commits into from
Aug 1, 2019
Merged

X509AuthnToken cache key change for proxied-PKI #44810

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c0a2afd
Cache x509 authn token by the chain
albertzaharovits Jul 24, 2019
61be212
Checkstyle
albertzaharovits Jul 24, 2019
a217287
remove incrementing byte
albertzaharovits Jul 31, 2019
6783aec
Merge branch 'proxied-pki' into security-pki-delegation-realm-cache-c…
albertzaharovits Jul 31, 2019
ae4305c
Merge branch 'proxied-pki' into security-pki-delegation-realm-cache-c…
albertzaharovits Aug 1, 2019
aff2b3f
Merge fallout
albertzaharovits Aug 1, 2019
bac48fa
Merge fallout - 2
albertzaharovits Aug 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions ...ck/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/pki/PkiRealm.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,9 +143,11 @@ public void authenticate(AuthenticationToken authToken, ActionListener<Authentic
assert delegatedRealms != null : "Realm has not been initialized correctly";
X509AuthenticationToken token = (X509AuthenticationToken) authToken;
try {
final BytesKey fingerprint = computeFingerprint(token.credentials()[0]);
final BytesKey fingerprint = computeTokenFingerprint(token);
User user = cache.get(fingerprint);
if (user != null) {
logger.debug((Supplier<?>) () -> new ParameterizedMessage("Using cached authentication for DN [{}], as principal [{}]",
token.dn(), user.principal()));
if (delegatedRealms.hasDelegation()) {
delegatedRealms.resolve(user.principal(), listener);
} else {
Expand Down Expand Up @@ -317,9 +319,13 @@ public void expireAll() {
}
}

private static BytesKey computeFingerprint(X509Certificate certificate) throws CertificateEncodingException {
static BytesKey computeTokenFingerprint(X509AuthenticationToken token) throws CertificateEncodingException {
MessageDigest digest = MessageDigests.sha256();
digest.update(certificate.getEncoded());
byte i = 1;
for (X509Certificate certificate : token.credentials()) {
digest.update(certificate.getEncoded());
digest.update(i++);
}
return new BytesKey(digest.digest());
}
}
27 changes: 26 additions & 1 deletion ...ugin/security/src/test/java/org/elasticsearch/xpack/security/authc/pki/PkiRealmTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import org.elasticsearch.xpack.core.security.support.NoOpLogger;
import org.elasticsearch.xpack.core.security.user.User;
import org.elasticsearch.xpack.security.authc.BytesKey;
import org.elasticsearch.xpack.security.authc.support.MockLookupRealm;
import org.elasticsearch.xpack.security.authc.support.UserRoleMapper;
import org.junit.Before;
Expand All @@ -47,6 +48,7 @@
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.equalTo;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.notNullValue;
import static org.hamcrest.Matchers.nullValue;
import static org.hamcrest.Matchers.sameInstance;
Expand Down Expand Up @@ -433,7 +435,7 @@ public void testDelegatedAuthorization() throws Exception {
assertThat(result.getUser(), sameInstance(lookupUser2));
}

public void testX509AuthenticationToken() throws Exception {
public void testX509AuthenticationTokenOrdered() throws Exception {
X509Certificate[] mockCertChain = new X509Certificate[2];
mockCertChain[0] = mock(X509Certificate.class);
when(mockCertChain[0].getIssuerX500Principal()).thenReturn(new X500Principal("CN=Test, OU=elasticsearch, O=org"));
Expand All @@ -443,6 +445,29 @@ public void testX509AuthenticationToken() throws Exception {
assertThat(e.getMessage(), is("certificates chain array is not ordered"));
}

public void testX509AuthenticationTokenCaching() throws Exception {
X509Certificate[] mockCertChain = new X509Certificate[2];
mockCertChain[0] = mock(X509Certificate.class);
when(mockCertChain[0].getSubjectX500Principal()).thenReturn(new X500Principal("CN=Test, OU=elasticsearch, O=org"));
when(mockCertChain[0].getIssuerX500Principal()).thenReturn(new X500Principal("CN=Test CA, OU=elasticsearch, O=org"));
when(mockCertChain[0].getEncoded()).thenReturn(randomByteArrayOfLength(2));
mockCertChain[1] = mock(X509Certificate.class);
when(mockCertChain[1].getSubjectX500Principal()).thenReturn(new X500Principal("CN=Test CA, OU=elasticsearch, O=org"));
when(mockCertChain[1].getEncoded()).thenReturn(randomByteArrayOfLength(3));
BytesKey cacheKey = PkiRealm.computeTokenFingerprint(new X509AuthenticationToken(mockCertChain));

BytesKey sameCacheKey = PkiRealm
.computeTokenFingerprint(new X509AuthenticationToken(new X509Certificate[] { mockCertChain[0], mockCertChain[1] }));
assertThat(cacheKey, is(sameCacheKey));

BytesKey cacheKeyClient = PkiRealm.computeTokenFingerprint(new X509AuthenticationToken(new X509Certificate[] { mockCertChain[0] }));
assertThat(cacheKey, is(not(cacheKeyClient)));

BytesKey cacheKeyRoot = PkiRealm.computeTokenFingerprint(new X509AuthenticationToken(new X509Certificate[] { mockCertChain[1] }));
assertThat(cacheKey, is(not(cacheKeyRoot)));
assertThat(cacheKeyClient, is(not(cacheKeyRoot)));
}

static X509Certificate readCert(Path path) throws Exception {
try (InputStream in = Files.newInputStream(path)) {
CertificateFactory factory = CertificateFactory.getInstance("X.509");
Expand Down