Allow Transport Actions to indicate authN realm

x-pack/docs/en/rest-api/security/oidc-authenticate-api.asciidoc

@@ -31,24 +31,28 @@ and <<security-api-oidc-logout,OpenID Connect logout API>>
 ==== {api-request-body-title}
 
 `redirect_uri`::
-The URL to which the OpenID Connect Provider redirected the User Agent in
+  (Required, string) The URL to which the OpenID Connect Provider redirected the User Agent in
 response to an authentication request, after a successful authentication. This
 URL is expected to be provided as-is (URL encoded), taken from the body of the
 response or as the value of a `Location` header in the response from the OpenID
 Connect Provider.
 
 `state`::
-String value used to maintain state between the authentication request and the
+  (Required, string) Used to maintain state between the authentication request and the
 response. This value needs to be the same as the one that was provided to the
 call to `/_security/oidc/prepare` earlier, or the one that was generated by {es}
 and included in the response to that call.
 
 `nonce`::
-String value used to associate a Client session with an ID Token and to mitigate
+  (Required, string) Used to associate a Client session with an ID Token and to mitigate
 replay attacks. This value needs to be the same as the one that was provided to
 the call to `/_security/oidc/prepare` earlier, or the one that was generated by
 {es} and included in the response to that call.
 
+`realm`::
+  (Optional, string) Used to identify the name of the OpenID Connect realm that should
+be used to authenticate this. Useful when multiple realms have been defined.
+
 [[security-api-oidc-authenticate-example]]
 ==== {api-examples-title}
 
@@ -63,7 +67,8 @@ POST /_security/oidc/authenticate
 {
   "redirect_uri" : "https://oidc-kibana.elastic.co:5603/api/security/v1/oidc?code=jtI3Ntt8v3_XvcLzCFGq&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
   "state" : "4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
-  "nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM"
+  "nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM",
+  "realm" : "oidc1"
 }
 --------------------------------------------------
 // CONSOLE

x-pack/docs/en/rest-api/security/oidc-logout-api.asciidoc

@@ -29,10 +29,10 @@ and
 ==== {api-request-body-title}
 
 `access_token`::
-The value of the access token to be invalidated as part of the logout.
+  (Required, string) The value of the access token to be invalidated as part of the logout.
 
 `refresh_token`::
-(Optional) The value of the refresh token to be invalidated as part of the logout.
+  (Optional, string) The value of the refresh token to be invalidated as part of the logout.
 
 
 [[security-api-oidc-logout-example]]

x-pack/docs/en/rest-api/security/oidc-prepare-authentication-api.asciidoc

@@ -33,28 +33,28 @@ and <<security-api-oidc-logout,OpenID Connect logout API>>.
 The following parameters can be specified in the body of the request:
 
 `realm`::
-The name of the OpenID Connect realm in {es} the configuration of which should 
+  (Optional, string) The name of the OpenID Connect realm in {es} the configuration of which should
 be used in order to generate the authentication request. Cannot be specified
-when `iss` is specified.
+when `iss` is specified. One of `realm`, `iss` needs to be specified.
 
 `state`::
-String value used to maintain state between the authentication request and the
+  (Optional, string) Value used to maintain state between the authentication request and the
 response, typically used as a Cross-Site Request Forgery mitigation. If the
 caller of the API doesn't provide a value, {es} will generate one with
 sufficient entropy itself and return it in the response.
 
 `nonce`::
-String value used to associate a Client session with an ID Token and to mitigate
+  (Optional, string) Value used to associate a Client session with an ID Token and to mitigate
 replay attacks. If the caller of the API doesn't provide a value, {es} will
 generate one with sufficient entropy itself and return it in the response.
 
-`issuer`::
-In the case of a 3rd Party initiated Single Sign On, this is the Issuer
+`iss`::
+  (Optional, string) In the case of a 3rd Party initiated Single Sign On, this is the Issuer
 Identifier for the OP that the RP is to send the Authentication Request to.
-Cannot be specified when `realm` is specified.
+Cannot be specified when `realm` is specified. One of `realm`, `iss` needs to be specified.
 
 `login_hint`::
-In the case of a 3rd Party initiated Single Sign On, a string value to be
+  (Optional, string) In the case of a 3rd Party initiated Single Sign On, a string value to be
 included in the authentication request, as the `login_hint` parameter. This
 parameter is not valid when `realm` is specified
 

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

@@ -649,7 +649,9 @@ POST /_security/oidc/prepare
   this HTTP GET request, the custom web app will need to make an HTTP POST request to
   `_security/oidc/authenticate`, again - authenticating as the `facilitator` user - passing the URL
   where the user's browser was redirected to, as a parameter, along with the
-  values for `nonce` and `state` it had saved in the user's session previously.
+  values for `nonce` and `state` it had saved in the user's session previously. If more than one
+  OpenID Connect realms are configured, the custom web app can specify the name of the realm to be
+  used for handling this, but this parameter is optional.
   See {ref}/security-api-oidc-authenticate.html[OIDC Authenticate API] for more details
 +
 [source,js]
@@ -658,7 +660,8 @@ POST /_security/oidc/authenticate
 {
   "redirect_uri" : "https://oidc-kibana.elastic.co:5603/api/security/v1/oidc?code=jtI3Ntt8v3_XvcLzCFGq&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
   "state" : "4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
-  "nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM"
+  "nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM",
+  "realm" : "oidc1"
 }
 -----------------------------------------------------------------------
 // CONSOLE

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectAuthenticateRequest.java

@@ -5,6 +5,7 @@
  */
 package org.elasticsearch.xpack.core.security.action.oidc;
 
+import org.elasticsearch.Version;
 import org.elasticsearch.action.ActionRequest;
 import org.elasticsearch.action.ActionRequestValidationException;
 import org.elasticsearch.common.Strings;
@@ -38,6 +39,11 @@ public class OpenIdConnectAuthenticateRequest extends ActionRequest {
      */
     private String nonce;
 
+    /**
+     * The name of the OIDC Realm that should consume the authentication request
+     */
+    private String realm;
+
     public OpenIdConnectAuthenticateRequest() {
 
     }
@@ -47,6 +53,10 @@ public OpenIdConnectAuthenticateRequest(StreamInput in) throws IOException {
         redirectUri = in.readString();
         state = in.readString();
         nonce = in.readString();
+        if (in.getVersion().onOrAfter(Version.V_7_4_0)){
+            realm = in.readOptionalString();
+        }
+
     }
 
     public String getRedirectUri() {
@@ -73,6 +83,14 @@ public void setNonce(String nonce) {
         this.nonce = nonce;
     }
 
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
+
     @Override
     public ActionRequestValidationException validate() {
         ActionRequestValidationException validationException = null;
@@ -94,10 +112,13 @@ public void writeTo(StreamOutput out) throws IOException {
         out.writeString(redirectUri);
         out.writeString(state);
         out.writeString(nonce);
+        if (out.getVersion().onOrAfter(Version.V_7_4_0)){
+            out.writeOptionalString(realm);
+        }
     }
 
     public String toString() {
-        return "{redirectUri=" + redirectUri + ", state=" + state + ", nonce=" + nonce + "}";
+        return "{redirectUri=" + redirectUri + ", state=" + state + ", nonce=" + nonce + ", realm=" +realm+"}";
     }
 }
 

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/saml/SamlAuthenticateRequest.java

@@ -7,6 +7,7 @@
 
 import org.elasticsearch.action.ActionRequest;
 import org.elasticsearch.action.ActionRequestValidationException;
+import org.elasticsearch.common.Nullable;
 import org.elasticsearch.common.io.stream.StreamInput;
 
 import java.io.IOException;
@@ -19,6 +20,8 @@ public final class SamlAuthenticateRequest extends ActionRequest {
 
     private byte[] saml;
     private List<String> validRequestIds;
+    @Nullable
+    private String realm;
 
     public SamlAuthenticateRequest(StreamInput in) throws IOException {
         super(in);
@@ -47,4 +50,12 @@ public List<String> getValidRequestIds() {
     public void setValidRequestIds(List<String> validRequestIds) {
         this.validRequestIds = validRequestIds;
     }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/saml/SamlAuthenticateRequestBuilder.java

@@ -29,4 +29,9 @@ public SamlAuthenticateRequestBuilder validRequestIds(List<String> validRequestI
         request.setValidRequestIds(validRequestIds);
         return this;
     }
+
+    public SamlAuthenticateRequestBuilder preferredRealm(String realm) {
+        request.setRealm(realm);
+        return this;
+    }
 }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/action/oidc/TransportOpenIdConnectAuthenticateAction.java

@@ -25,6 +25,8 @@
 import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectAuthenticateAction;
 import org.elasticsearch.xpack.core.security.authc.Authentication;
 import org.elasticsearch.xpack.core.security.authc.AuthenticationResult;
+import org.elasticsearch.xpack.core.security.authc.RealmConfig;
+import org.elasticsearch.xpack.core.security.authc.oidc.OpenIdConnectRealmSettings;
 import org.elasticsearch.xpack.security.authc.AuthenticationService;
 import org.elasticsearch.xpack.security.authc.TokenService;
 import org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectRealm;
@@ -59,7 +61,9 @@ protected void doExecute(Task task, OpenIdConnectAuthenticateRequest request,
         final ThreadContext threadContext = threadPool.getThreadContext();
         Authentication originatingAuthentication = Authentication.getAuthentication(threadContext);
         try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
-            authenticationService.authenticate(OpenIdConnectAuthenticateAction.NAME, request, token, ActionListener.wrap(
+            RealmConfig.RealmIdentifier preferredRealm = request.getRealm() == null ? null :
+                new RealmConfig.RealmIdentifier(OpenIdConnectRealmSettings.TYPE, request.getRealm());
+            authenticationService.authenticate(OpenIdConnectAuthenticateAction.NAME, request, token, preferredRealm, ActionListener.wrap(
                 authentication -> {
                     AuthenticationResult result = threadContext.getTransient(AuthenticationResult.THREAD_CONTEXT_KEY);
                     if (result == null) {

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/action/saml/TransportSamlAuthenticateAction.java

@@ -20,6 +20,8 @@
 import org.elasticsearch.xpack.core.security.action.saml.SamlAuthenticateResponse;
 import org.elasticsearch.xpack.core.security.authc.Authentication;
 import org.elasticsearch.xpack.core.security.authc.AuthenticationResult;
+import org.elasticsearch.xpack.core.security.authc.RealmConfig;
+import org.elasticsearch.xpack.core.security.authc.saml.SamlRealmSettings;
 import org.elasticsearch.xpack.security.authc.AuthenticationService;
 import org.elasticsearch.xpack.security.authc.TokenService;
 import org.elasticsearch.xpack.security.authc.saml.SamlRealm;
@@ -53,7 +55,10 @@ protected void doExecute(Task task, SamlAuthenticateRequest request, ActionListe
         final ThreadContext threadContext = threadPool.getThreadContext();
         Authentication originatingAuthentication = Authentication.getAuthentication(threadContext);
         try (ThreadContext.StoredContext ignore = threadContext.stashContext()) {
-            authenticationService.authenticate(SamlAuthenticateAction.NAME, request, saml, ActionListener.wrap(authentication -> {
+            RealmConfig.RealmIdentifier preferredRealm = request.getRealm() == null ? null :
+                new RealmConfig.RealmIdentifier(SamlRealmSettings.TYPE, request.getRealm());
+            authenticationService.authenticate(SamlAuthenticateAction.NAME, request, saml, preferredRealm,
+                ActionListener.wrap(authentication -> {
                 AuthenticationResult result = threadContext.getTransient(AuthenticationResult.THREAD_CONTEXT_KEY);
                 if (result == null) {
                     listener.onFailure(new IllegalStateException("Cannot find AuthenticationResult on thread context"));

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/AuthenticationService.java

@@ -36,6 +36,7 @@
 import org.elasticsearch.xpack.core.security.authc.AuthenticationServiceField;
 import org.elasticsearch.xpack.core.security.authc.AuthenticationToken;
 import org.elasticsearch.xpack.core.security.authc.Realm;
+import org.elasticsearch.xpack.core.security.authc.RealmConfig;
 import org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.EmptyAuthorizationInfo;
 import org.elasticsearch.xpack.core.security.support.Exceptions;
 import org.elasticsearch.xpack.core.security.user.AnonymousUser;
@@ -56,6 +57,7 @@
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.BiConsumer;
 import java.util.function.Consumer;
+import java.util.stream.Collectors;
 
 import static org.elasticsearch.xpack.security.support.SecurityIndexManager.isIndexDeleted;
 import static org.elasticsearch.xpack.security.support.SecurityIndexManager.isMoveFromRedToNonRed;
@@ -140,16 +142,33 @@ public void authenticate(String action, TransportMessage message, User fallbackU
     }
 
     /**
-     * Authenticates the username and password that are provided as parameters. This will not look
-     * at the values in the ThreadContext for Authentication.
+     * Authenticates the user based on the contents of the token that is provided as parameter.If {@code preferredRealm} can't
+     * authenticate the token, no other realms will be attempted.
+     * This will not look at the values in the ThreadContext for Authentication.
      *
      * @param action  The action of the message
      * @param message The message that resulted in this authenticate call
      * @param token   The token (credentials) to be authenticated
      */
     public void authenticate(String action, TransportMessage message,
                              AuthenticationToken token, ActionListener<Authentication> listener) {
-        new Authenticator(action, message, null, listener).authenticateToken(token);
+        new Authenticator(action, message, null, listener).authenticateToken(token, null);
+    }
+
+    /**
+     * Authenticates the user based on the contents of the token that is provided as parameter only at the realm that is indicated with
+     * {@code preferredRealm}. If {@code preferredRealm} can't authenticate the token, no other realms will be attempted.
+     * This will not look at the values in the ThreadContext for Authentication.
+     *
+     * @param action  The action of the message
+     * @param message The message that resulted in this authenticate call
+     * @param token   The token (credentials) to be authenticated
+     * @param preferredRealm The realm that should be used to authenticate the token
+     */
+    public void authenticate(String action, TransportMessage message,
+                             AuthenticationToken token, @Nullable RealmConfig.RealmIdentifier preferredRealm,
+                             ActionListener<Authentication> listener) {
+        new Authenticator(action, message, null, listener).authenticateToken(token, preferredRealm);
     }
 
     public void expire(String principal) {
@@ -345,18 +364,25 @@ void extractToken(Consumer<AuthenticationToken> consumer) {
             action.run();
         }
 
+        private void consumeToken(AuthenticationToken token){
+            consumeToken(token, null);
+        }
+
         /**
          * Consumes the {@link AuthenticationToken} provided by the caller. In the case of a {@code null} token, {@link #handleNullToken()}
-         * is called. In the case of a {@code non-null} token, the realms are iterated over and the first realm that returns a non-null
-         * {@link User} is the authenticating realm and iteration is stopped. This user is then passed to {@link #consumeUser(User, Map)}
-         * if no exception was caught while trying to authenticate the token
+         * is called. In the case of a {@code non-null} token, the realms are iterated over in the order defined in the configuration
+         * while possible also taking into consideration the last realm that authenticated this principal. If {@code preferredRealm} is
+         * not null, only this realm will be attempted, regardless of its order/applicability. When consulting multiple realms, the
+         * first realm that returns a non-null {@link User} is the authenticating realm and iteration is stopped. This user is then
+         * passed to {@link #consumeUser(User, Map)} if no exception was caught while trying to authenticate the token
          */
-        private void consumeToken(AuthenticationToken token) {
+        private void consumeToken(AuthenticationToken token, @Nullable RealmConfig.RealmIdentifier preferredRealm) {
             if (token == null) {
                 handleNullToken();
             } else {
                 authenticationToken = token;
-                final List<Realm> realmsList = getRealmList(authenticationToken.principal());
+                final List<Realm> realmsList = getRealmList(authenticationToken.principal(), preferredRealm);
+                logger.debug("Realms [{}] will be used for authentication in the specified order.", realmsList);
                 final long startInvalidation = numInvalidation.get();
                 final Map<Realm, Tuple<String, Exception>> messages = new LinkedHashMap<>();
                 final BiConsumer<Realm, ActionListener<User>> realmAuthenticatingConsumer = (realm, userListener) -> {
@@ -411,8 +437,20 @@ private void consumeToken(AuthenticationToken token) {
             }
         }
 
-        private List<Realm> getRealmList(String principal) {
+        /**
+         * Possible filters the realm list that is defined in the node's configuration based on {@code preferredRealm} and also
+         * possibly reorders the realm list depending on whether this principal has been recently authenticated by a specific realm
+         * @param principal The principal of the {@link AuthenticationToken} to be authenticated by a realm
+         * @param preferredRealm The realm that should authenticate the current {@link AuthenticationToken}
+         * @return a list of realms ordered based on which realm should authenticate the current {@link AuthenticationToken}
+         */
+        private List<Realm> getRealmList(String principal, @Nullable RealmConfig.RealmIdentifier preferredRealm) {
             final List<Realm> orderedRealmList = this.defaultOrderedRealmList;
+            if (preferredRealm != null){
+                return orderedRealmList.stream()
+                    .filter(realm -> realm.name().equals(preferredRealm.getName()) && realm.type().equals(preferredRealm.getType()))
+                    .collect(Collectors.toUnmodifiableList());
+            }
             if (lastSuccessfulAuthCache != null) {
                 final Realm lastSuccess = lastSuccessfulAuthCache.get(principal);
                 if (lastSuccess != null) {
@@ -519,7 +557,7 @@ private void consumeUser(User user, Map<Realm, Tuple<String, Exception>> message
          * names of users that exist using a timing attack
          */
         private void lookupRunAsUser(final User user, String runAsUsername, Consumer<User> userConsumer) {
-            final RealmUserLookup lookup = new RealmUserLookup(getRealmList(runAsUsername), threadContext);
+            final RealmUserLookup lookup = new RealmUserLookup(getRealmList(runAsUsername, null), threadContext);
             final long startInvalidationNum = numInvalidation.get();
             lookup.lookup(runAsUsername, ActionListener.wrap(tuple -> {
                 if (tuple == null) {
@@ -572,8 +610,8 @@ void writeAuthToContext(Authentication authentication) {
             action.run();
         }
 
-        private void authenticateToken(AuthenticationToken token) {
-            this.consumeToken(token);
+        private void authenticateToken(AuthenticationToken token, @Nullable RealmConfig.RealmIdentifier preferredRealm) {
+            this.consumeToken(token, preferredRealm);
         }
     }