Skip to content

Enroll Kibana API uses Service Accounts #76370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkakavas merged 16 commits into from
Aug 17, 2021
Merged

Enroll Kibana API uses Service Accounts #76370

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
c84c36f
Enroll Kibana API uses Service Accounts
jkakavas Aug 11, 2021
39d6b92
minor updates
jkakavas Aug 11, 2021
d23a85b
fix tests
jkakavas Aug 11, 2021
29cf973
unused import
jkakavas Aug 11, 2021
0180b16
Update service accounts overview to include kibana-system
Aug 11, 2021
2e9c380
fix more tests
jkakavas Aug 11, 2021
7f204e7
Merge remote-tracking branch 'origin/master' into kibana-service-acco…
jkakavas Aug 11, 2021
b9280b2
Merge remote-tracking branch 'origin/master' into kibana-service-acco…
jkakavas Aug 13, 2021
52a3ac4
update service name
jkakavas Aug 13, 2021
89d0f38
re-enable enrollment documentation tests
jkakavas Aug 13, 2021
8a3e89f
Address feedback
jkakavas Aug 16, 2021
cd73a19
update var name
jkakavas Aug 16, 2021
ed7e2fe
Merge remote-tracking branch 'origin/master' into kibana-service-acco…
jkakavas Aug 16, 2021
4dce318
Fix links, streamline grammar, and other editorial changes
Aug 16, 2021
cca510c
Clarify the value of the token used to authenticate
Aug 16, 2021
3ab69c9
Merge branch 'master' into kibana-service-account-enroll-api
elasticmachine Aug 17, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions ...igh-level/qa/ssl-enabled/src/javaRestTest/java/org/elasticsearch/client/EnrollmentIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,6 @@ public void testEnrollKibana() throws Exception {
assertThat(kibanaResponse, notNullValue());
assertThat(kibanaResponse.getHttpCa()
, endsWith("brcNC5xq6YE7C4/06nH7F6le4kE4Uo6c9fpkl4ehOxQxndNLn462tFF+8VBA8IftJ1PPWzqGxLsCTzM6p6w8sa+XhgNYglLfkRjirc="));
assertNotNull(kibanaResponse.getPassword());
assertThat(kibanaResponse.getPassword().toString().length(), equalTo(14));
assertNotNull(kibanaResponse.getToken());
}
}
16 changes: 8 additions & 8 deletions ...-high-level/src/main/java/org/elasticsearch/client/security/KibanaEnrollmentResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,21 @@

public final class KibanaEnrollmentResponse {

private SecureString password;
private SecureString token;
Copy link
Contributor Author

@jkakavas jkakavas Aug 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@azasypkin would Kibana want to know the token name in addition to the value ? ( https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html )

Copy link
Member

@ywangd ywangd Aug 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A explicit token name might be convenient for kibana, but the token value itself also has the token name embedded. The token value takes the format of \0\1\0\1elastic/kibana-system/$tokenName:$tokenSecret and is base64 encoded.

Copy link
Member

@azasypkin azasypkin Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@azasypkin would Kibana want to know the token name in addition to the value ? ( https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html )

Yeah, I think it'd be better to have one (to log it least).

Copy link

@thomheymann thomheymann Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From what I can gather we only need the service account token to authenticate so don't think we need the name at all.

Copy link
Member

@azasypkin azasypkin Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, we don't need it in the code, but I thought it'd be beneficial to log it anyway, to know which Kibana triggered generation of which token, for troubleshooting purposes.

Copy link

@thomheymann thomheymann Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be honest, for consistency, it might make sense to mirror the create service token API anyways:

{
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}

Learn once, use anywhere, etc.

Copy link
Contributor Author

@jkakavas jkakavas Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

coo, I'll make the change to return the name too, thanks for weighing in folks

private String httpCa;

public KibanaEnrollmentResponse(SecureString password, String httpCa) {
this.password = password;
public KibanaEnrollmentResponse(SecureString token, String httpCa) {
this.token = token;
this.httpCa = httpCa;
}

public SecureString getPassword() { return password; }
public SecureString getToken() { return token; }

public String getHttpCa() {
return httpCa;
}

private static final ParseField PASSWORD = new ParseField("password");
private static final ParseField TOKEN = new ParseField("token");
private static final ParseField HTTP_CA = new ParseField("http_ca");

@SuppressWarnings("unchecked")
Expand All @@ -42,7 +42,7 @@ public String getHttpCa() {
a -> new KibanaEnrollmentResponse(new SecureString(((String) a[0]).toCharArray()), (String) a[1]));

static {
PARSER.declareString(ConstructingObjectParser.constructorArg(), PASSWORD);
PARSER.declareString(ConstructingObjectParser.constructorArg(), TOKEN);
PARSER.declareString(ConstructingObjectParser.constructorArg(), HTTP_CA);
}

Expand All @@ -54,10 +54,10 @@ public static KibanaEnrollmentResponse fromXContent(XContentParser parser) throw
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
KibanaEnrollmentResponse that = (KibanaEnrollmentResponse) o;
return password.equals(that.password) && httpCa.equals(that.httpCa);
return token.equals(that.token) && httpCa.equals(that.httpCa);
}

@Override public int hashCode() {
return Objects.hash(password, httpCa);
return Objects.hash(token, httpCa);
}
}
8 changes: 4 additions & 4 deletions ...h-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2875,7 +2875,7 @@ public void onFailure(Exception e) {
}
}

@AwaitsFix(bugUrl = "Determine behavior for keystores with multiple keys")
@AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/75097")
Copy link
Contributor

@BigPandaToo BigPandaToo Aug 13, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it really blocked by this issue? I think it shouldn't be unless we use truststore containing multiple CA certs

Copy link
Contributor Author

@jkakavas jkakavas Aug 13, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True, we should have re-enabled this test as part of #73807. Will take care of it on Monday

Copy link
Contributor

@BigPandaToo BigPandaToo Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, testEnrollNode and testEnrollKibana here are already doing what we need, I believe

Copy link
Contributor Author

@jkakavas jkakavas Aug 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, not really. EnrollIT means to test the HLRC behavior where the *DocumentationIT means to test that our documentation snippets are accurate and work

public void testNodeEnrollment() throws Exception {
RestHighLevelClient client = highLevelClient();

Expand Down Expand Up @@ -2918,7 +2918,7 @@ public void onFailure(Exception e) {
}
}

@AwaitsFix(bugUrl = "Determine behavior for keystores with multiple keys")
@AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/75097")
Copy link
Contributor

@BigPandaToo BigPandaToo Aug 13, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above ^^

public void testKibanaEnrollment() throws Exception {
RestHighLevelClient client = highLevelClient();

Expand All @@ -2928,10 +2928,10 @@ public void testKibanaEnrollment() throws Exception {
// end::kibana-enrollment-execute

// tag::kibana-enrollment-response
SecureString password = response.getPassword(); // <1>
SecureString token = response.getToken(); // <1>
String httoCa = response.getHttpCa(); // <2>
// end::kibana-enrollment-response
assertThat(password.length(), equalTo(14));
assertNotNull(token);
}

{
Expand Down
18 changes: 9 additions & 9 deletions ...-level/src/test/java/org/elasticsearch/client/security/KibanaErnollmentResponseTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,42 +24,42 @@
public class KibanaErnollmentResponseTests extends ESTestCase {

public void testFromXContent() throws IOException {
final String password = randomAlphaOfLength(14);
final String token = randomAlphaOfLengthBetween(30, 40);
final String httpCa = randomAlphaOfLength(50);
final List<String> nodesAddresses = randomList(2, 10, () -> buildNewFakeTransportAddress().toString());

final XContentType xContentType = randomFrom(XContentType.values());
final XContentBuilder builder = XContentFactory.contentBuilder(xContentType);
builder.startObject().field("password", password).field("http_ca", httpCa).field("nodes_addresses", nodesAddresses).endObject();
builder.startObject().field("token", token).field("http_ca", httpCa).field("nodes_addresses", nodesAddresses).endObject();
BytesReference xContent = BytesReference.bytes(builder);

final KibanaEnrollmentResponse response = KibanaEnrollmentResponse.fromXContent(createParser(xContentType.xContent(), xContent));
assertThat(response.getPassword(), equalTo(password));
assertThat(response.getToken(), equalTo(token));
assertThat(response.getHttpCa(), equalTo(httpCa));
}

public void testEqualsHashCode() {
final SecureString password = new SecureString(randomAlphaOfLength(14).toCharArray());
final SecureString password = new SecureString(randomAlphaOfLengthBetween(30, 40).toCharArray());
final String httpCa = randomAlphaOfLength(50);
KibanaEnrollmentResponse kibanaEnrollmentResponse = new KibanaEnrollmentResponse(password, httpCa);

EqualsHashCodeTestUtils.checkEqualsAndHashCode(kibanaEnrollmentResponse,
(original) -> new KibanaEnrollmentResponse(original.getPassword(), original.getHttpCa()));
(original) -> new KibanaEnrollmentResponse(original.getToken(), original.getHttpCa()));

EqualsHashCodeTestUtils.checkEqualsAndHashCode(kibanaEnrollmentResponse,
(original) -> new KibanaEnrollmentResponse(original.getPassword(), original.getHttpCa()),
(original) -> new KibanaEnrollmentResponse(original.getToken(), original.getHttpCa()),
KibanaErnollmentResponseTests::mutateTestItem);
}

private static KibanaEnrollmentResponse mutateTestItem(KibanaEnrollmentResponse original) {
switch (randomIntBetween(0, 1)) {
case 0:
return new KibanaEnrollmentResponse(new SecureString(randomAlphaOfLength(14).toCharArray()),
return new KibanaEnrollmentResponse(new SecureString(randomAlphaOfLengthBetween(30, 40).toCharArray()),
original.getHttpCa());
case 1:
return new KibanaEnrollmentResponse(original.getPassword(), randomAlphaOfLength(51));
return new KibanaEnrollmentResponse(original.getToken(), randomAlphaOfLength(51));
default:
return new KibanaEnrollmentResponse(original.getPassword(),
return new KibanaEnrollmentResponse(original.getToken(),
original.getHttpCa());
}
}
Expand Down
2 changes: 1 addition & 1 deletion docs/java-rest/high-level/security/enroll_kibana.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ executed operation as follows:
--------------------------------------------------
include-tagged::{doc-tests-file}[{api-kibana-response]
--------------------------------------------------
<1> The password for the `kibana_system` user
<1> A token that can be used as a bearer token for the `kibana-system` service account.
<2> The CA certificate that has signed the certificate that the cluster uses for TLS on the HTTP layer,
as a Base64 encoded string of the ASN.1 DER encoding of the certificate.

Expand Down
4 changes: 2 additions & 2 deletions x-pack/docs/en/rest-api/security/enroll-kibana.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,10 @@ The API returns the following response:
[source,console_result]
----
{
"password" : "longsecurepassword", <1>
"token" : "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ", <1>
"http_ca" : "MIIJlAIBAzCCCVoGCSqGSIb3....vsDfsA3UZBAjEPfhubpQysAICCAA=", <2>
}
----
<1> The password for the `kibana_system` user.
<1> A token that can be used as a bearer token for the `kibana-system` service account.
<2> The CA certificate used to sign the node certificates that {es} uses for TLS on the HTTP layer.
The certificate is returned as a Base64 encoded string of the ASN.1 DER encoding of the certificate.
22 changes: 11 additions & 11 deletions ...ava/org/elasticsearch/xpack/core/security/action/enrollment/KibanaEnrollmentResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

public final class KibanaEnrollmentResponse extends ActionResponse implements ToXContentObject {

private static final ParseField PASSWORD = new ParseField("password");
private static final ParseField TOKEN = new ParseField("token");
private static final ParseField HTTP_CA = new ParseField("http_ca");

@SuppressWarnings("unchecked")
Expand All @@ -32,39 +32,39 @@ public final class KibanaEnrollmentResponse extends ActionResponse implements To
a -> new KibanaEnrollmentResponse(new SecureString(((String) a[0]).toCharArray()), (String) a[1]));

static {
PARSER.declareString(ConstructingObjectParser.constructorArg(), PASSWORD);
PARSER.declareString(ConstructingObjectParser.constructorArg(), TOKEN);
PARSER.declareString(ConstructingObjectParser.constructorArg(), HTTP_CA);
}

private final SecureString password;
private final SecureString token;
private final String httpCa;

public KibanaEnrollmentResponse(StreamInput in) throws IOException {
super(in);
password = in.readSecureString();
token = in.readSecureString();
httpCa = in.readString();
}

public KibanaEnrollmentResponse(SecureString password, String httpCa) {
this.password = password;
public KibanaEnrollmentResponse(SecureString token, String httpCa) {
this.token = token;
this.httpCa = httpCa;
}

public SecureString getPassword() { return password; }
public SecureString getToken() { return token; }
public String getHttpCa() {
return httpCa;
}

@Override public XContentBuilder toXContent(
XContentBuilder builder, Params params) throws IOException {
builder.startObject();
builder.field(PASSWORD.getPreferredName(), password.toString());
builder.field(TOKEN.getPreferredName(), token.toString());
builder.field(HTTP_CA.getPreferredName(), httpCa);
return builder.endObject();
}

@Override public void writeTo(StreamOutput out) throws IOException {
out.writeSecureString(password);
out.writeSecureString(token);
out.writeString(httpCa);
}

Expand All @@ -76,10 +76,10 @@ public static KibanaEnrollmentResponse fromXContent(XContentParser parser) {
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
KibanaEnrollmentResponse response = (KibanaEnrollmentResponse) o;
return password.equals(response.password) && httpCa.equals(response.httpCa);
return token.equals(response.token) && httpCa.equals(response.httpCa);
}

@Override public int hashCode() {
return Objects.hash(password, httpCa);
return Objects.hash(token, httpCa);
}
}
Loading