Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors by cwillum · Pull Request #3251 · opensearch-project/documentation-website

cwillum · 2023-03-07T02:49:25Z

Description

Security added a new setting to be used for JWT, SAML, and OIDC backend configurations when there is a disparity between clock time between the validation servers and the token causes authentication to fail.

Issues Resolved

Added new documentation to JWT, SAML, and OIDC backend documentation for the new jwt_clock_skew_tolerance_seconds setting.

Fixes #3220

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum · 2023-03-07T22:05:06Z

@cwperks Can you check me on this, language, accuracy, and what else you might see? Thanks.
I considered adding something to troubleshooting, as well. But I think the enhancement to add a default would make that redundant, and twice redundant with the new information about this in the backend configurations.

cwperks

@cwillum This change looks good to me. I left a minor comment on the choice of using the term validation server, but the wording looks good in general.

_security/authentication-backends/saml.md

cwperks · 2023-03-07T23:16:52Z

_security/authentication-backends/openid-connect.md


+## Time disparity compensation for JSON Web Token validation
+
+Occasionally you may find that the clock times between the validation server and the OpenSearch node are not perfectly synchronized. When this is the case, even by a few seconds, the system that either issues or receives a JWT may try to validate `nbf` (not before) and `exp` (expiration) claims and fail to authenticate the user due to the time disparity.


I have been referring to the system that generates the JWTs as the Authentication server. Upon successful Authentication it generates the token and gives it back to the authenticated user who can then bear the token for subsequent requests. What do you think about authentication server instead of validation server?

I'm with you on that. Thanks. (authentication server)

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum

Thanks @cwperks

cwillum · 2023-03-07T23:41:45Z

_security/authentication-backends/openid-connect.md


+## Time disparity compensation for JSON Web Token validation
+
+Occasionally you may find that the clock times between the validation server and the OpenSearch node are not perfectly synchronized. When this is the case, even by a few seconds, the system that either issues or receives a JWT may try to validate `nbf` (not before) and `exp` (expiration) claims and fail to authenticate the user due to the time disparity.


I'm with you on that. Thanks. (authentication server)

cwillum · 2023-03-17T16:59:10Z

Waiting for availability on doc team review.

JeffHuss

LGTM!

cwillum · 2023-03-27T15:57:39Z

Waiting for availability on doc team review.

_security/authentication-backends/saml.md

carolxob

LGTM with a few very minor suggestions.

hdhalter

Looks good! A couple of minor suggestions.

_security/configuration/configuration.md

hdhalter · 2023-03-27T23:11:27Z

_security/configuration/configuration.md

-The payload of a JSON web token contains the so-called [JWT Claims](https://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#RegisteredClaimName). A claim can be any piece of information about the user that the application that created the token has verified.
+The payload of a JSON Web Token contains the so-called [JWT Claims](https://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#RegisteredClaimName). A claim can be any piece of information about the user that the application that created the token has verified.

 The specification defines a set of standard claims with reserved names ("registered claims"). These include, for example, the token issuer, the expiration date, or the creation date.


When you say 'these include...' do you need to say, 'for example'? Could you just say, 'The standard claims include the token issuer, the expiration date...' or are they examples of reserved names?

These are just examples of the many registered claims that exist. I have rewritten this statement in the hopes of bestowing the claim with a richness of clarity.

Signed-off-by: cwillum <cwmmoore@amazon.com>

natebower

@cwillum Please confirm that JWT is defined on first appearance in each file and that only the acronym is used thereafter. If the first use of an acronym is in a heading, retain the acronym in the heading, and then write out the term in the following body text, followed by the acronym in parentheses. Let me know if you have any questions. Thanks!

_security/authentication-backends/openid-connect.md

_security/configuration/configuration.md

_security/authentication-backends/saml.md

Signed-off-by: cwillum <cwmmoore@amazon.com>

…esolves authentication errors (#3251) * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> --------- Signed-off-by: cwillum <cwmmoore@amazon.com> (cherry picked from commit 15d324d) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3607) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3606) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3605) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3604) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3603) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3602) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) (#3601) * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew * fix#3220 auth fail from clock skew --------- (cherry picked from commit 15d324d) Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…esolves authentication errors (#3251) * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> --------- Signed-off-by: cwillum <cwmmoore@amazon.com>

…g that resolves authentication errors (#3251)" This reverts commit d9bf5dc.

…esolves authentication errors (opensearch-project#3251) * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#3220 auth fail from clock skew Signed-off-by: cwillum <cwmmoore@amazon.com> --------- Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#3220 auth fail from clock skew

b7d88bb

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum requested a review from a team as a code owner March 7, 2023 02:49

cwillum self-assigned this Mar 7, 2023

cwillum added 2 commits March 7, 2023 10:07

fix#3220 auth fail from clock skew

e57099f

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#3220 auth fail from clock skew

bac3fdd

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwperks approved these changes Mar 7, 2023

View reviewed changes

fix#3220 auth fail from clock skew

49fe986

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum commented Mar 8, 2023

View reviewed changes

cwillum added Doc review PR: Doc review in progress and removed In progress Issue/PR: The issue or PR is in progress. labels Mar 17, 2023

JeffHuss approved these changes Mar 17, 2023

View reviewed changes

carolxob self-requested a review March 27, 2023 16:01

carolxob reviewed Mar 27, 2023

View reviewed changes

_security/authentication-backends/saml.md Outdated Show resolved Hide resolved

carolxob reviewed Mar 27, 2023

View reviewed changes

_security/authentication-backends/saml.md Show resolved Hide resolved

carolxob reviewed Mar 27, 2023

View reviewed changes

_security/authentication-backends/saml.md Show resolved Hide resolved

carolxob reviewed Mar 27, 2023

View reviewed changes

_security/authentication-backends/saml.md Show resolved Hide resolved

carolxob approved these changes Mar 27, 2023

View reviewed changes

hdhalter approved these changes Mar 27, 2023

View reviewed changes

fix#3220 auth fail from clock skew

7ea73cb

Signed-off-by: cwillum <cwmmoore@amazon.com>

natebower reviewed Mar 28, 2023

View reviewed changes

fix#3220 auth fail from clock skew

0e45051

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum removed the Doc review PR: Doc review in progress label Mar 28, 2023

cwillum merged commit 15d324d into main Mar 28, 2023

cwillum deleted the fix#3220-clock-skew-fail-to-auth branch March 28, 2023 20:48

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.0] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3601

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.1] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3602

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.2] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3603

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.3] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3604

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.4] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3605

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.5] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3606

Merged

opensearch-trigger-bot bot mentioned this pull request Mar 28, 2023

[Backport 2.6] Add documentation for jwt_clock_skew_tolerance_seconds setting that resolves authentication errors #3607

Merged

vagimeli added a commit that referenced this pull request May 4, 2023

Revert "Add documentation for jwt_clock_skew_tolerance_seconds settin…

40aa6ad

…g that resolves authentication errors (#3251)" This reverts commit d9bf5dc.


		## Time disparity compensation for JSON Web Token validation

		Occasionally you may find that the clock times between the validation server and the OpenSearch node are not perfectly synchronized. When this is the case, even by a few seconds, the system that either issues or receives a JWT may try to validate `nbf` (not before) and `exp` (expiration) claims and fail to authenticate the user due to the time disparity.

Conversation

cwillum commented Mar 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issues Resolved

Checklist

Uh oh!

cwillum commented Mar 7, 2023

Uh oh!

cwperks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cwperks Mar 7, 2023

Choose a reason for hiding this comment

Uh oh!

cwillum Mar 7, 2023

Choose a reason for hiding this comment

Uh oh!

cwillum left a comment

Choose a reason for hiding this comment

Uh oh!

cwillum Mar 7, 2023

Choose a reason for hiding this comment

Uh oh!

cwillum commented Mar 17, 2023

Uh oh!

JeffHuss left a comment

Choose a reason for hiding this comment

Uh oh!

cwillum commented Mar 27, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

carolxob left a comment

Choose a reason for hiding this comment

Uh oh!

hdhalter left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

hdhalter Mar 27, 2023

Choose a reason for hiding this comment

Uh oh!

cwillum Mar 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

natebower left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

cwillum commented Mar 7, 2023 •

edited

Loading

cwillum Mar 28, 2023 •

edited

Loading