Support 3rd party initiated login for OpenID Connect #38474

jkakavas · 2019-02-05T23:36:05Z

https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin

- Use nimbus oidc sdk - JWE not handled - UserInfo requests not handled

…cation-flows

…alm-authentication-flows

- Make the calls to TokenEndpoint and UserInfoEndpoint asynchrously - Move IdTokenValidator to an instance variable

…alm-authentication-flows

Access Token will not be returned in the implicit flow if the response type is set to "id_token" (as opposed to "id_token token") In such cases, there is no access token to validate and we cannot make requests to the UserInfo endpoint, even if the user has configured the Userinfo endpoint in the configuration

Our tests now handle all applicable known attacks. References: - https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/30/oidc-security.pdf - https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2017/01/13/OIDCSecurity_1.pdf - https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

…alm-authentication-flows

elasticmachine · 2019-02-05T23:36:07Z

Pinging @elastic/es-security

albertzaharovits · 2019-02-11T14:45:41Z

This does not cover the spec you've pointed to:

login_hint
OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in. If the client receives a value for this string-valued parameter, it MUST include it in the Authentication Request as the login_hint parameter value.

The transport request for the prepare authentication request does not carry the login_hint parameter.

target_link_uri
OPTIONAL. URL that the RP is requested to redirect to after authentication. RPs MUST verify the value of the target_link_uri to prevent being used as an open redirector to external sites.

Do we have to keep this in the flow context and return it in the OpenIdConnectAuthenticateResponse ? 😒

jkakavas · 2019-02-11T15:57:55Z

The transport request for the prepare authentication request does not carry the login_hint parameter.

Yeap, thanks for keeping me honest here. I worked mostly from experience here and missed adding the login hint. It's rarely used AFAIK but it's easy to support so I'll add it.

Do we have to keep this in the flow context and return it in the OpenIdConnectAuthenticateResponse ? unamused

I don't think we should support target_link_uri. There aren't many use cases where the 3rd party would necessarily know a deep link within Kibana so that it would point the UA there from the beginning. Even if we do support this in the future, this should be a URI pointing to the facilitator only and as such, it can very well be stored in the user's session with the facilitator

albertzaharovits · 2019-02-11T17:15:47Z

I don't think we should support target_link_uri

I totally agree. This is the kind of flexibility we should refrain from following.

albertzaharovits

LGTM after updating the rest-transport PARSER

albertzaharovits · 2019-02-13T11:35:32Z

...sticsearch/xpack/security/rest/action/oidc/RestOpenIdConnectPrepareAuthenticationAction.java

@@ -36,6 +36,7 @@

    static {
        PARSER.declareString(OpenIdConnectPrepareAuthenticationRequest::setRealmName, new ParseField("realm"));
+        PARSER.declareString(OpenIdConnectPrepareAuthenticationRequest::setIssuer, new ParseField("iss"));


add:

PARSER.declareString(OpenIdConnectPrepareAuthenticationRequest::setLoginHint, new ParseField("login_hint"));

🤦‍♂️

jaymode

left some minor comments, otherwise LGTM

jaymode · 2019-02-13T21:47:24Z

...elasticsearch/xpack/core/security/action/oidc/OpenIdConnectPrepareAuthenticationRequest.java

+    /**
+     * In case of a
+     * <a href="https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin">3rd party initiated authentication</a>, the
+     * issuer to the UA needs to be redirected for authentication


Suggested change

* issuer to the UA needs to be redirected for authentication

* issuer that the User Agent needs to be redirected to for authentication.

jaymode · 2019-02-13T21:47:37Z

...elasticsearch/xpack/core/security/action/oidc/OpenIdConnectPrepareAuthenticationRequest.java

+        return loginHint;
+    }
+
+


Suggested change

jaymode · 2019-02-13T21:51:45Z

...sticsearch/xpack/security/action/oidc/TransportOpenIdConnectPrepareAuthenticationAction.java

-        if (null == realm || realm instanceof OpenIdConnectRealm == false) {
+        Realm realm = null;
+        if (Strings.hasText(request.getIssuer())) {
+            List<OpenIdConnectRealm> matchingRealms = this.realms.stream().filter(r -> r instanceof OpenIdConnectRealm)


can we use a single filter?

.filter(r -> r instanceof OpenIdConnectRealm && ((OpenIdConnectRealm) r).isIssuerValid(request.getIssuer()))

…ty-initiated

This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. The code in this commit has been tracked in a feature branch and has been previously reviewed and approved in : #37009 #37787 #38474 #38475 #40262

This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. The code in this commit has been tracked in a feature branch and has been previously reviewed and approved in : elastic#37009 elastic#37787 elastic#38474 elastic#38475 elastic#40262

jkakavas added 25 commits January 23, 2019 11:04

Implement code and implicit flows

6448271

- Use nimbus oidc sdk - JWE not handled - UserInfo requests not handled

fix licenses and SHAs for introduced dependencies

92f63ef

Support userinfo requests

19034ce

Merge remote-tracking branch 'origin/master' into oidc-realm-authenti…

aaa5426

…cation-flows

Add few tests

6614057

Fix bugs and add unit tests

b70526a

Merge remote-tracking branch 'origin/feature-oidc-realm' into oidc-re…

422319d

…alm-authentication-flows

Address Feedback

05910d9

- Make the calls to TokenEndpoint and UserInfoEndpoint asynchrously - Move IdTokenValidator to an instance variable

Merge remote-tracking branch 'origin/feature-oidc-realm' into oidc-re…

22e8bb7

…alm-authentication-flows

Merge remote-tracking branch 'origin/feature-oidc-realm' into oidc-re…

ad493a9

…alm-authentication-flows

Fix checkstyle

b3cbd8d

Make JWKSource reloading async

0a0ae0e

Merge remote-tracking branch 'origin/feature-oidc-realm' into oidc-re…

bc1f552

…alm-authentication-flows

fix thirdPartyAudit

baadcdb

address feedback

09413b5

cleanup

59bc122

re-introduce the option for facilitators to pass state and nonce values

b368ffc

remove unused import

81a1770

Merge branch 'feature-oidc-realm' into oidc-realm-authentication-flows

c9c1cf7

fix tests

3450541

Support 3rd party initiated authentication

8fd7f31

Merge branch 'oidc-realm-authentication-flows' into 3rd-party-initiated

354f7fd

Merge branch 'feature-oidc-realm' into 3rd-party-initiated

5937ec8

jkakavas added >feature :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Feb 5, 2019

jkakavas requested review from jaymode and albertzaharovits February 5, 2019 23:36

Merge branch 'feature-oidc-realm' into 3rd-party-initiated

d6a8474

jkakavas added 2 commits February 11, 2019 20:10

Merge branch 'feature-oidc-realm' into 3rd-party-initiated

afaf2e9

address feedback

4e0788e

jkakavas force-pushed the 3rd-party-initiated branch from 8cee04c to 4e0788e Compare February 11, 2019 18:11

albertzaharovits approved these changes Feb 13, 2019

View reviewed changes

jkakavas added 2 commits February 13, 2019 14:26

add parser field

0fbe3c7

Merge branch 'feature-oidc-realm' into 3rd-party-initiated

82fa677

jaymode approved these changes Feb 13, 2019

View reviewed changes

jkakavas added 2 commits February 22, 2019 15:43

Merge remote-tracking branch 'origin/feature-oidc-realm' into 3rd-par…

af22291

…ty-initiated

address feedback

00baca1

jkakavas merged commit 53c3061 into elastic:feature-oidc-realm Feb 25, 2019

jkakavas mentioned this pull request Apr 1, 2019

Add an OpenID Connect authentication realm #40674

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support 3rd party initiated login for OpenID Connect #38474

Support 3rd party initiated login for OpenID Connect #38474

jkakavas commented Feb 5, 2019

elasticmachine commented Feb 5, 2019

albertzaharovits commented Feb 11, 2019

jkakavas commented Feb 11, 2019 •

edited

Loading

albertzaharovits commented Feb 11, 2019

albertzaharovits left a comment

albertzaharovits Feb 13, 2019 •

edited

Loading

jkakavas Feb 13, 2019

jaymode left a comment

jaymode Feb 13, 2019

jaymode Feb 13, 2019

jaymode Feb 13, 2019

	* issuer to the UA needs to be redirected for authentication
	* issuer that the User Agent needs to be redirected to for authentication.

Support 3rd party initiated login for OpenID Connect #38474

Support 3rd party initiated login for OpenID Connect #38474

Conversation

jkakavas commented Feb 5, 2019

elasticmachine commented Feb 5, 2019

albertzaharovits commented Feb 11, 2019

jkakavas commented Feb 11, 2019 • edited Loading

albertzaharovits commented Feb 11, 2019

albertzaharovits left a comment

Choose a reason for hiding this comment

albertzaharovits Feb 13, 2019 • edited Loading

Choose a reason for hiding this comment

jkakavas Feb 13, 2019

Choose a reason for hiding this comment

jaymode left a comment

Choose a reason for hiding this comment

jaymode Feb 13, 2019

Choose a reason for hiding this comment

jaymode Feb 13, 2019

Choose a reason for hiding this comment

jaymode Feb 13, 2019

Choose a reason for hiding this comment

jkakavas commented Feb 11, 2019 •

edited

Loading

albertzaharovits Feb 13, 2019 •

edited

Loading