|
| 1 | +/* |
| 2 | + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one |
| 3 | + * or more contributor license agreements. Licensed under the Elastic License; |
| 4 | + * you may not use this file except in compliance with the Elastic License. |
| 5 | + */ |
| 6 | +package org.elasticsearch.xpack.security.action.oidc; |
| 7 | + |
| 8 | +import com.nimbusds.jwt.JWT; |
| 9 | +import com.nimbusds.jwt.JWTParser; |
| 10 | +import org.apache.logging.log4j.LogManager; |
| 11 | +import org.apache.logging.log4j.Logger; |
| 12 | +import org.elasticsearch.ElasticsearchSecurityException; |
| 13 | +import org.elasticsearch.action.ActionListener; |
| 14 | +import org.elasticsearch.action.support.ActionFilters; |
| 15 | +import org.elasticsearch.action.support.HandledTransportAction; |
| 16 | +import org.elasticsearch.common.Strings; |
| 17 | +import org.elasticsearch.common.inject.Inject; |
| 18 | +import org.elasticsearch.common.io.stream.Writeable; |
| 19 | +import org.elasticsearch.tasks.Task; |
| 20 | +import org.elasticsearch.transport.TransportService; |
| 21 | +import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutAction; |
| 22 | +import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutRequest; |
| 23 | +import org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutResponse; |
| 24 | +import org.elasticsearch.xpack.core.security.authc.Authentication; |
| 25 | +import org.elasticsearch.xpack.core.security.authc.Realm; |
| 26 | +import org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult; |
| 27 | +import org.elasticsearch.xpack.core.security.user.User; |
| 28 | +import org.elasticsearch.xpack.security.authc.Realms; |
| 29 | +import org.elasticsearch.xpack.security.authc.TokenService; |
| 30 | +import org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectRealm; |
| 31 | + |
| 32 | +import java.io.IOException; |
| 33 | +import java.text.ParseException; |
| 34 | +import java.util.Map; |
| 35 | + |
| 36 | +/** |
| 37 | + * Transport action responsible for generating an OpenID connect logout request to be sent to an OpenID Connect Provider |
| 38 | + */ |
| 39 | +public class TransportOpenIdConnectLogoutAction extends HandledTransportAction<OpenIdConnectLogoutRequest, OpenIdConnectLogoutResponse> { |
| 40 | + |
| 41 | + private final Realms realms; |
| 42 | + private final TokenService tokenService; |
| 43 | + private static final Logger logger = LogManager.getLogger(TransportOpenIdConnectLogoutAction.class); |
| 44 | + |
| 45 | + @Inject |
| 46 | + public TransportOpenIdConnectLogoutAction(TransportService transportService, ActionFilters actionFilters, Realms realms, |
| 47 | + TokenService tokenService) { |
| 48 | + super(OpenIdConnectLogoutAction.NAME, transportService, actionFilters, |
| 49 | + (Writeable.Reader<OpenIdConnectLogoutRequest>) OpenIdConnectLogoutRequest::new); |
| 50 | + this.realms = realms; |
| 51 | + this.tokenService = tokenService; |
| 52 | + } |
| 53 | + |
| 54 | + @Override |
| 55 | + protected void doExecute(Task task, OpenIdConnectLogoutRequest request, ActionListener<OpenIdConnectLogoutResponse> listener) { |
| 56 | + invalidateRefreshToken(request.getRefreshToken(), ActionListener.wrap(ignore -> { |
| 57 | + try { |
| 58 | + final String token = request.getToken(); |
| 59 | + tokenService.getAuthenticationAndMetaData(token, ActionListener.wrap( |
| 60 | + tuple -> { |
| 61 | + final Authentication authentication = tuple.v1(); |
| 62 | + final Map<String, Object> tokenMetadata = tuple.v2(); |
| 63 | + validateAuthenticationAndMetadata(authentication, tokenMetadata); |
| 64 | + tokenService.invalidateAccessToken(token, ActionListener.wrap( |
| 65 | + result -> { |
| 66 | + if (logger.isTraceEnabled()) { |
| 67 | + logger.trace("OpenID Connect Logout for user [{}] and token [{}...{}]", |
| 68 | + authentication.getUser().principal(), |
| 69 | + token.substring(0, 8), |
| 70 | + token.substring(token.length() - 8)); |
| 71 | + } |
| 72 | + OpenIdConnectLogoutResponse response = buildResponse(authentication, tokenMetadata); |
| 73 | + listener.onResponse(response); |
| 74 | + }, listener::onFailure) |
| 75 | + ); |
| 76 | + }, listener::onFailure)); |
| 77 | + } catch (IOException e) { |
| 78 | + listener.onFailure(e); |
| 79 | + } |
| 80 | + }, listener::onFailure)); |
| 81 | + } |
| 82 | + |
| 83 | + private OpenIdConnectLogoutResponse buildResponse(Authentication authentication, Map<String, Object> tokenMetadata) { |
| 84 | + final String idTokenHint = (String) getFromMetadata(tokenMetadata, "id_token_hint"); |
| 85 | + final Realm realm = this.realms.realm(authentication.getAuthenticatedBy().getName()); |
| 86 | + final JWT idToken; |
| 87 | + try { |
| 88 | + idToken = JWTParser.parse(idTokenHint); |
| 89 | + } catch (ParseException e) { |
| 90 | + throw new ElasticsearchSecurityException("Token Metadata did not contain a valid IdToken", e); |
| 91 | + } |
| 92 | + return ((OpenIdConnectRealm) realm).buildLogoutResponse(idToken); |
| 93 | + } |
| 94 | + |
| 95 | + private void validateAuthenticationAndMetadata(Authentication authentication, Map<String, Object> tokenMetadata) { |
| 96 | + if (tokenMetadata == null) { |
| 97 | + throw new ElasticsearchSecurityException("Authentication did not contain metadata"); |
| 98 | + } |
| 99 | + if (authentication == null) { |
| 100 | + throw new ElasticsearchSecurityException("No active authentication"); |
| 101 | + } |
| 102 | + final User user = authentication.getUser(); |
| 103 | + if (user == null) { |
| 104 | + throw new ElasticsearchSecurityException("No active user"); |
| 105 | + } |
| 106 | + |
| 107 | + final Authentication.RealmRef ref = authentication.getAuthenticatedBy(); |
| 108 | + if (ref == null || Strings.isNullOrEmpty(ref.getName())) { |
| 109 | + throw new ElasticsearchSecurityException("Authentication {} has no authenticating realm", |
| 110 | + authentication); |
| 111 | + } |
| 112 | + final Realm realm = this.realms.realm(authentication.getAuthenticatedBy().getName()); |
| 113 | + if (realm == null) { |
| 114 | + throw new ElasticsearchSecurityException("Authenticating realm {} does not exist", ref.getName()); |
| 115 | + } |
| 116 | + if (realm instanceof OpenIdConnectRealm == false) { |
| 117 | + throw new IllegalArgumentException("Access token is not valid for an OpenID Connect realm"); |
| 118 | + } |
| 119 | + } |
| 120 | + |
| 121 | + private Object getFromMetadata(Map<String, Object> metadata, String key) { |
| 122 | + if (metadata.containsKey(key) == false) { |
| 123 | + throw new ElasticsearchSecurityException("Authentication token does not have OpenID Connect metadata [{}]", key); |
| 124 | + } |
| 125 | + Object value = metadata.get(key); |
| 126 | + if (null != value && value instanceof String == false) { |
| 127 | + throw new ElasticsearchSecurityException("In authentication token, OpenID Connect metadata [{}] is [{}] rather than " + |
| 128 | + "String", key, value.getClass()); |
| 129 | + } |
| 130 | + return value; |
| 131 | + |
| 132 | + } |
| 133 | + private void invalidateRefreshToken(String refreshToken, ActionListener<TokensInvalidationResult> listener) { |
| 134 | + if (refreshToken == null) { |
| 135 | + listener.onResponse(null); |
| 136 | + } else { |
| 137 | + tokenService.invalidateRefreshToken(refreshToken, listener); |
| 138 | + } |
| 139 | + } |
| 140 | +} |
0 commit comments