Skip to content

Commit fe9442b

Browse files
jkakavasjkakavas
authored
Add an OpenID Connect authentication realm (#40674) (#41178)
This commit adds an OpenID Connect authentication realm to elasticsearch. Elasticsearch (with the assistance of kibana or another web component) acts as an OpenID Connect Relying Party and supports the Authorization Code Grant and Implicit flows as described in http://ela.st/oidc-spec. It adds support for consuming and verifying signed ID Tokens, both RP initiated and 3rd party initiated Single Sign on and RP initiated signle logout. It also adds an OpenID Connect Provider in the idp-fixture to be used for the associated integration tests. This is a backport of #40674
1 parent 2980a6c commit fe9442b

File tree

69 files changed

+7229
-10
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+7229
-10
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectAuthenticateAction.java

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.Action;
9+
import org.elasticsearch.common.io.stream.Writeable;
10+
11+
/**
12+
* Action for initiating an authentication process using OpenID Connect
13+
*/
14+
public final class OpenIdConnectAuthenticateAction extends Action<OpenIdConnectAuthenticateResponse> {
15+
16+
public static final OpenIdConnectAuthenticateAction INSTANCE = new OpenIdConnectAuthenticateAction();
17+
public static final String NAME = "cluster:admin/xpack/security/oidc/authenticate";
18+
19+
private OpenIdConnectAuthenticateAction() {
20+
super(NAME);
21+
}
22+
23+
@Override
24+
public OpenIdConnectAuthenticateResponse newResponse() {
25+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
26+
}
27+
28+
@Override
29+
public Writeable.Reader<OpenIdConnectAuthenticateResponse> getResponseReader() {
30+
return OpenIdConnectAuthenticateResponse::new;
31+
}
32+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectAuthenticateRequest.java

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.ActionRequest;
9+
import org.elasticsearch.action.ActionRequestValidationException;
10+
import org.elasticsearch.common.Strings;
11+
import org.elasticsearch.common.io.stream.StreamInput;
12+
import org.elasticsearch.common.io.stream.StreamOutput;
13+
14+
import java.io.IOException;
15+
16+
import static org.elasticsearch.action.ValidateActions.addValidationError;
17+
18+
/**
19+
* Represents a request for authentication using OpenID Connect
20+
*/
21+
public class OpenIdConnectAuthenticateRequest extends ActionRequest {
22+
23+
/**
24+
* The URI where the OP redirected the browser after the authentication attempt. This is passed as is from the
25+
* facilitator entity (i.e. Kibana)
26+
*/
27+
private String redirectUri;
28+
29+
/**
30+
* The state value that we generated or the facilitator provided for this specific flow and that should be stored at the user's session
31+
* with the facilitator
32+
*/
33+
private String state;
34+
35+
/**
36+
* The nonce value that we generated or the facilitator provided for this specific flow and that should be stored at the user's session
37+
* with the facilitator
38+
*/
39+
private String nonce;
40+
41+
public OpenIdConnectAuthenticateRequest() {
42+
43+
}
44+
45+
public OpenIdConnectAuthenticateRequest(StreamInput in) throws IOException {
46+
super.readFrom(in);
47+
redirectUri = in.readString();
48+
state = in.readString();
49+
nonce = in.readString();
50+
}
51+
52+
public String getRedirectUri() {
53+
return redirectUri;
54+
}
55+
56+
public void setRedirectUri(String redirectUri) {
57+
this.redirectUri = redirectUri;
58+
}
59+
60+
public String getState() {
61+
return state;
62+
}
63+
64+
public void setState(String state) {
65+
this.state = state;
66+
}
67+
68+
public String getNonce() {
69+
return nonce;
70+
}
71+
72+
public void setNonce(String nonce) {
73+
this.nonce = nonce;
74+
}
75+
76+
@Override
77+
public ActionRequestValidationException validate() {
78+
ActionRequestValidationException validationException = null;
79+
if (Strings.isNullOrEmpty(state)) {
80+
validationException = addValidationError("state parameter is missing", validationException);
81+
}
82+
if (Strings.isNullOrEmpty(nonce)) {
83+
validationException = addValidationError("nonce parameter is missing", validationException);
84+
}
85+
if (Strings.isNullOrEmpty(redirectUri)) {
86+
validationException = addValidationError("redirect_uri parameter is missing", validationException);
87+
}
88+
return validationException;
89+
}
90+
91+
@Override
92+
public void writeTo(StreamOutput out) throws IOException {
93+
super.writeTo(out);
94+
out.writeString(redirectUri);
95+
out.writeString(state);
96+
out.writeString(nonce);
97+
}
98+
99+
@Override
100+
public void readFrom(StreamInput in) {
101+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
102+
}
103+
104+
public String toString() {
105+
return "{redirectUri=" + redirectUri + ", state=" + state + ", nonce=" + nonce + "}";
106+
}
107+
}
108+

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectAuthenticateRequestBuilder.java

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.ActionRequestBuilder;
9+
import org.elasticsearch.client.ElasticsearchClient;
10+
11+
/**
12+
* Request builder for populating a {@link OpenIdConnectAuthenticateRequest}
13+
*/
14+
public class OpenIdConnectAuthenticateRequestBuilder
15+
extends ActionRequestBuilder<OpenIdConnectAuthenticateRequest, OpenIdConnectAuthenticateResponse> {
16+
17+
public OpenIdConnectAuthenticateRequestBuilder(ElasticsearchClient client) {
18+
super(client, OpenIdConnectAuthenticateAction.INSTANCE, new OpenIdConnectAuthenticateRequest());
19+
}
20+
21+
public OpenIdConnectAuthenticateRequestBuilder redirectUri(String redirectUri) {
22+
request.setRedirectUri(redirectUri);
23+
return this;
24+
}
25+
26+
public OpenIdConnectAuthenticateRequestBuilder state(String state) {
27+
request.setState(state);
28+
return this;
29+
}
30+
31+
public OpenIdConnectAuthenticateRequestBuilder nonce(String nonce) {
32+
request.setNonce(nonce);
33+
return this;
34+
}
35+
36+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectAuthenticateResponse.java

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.ActionResponse;
9+
import org.elasticsearch.common.io.stream.StreamInput;
10+
import org.elasticsearch.common.io.stream.StreamOutput;
11+
import org.elasticsearch.common.unit.TimeValue;
12+
13+
import java.io.IOException;
14+
15+
public class OpenIdConnectAuthenticateResponse extends ActionResponse {
16+
private String principal;
17+
private String accessTokenString;
18+
private String refreshTokenString;
19+
private TimeValue expiresIn;
20+
21+
public OpenIdConnectAuthenticateResponse(String principal, String accessTokenString, String refreshTokenString, TimeValue expiresIn) {
22+
this.principal = principal;
23+
this.accessTokenString = accessTokenString;
24+
this.refreshTokenString = refreshTokenString;
25+
this.expiresIn = expiresIn;
26+
}
27+
28+
public OpenIdConnectAuthenticateResponse(StreamInput in) throws IOException {
29+
super.readFrom(in);
30+
principal = in.readString();
31+
accessTokenString = in.readString();
32+
refreshTokenString = in.readString();
33+
expiresIn = in.readTimeValue();
34+
}
35+
36+
public String getPrincipal() {
37+
return principal;
38+
}
39+
40+
public String getAccessTokenString() {
41+
return accessTokenString;
42+
}
43+
44+
public String getRefreshTokenString() {
45+
return refreshTokenString;
46+
}
47+
48+
public TimeValue getExpiresIn() {
49+
return expiresIn;
50+
}
51+
52+
@Override
53+
public void readFrom(StreamInput in) {
54+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
55+
}
56+
57+
@Override
58+
public void writeTo(StreamOutput out) throws IOException {
59+
super.writeTo(out);
60+
out.writeString(principal);
61+
out.writeString(accessTokenString);
62+
out.writeString(refreshTokenString);
63+
out.writeTimeValue(expiresIn);
64+
}
65+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectLogoutAction.java

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.Action;
9+
import org.elasticsearch.common.io.stream.Writeable;
10+
11+
public class OpenIdConnectLogoutAction extends Action<OpenIdConnectLogoutResponse> {
12+
13+
public static final OpenIdConnectLogoutAction INSTANCE = new OpenIdConnectLogoutAction();
14+
public static final String NAME = "cluster:admin/xpack/security/oidc/logout";
15+
16+
private OpenIdConnectLogoutAction() {
17+
super(NAME);
18+
}
19+
20+
@Override
21+
public OpenIdConnectLogoutResponse newResponse() {
22+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
23+
}
24+
25+
@Override
26+
public Writeable.Reader<OpenIdConnectLogoutResponse> getResponseReader() {
27+
return OpenIdConnectLogoutResponse::new;
28+
}
29+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectLogoutRequest.java

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.ActionRequest;
9+
import org.elasticsearch.action.ActionRequestValidationException;
10+
import org.elasticsearch.common.Nullable;
11+
import org.elasticsearch.common.Strings;
12+
import org.elasticsearch.common.io.stream.StreamInput;
13+
import org.elasticsearch.common.io.stream.StreamOutput;
14+
15+
import java.io.IOException;
16+
17+
import static org.elasticsearch.action.ValidateActions.addValidationError;
18+
19+
public final class OpenIdConnectLogoutRequest extends ActionRequest {
20+
21+
private String token;
22+
@Nullable
23+
private String refreshToken;
24+
25+
public OpenIdConnectLogoutRequest() {
26+
27+
}
28+
29+
public OpenIdConnectLogoutRequest(StreamInput in) throws IOException {
30+
super.readFrom(in);
31+
token = in.readString();
32+
refreshToken = in.readOptionalString();
33+
}
34+
35+
@Override
36+
public ActionRequestValidationException validate() {
37+
ActionRequestValidationException validationException = null;
38+
if (Strings.isNullOrEmpty(token)) {
39+
validationException = addValidationError("token is missing", validationException);
40+
}
41+
return validationException;
42+
}
43+
44+
public String getToken() {
45+
return token;
46+
}
47+
48+
public void setToken(String token) {
49+
this.token = token;
50+
}
51+
52+
public String getRefreshToken() {
53+
return refreshToken;
54+
}
55+
56+
public void setRefreshToken(String refreshToken) {
57+
this.refreshToken = refreshToken;
58+
}
59+
60+
@Override
61+
public void writeTo(StreamOutput out) throws IOException {
62+
super.writeTo(out);
63+
out.writeString(token);
64+
out.writeOptionalString(refreshToken);
65+
}
66+
67+
@Override
68+
public void readFrom(StreamInput in) {
69+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
70+
}
71+
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectLogoutResponse.java

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License;
4+
* you may not use this file except in compliance with the Elastic License.
5+
*/
6+
package org.elasticsearch.xpack.core.security.action.oidc;
7+
8+
import org.elasticsearch.action.ActionResponse;
9+
import org.elasticsearch.common.io.stream.StreamInput;
10+
import org.elasticsearch.common.io.stream.StreamOutput;
11+
12+
import java.io.IOException;
13+
14+
public final class OpenIdConnectLogoutResponse extends ActionResponse {
15+
16+
private String endSessionUrl;
17+
18+
public OpenIdConnectLogoutResponse(StreamInput in) throws IOException {
19+
super.readFrom(in);
20+
this.endSessionUrl = in.readString();
21+
}
22+
23+
public OpenIdConnectLogoutResponse(String endSessionUrl) {
24+
this.endSessionUrl = endSessionUrl;
25+
}
26+
27+
@Override
28+
public void readFrom(StreamInput in) {
29+
throw new UnsupportedOperationException("usage of Streamable is to be replaced by Writeable");
30+
}
31+
32+
@Override
33+
public void writeTo(StreamOutput out) throws IOException {
34+
super.writeTo(out);
35+
out.writeString(endSessionUrl);
36+
}
37+
38+
public String toString() {
39+
return "{endSessionUrl=" + endSessionUrl + "}";
40+
}
41+
42+
public String getEndSessionUrl() {
43+
return endSessionUrl;
44+
}
45+
}

0 commit comments

Comments
 (0)