Enable `bearer` scheme by default to support service token authorization #112654

joshdover · 2021-09-21T11:22:58Z

Summary

Related to #112648, required to allow Fleet Server to use its service account token for authorization against Fleet APIs in Kibana.

Updates the default for xpack.security.authc.http.schemes to include the bearer scheme
Adds functional tests for HTTP Bearer authorization (supports API calls, but not login or logout)
Updated documentation to reflect the changes

I wasn't sure if this change should have a release note or not, @elastic/kibana-security please let me know if I should add one.

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list

For maintainers

This was checked for breaking API changes and was labeled appropriately

joshdover · 2021-09-21T13:42:49Z

@elastic/kibana-security Any concerns with this change? Also, do you have any recommendations on where to add some functional test coverage for this?

jportner · 2021-09-27T15:36:28Z

@elastic/kibana-security Any concerns with this change? Also, do you have any recommendations on where to add some functional test coverage for this?

Just to be clear, this is related to the Fleet server changing to use a service account, yes?

We most recently changed how schemes are configured in 7.7 via #58126.

I'm not sure it makes sense for the bearer scheme to be automatically enabled for all providers. It does conflict with our docs on HTTP authentication. But I'm also not sure how else we could best bsupport Fleet functionality out of the box.

@azasypkin I hate to suggest this, but would it make sense to introduce a Kibana-specific scheme to support service accounts? Or maybe there's another option that I'm missing. I'll defer to you.

azasypkin · 2021-09-28T12:17:10Z

@azasypkin I hate to suggest this, but would it make sense to introduce a Kibana-specific scheme to support service accounts? Or maybe there's another option that I'm missing. I'll defer to you.

If it's to support service accounts then I think it'd fine to include bearer to the default list of supported HTTP schemes so that API requests to both Kibana and ES use the same scheme. It's already implicitly enabled in many cases anyway because of default autoSchemesEnabled: true flag. But as you mentioned, we'll need to a) update our docs, and b) update kibana.yml template in Cloud to include bearer if needed (Cloud overrides default value for xpack.security.authc.http.schemes to include basic)

Also, do you have any recommendations on where to add some functional test coverage for this?

It'd be great if you can add a couple of tests for this to x-pack/test/security_api_integration (e.g. create http_auth.config.ts with default xpack.security.authc config). We have several similar tests here.

joshdover · 2021-10-01T11:15:21Z

Just to be clear, this is related to the Fleet server changing to use a service account, yes?

Yep this is to support #112648

But as you mentioned, we'll need to a) update our docs, and b) update kibana.yml template in Cloud to include bearer if needed (Cloud overrides default value for xpack.security.authc.http.schemes to include basic)

Makes sense. I'll update this PR with the additional testing and update the relevant docs. I'll also open a PR for updating the Cloud stack pack for 7.x and 8.0.

Thanks for the guidance here, everyone.

x-pack/test/security_api_integration/tests/http_bearer/login.ts

azasypkin · 2021-10-07T10:12:34Z

ACK: will review today

azasypkin

Looks good to me, just a couple of nits and one suggestion.

docs/user/security/authentication/index.asciidoc

x-pack/test/security_api_integration/http_bearer.config.ts

x-pack/test/security_api_integration/tests/http_bearer/header.ts

x-pack/test/security_api_integration/tests/http_bearer/login.ts

x-pack/test/security_api_integration/tests/http_bearer/header.ts

…ervice-token

azasypkin

LGTM! Please don't forget to update Cloud kibana.yml template.

x-pack/test/security_api_integration/tests/http_bearer/header.ts

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

kibanamachine · 2021-10-11T16:16:23Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #159418 succeeded 127d060
💚 Build #157945 succeeded ec6a2e3
💔 Build #157938 failed 9d29ef5
💚 Build #154527 succeeded 43dbd25b22236a32dc7a7ec0bc86306f693463c9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @joshdover

kibanamachine · 2021-10-11T16:19:07Z

💔 Backport failed

Status	Branch	Result
❌	7.x	Commit could not be cherrypicked due to conflicts

To backport manually run:
node scripts/backport --pr 112654

kibanamachine · 2021-10-13T16:24:59Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112654 or prevent reminders by adding the backport:skip label.

kibanamachine · 2021-10-14T16:32:19Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112654 or prevent reminders by adding the backport:skip label.

kibanamachine · 2021-10-15T16:42:18Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112654 or prevent reminders by adding the backport:skip label.

kibanamachine · 2021-10-18T16:52:18Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112654 or prevent reminders by adding the backport:skip label.

…ion (elastic#112654) Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com> # Conflicts: # x-pack/plugins/security/server/usage_collector/security_usage_collector.test.ts

kibanamachine · 2021-10-19T16:53:23Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.

…orization (#112654) (#115557) Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

joshdover mentioned this pull request Sep 21, 2021

[Fleet] Allow elastic/fleet-server service account to call setup API #112648

Closed

5 tasks

joshdover self-assigned this Sep 21, 2021

jportner requested a review from azasypkin September 27, 2021 15:36

joshdover added 3 commits October 5, 2021 11:25

Enable bearer scheme by default to support service token authorization

2a84045

Add functional tests for http bearer scheme

608d8ad

Update docs

9d29ef5

joshdover force-pushed the add-support-for-service-token branch from 43dbd25 to 9d29ef5 Compare October 5, 2021 09:57

joshdover added Feature:Security/Authentication Platform Security - Authentication release_note:skip Skip the PR/issue when compiling release notes Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v7.16.0 v8.0.0 labels Oct 5, 2021

joshdover commented Oct 5, 2021

View reviewed changes

x-pack/test/security_api_integration/tests/http_bearer/login.ts Outdated Show resolved Hide resolved

joshdover marked this pull request as ready for review October 5, 2021 10:08

joshdover requested a review from a team as a code owner October 5, 2021 10:08

Fix test name suite rename

ec6a2e3

azasypkin reviewed Oct 7, 2021

View reviewed changes

joshdover added 3 commits October 11, 2021 11:08

Merge remote-tracking branch 'upstream/master' into add-support-for-s…

9fed02d

…ervice-token

Fix typo in docs

734fdc7

Update tests for PR comments

127d060

joshdover requested a review from azasypkin October 11, 2021 09:35

azasypkin approved these changes Oct 11, 2021

View reviewed changes

x-pack/test/security_api_integration/tests/http_bearer/header.ts Outdated Show resolved Hide resolved

Update x-pack/test/security_api_integration/tests/http_bearer/header.ts

1f55572

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

joshdover enabled auto-merge (squash) October 11, 2021 14:14

joshdover added the auto-backport Deprecated - use backport:version if exact versions are needed label Oct 11, 2021

joshdover merged commit b03237a into elastic:master Oct 11, 2021

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 13, 2021

joshdover mentioned this pull request Oct 19, 2021

[7.x] Enable bearer scheme by default to support service token authorization (#112654) #115557

Merged

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 19, 2021

joshdover added a commit that referenced this pull request Oct 19, 2021

[7.x] Enable bearer scheme by default to support service token auth…

e250fc5

…orization (#112654) (#115557) Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable `bearer` scheme by default to support service token authorization #112654

Enable `bearer` scheme by default to support service token authorization #112654

joshdover commented Sep 21, 2021 •

edited

Loading

joshdover commented Sep 21, 2021

jportner commented Sep 27, 2021

azasypkin commented Sep 28, 2021

joshdover commented Oct 1, 2021

azasypkin commented Oct 7, 2021

azasypkin left a comment

azasypkin left a comment

kibanamachine commented Oct 11, 2021

kibanamachine commented Oct 11, 2021

kibanamachine commented Oct 13, 2021

kibanamachine commented Oct 14, 2021

kibanamachine commented Oct 15, 2021

kibanamachine commented Oct 18, 2021

kibanamachine commented Oct 19, 2021

Enable bearer scheme by default to support service token authorization #112654

Enable bearer scheme by default to support service token authorization #112654

Conversation

joshdover commented Sep 21, 2021 • edited Loading

Summary

Checklist

For maintainers

joshdover commented Sep 21, 2021

jportner commented Sep 27, 2021

azasypkin commented Sep 28, 2021

joshdover commented Oct 1, 2021

azasypkin commented Oct 7, 2021

azasypkin left a comment

Choose a reason for hiding this comment

azasypkin left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 11, 2021

💚 Build Succeeded

Metrics [docs]

History

kibanamachine commented Oct 11, 2021

💔 Backport failed

kibanamachine commented Oct 13, 2021

kibanamachine commented Oct 14, 2021

kibanamachine commented Oct 15, 2021

kibanamachine commented Oct 18, 2021

kibanamachine commented Oct 19, 2021

Enable `bearer` scheme by default to support service token authorization #112654

Enable `bearer` scheme by default to support service token authorization #112654

joshdover commented Sep 21, 2021 •

edited

Loading