When a http request arrives, we first verify that it carries an authentication token (if it doesn't we throw an authentication exception). Beyond that, any action request that arrives, if it doesn't have an authentication token we assume system user identity. The rationale behind it is that if a request comes in via the transport, then the sending peer authenticated with a client auth cert (the cert acts as the guarantee here that the actor can be assumed as System)... otherwise, the request can come from the local node and triggered by the system (e.g. gateway recovery)
The System user only has permissions to internal apis (it doesn't have full access/permission to all the apis). when a System identity is assumed, the authorization service will grant/deny the request based on whether the request is an internal api or not.
Aso fixed the known actions (to be insync with 1.x branch)
Closeselastic/elasticsearch#45
Original commit: elastic/x-pack-elasticsearch@be27cb0e1b
- throw an error on initialization if the audit trail is configured with an unknown output
- removed unnecessary null checks
Original commit: elastic/x-pack-elasticsearch@8d26723553
Added `shield.n2n.enabled` property to disable this feature, so
it does not get added to the netty pipeline.
Original commit: elastic/x-pack-elasticsearch@d73d27619c
Removing all roles from a user result in an invalid line left in the
roles file. This commit simply removes the user from the roles file
in that case.
Original commit: elastic/x-pack-elasticsearch@c1f4a961fd
The roles file had been checked instead of the users file when checking
if the user already exists. This lead to wrong "user not found" error
messages.
Original commit: elastic/x-pack-elasticsearch@6fc5646ce7
The LDAP realm is a bind-per-user strategy and the group lookup strategy is configurable.
If a role mapping file is not defined, groups names are taken as role names.
Special configuration for active directory simplifies the configuration.
Integration Tests are using an embedded apache DS LDAP Server.
Original commit: elastic/x-pack-elasticsearch@ce20e1b3be
A strategy for extracting the related indices from a request. The default strategy relies on the request to either be `IndicesRequest` or `CompositeIndicesRequest`. But depending on the request type, there might be other strategies as well. For example, `GetIndexTemplatesRequest` only holds the template name and therefore requires a different strategy where the template is looked up in the cluster metadata and the indices are resolved from there.
This also cleans up the Permission class and makes sure that the indices are resolved once per request (and not once per configured group permission)
Original commit: elastic/x-pack-elasticsearch@95192ccdff
- It is now possible to assign index & cluster permission on an action level (not just the fixed privileges we defined).
- also added a test to check that all the actions elasticsearch has are indeed known to shield. So whenever a new action is introduced in elasticsearch, and shield is not aware of it, the build will fail. This will help us ensure that all actions in elasticsearch are 1) well formatted/categorized, 2) secured and "permissible"
Closeselastic/elasticsearch#19
Original commit: elastic/x-pack-elasticsearch@170c3b9185
Load transports in plugin. No need to specify any transport modules anymore.
Removed the transport modules.
Original commit: elastic/x-pack-elasticsearch@45f3245361
- Fixed a bug in the logic of applying the indices group permission check
- For the rest, mainly cosmetics refactoring (renaming & redundant code removal)
Original commit: elastic/x-pack-elasticsearch@748575dc2e
Created an initial set of documentation which can also be built
using `build_docs.pl` without errors.
Original commit: elastic/x-pack-elasticsearch@1a3ccf4eb9
Requests are now auth'ed on the transport level as well (in addition to the transport action level). This is required as some internal requests are not executed as actions, thus not going through the auth process in the transport action. Since we have n2n authentication, we also assume here that requests that are not associated with an authentication token are internal system calls. We then, auth the request as a system user.
Also Added a system realm (to handle system requests)
Original commit: elastic/x-pack-elasticsearch@2c917318f0
* Changed Authentication/AuthorizationException to always return RestStatus.UNAUTHORIZED
* Added the WWW-Authenticate header, which results in user/pass input in browsers
* Added tests and own assertions class
Closeselastic/elasticsearch#18
Original commit: elastic/x-pack-elasticsearch@c6ce084692
- Also added an overloaded version of the AuthenticationService#token method that accepts a default token and that doesn't thrown an authentication exception
- Added AuditTrail#authenticationFailed method at a higher level than the realm version. Now the realm authc failure will only be logged when trace is enabled. With this change, the audit trail logging is more consistent in its terminology (anonymous is now logged when no auth token is found)
- extended the level of audit trail logging tuning (now using all logging levels, incl. error & warn)
- Added tests for audit trails
- Added tests for authentication service
- Added mockito as a test lib (will serve as our mocking framework)
Original commit: elastic/x-pack-elasticsearch@8d21ab7484
- The authentication service now exposes a token() method to extract the token from the message
- The AuthenticationService#authenticate now accepts the token (extracted using the AuthenticationService#token)
- The Realm now exposes a support(AuthenticationToken) method
- The authc service will now consult all the realms that support a specific token, and the first realm that successfully authenticate will "win".
- Removed the SecurityActionFilter class - it wasn't tested or used anywhere. We'll add a new action filter in a separate commit
Original commit: elastic/x-pack-elasticsearch@e4dd36175f
- changed Privileges class (moved away from enum and use constants instead), now implies(...) can only work on same type privilege
- introduces Permissions.Global (replacing the generic Compound)
- Fixed FileRolesStore to use new privileges & permsissions
- Changed the file format for FileRolesStore. Now instead of the `indices::privileges` array, the indices permissions are defined as an object where the indices are the keys and the privileges are the values. This moves the configuration to pure yaml format.
- Added an option on the authorization service to extract all indices & aliases permitted for a specific user+privilege
Original commit: elastic/x-pack-elasticsearch@77afce767c
* Fixed issue, where client auth was never needed for HTTP.
* Changed parameter name to `require.client.auth`
* Added tests, removed useless code in SslIntegrationTests
Original commit: elastic/x-pack-elasticsearch@ea424e0ae4
In order to use the `esusers` tool and to crypt passwords, one needs
to have the jar packaged in the zip release. This adds the depdendency
to the assembly descriptor.
Original commit: elastic/x-pack-elasticsearch@82ae451892
- Also introduced an option to disable esusers auth (such that if users configured ldap, the audit trails won't get cluttered by failed authentication in esusers
- Moved the realms initialization to a dedicated Realms class
- Also introduce an option to completely disable shield while keeping the installed plugin and its settings
Original commit: elastic/x-pack-elasticsearch@b554ad5ba7
Now the UsernamePasswordToken, once resolved, is placed in the (new) request context as is (avoids the need to re-parse headers)
Original commit: elastic/x-pack-elasticsearch@f898a94157
Two new commands to the command line tool have been added
* esusers list: Allows to list all users with their roles or only a single one
* esusers roles: Allows to add or remove roles
Roles have been configured as to only consist of lowercase alphanumeric characters.
Original commit: elastic/x-pack-elasticsearch@6fcb4c56e4
Changed the scope of the guava dependency to prevent wrong imports and always use the shaded ones.
This required a change in the forbidden API signatures, as that tool alwyas try load the class and fail
if the class cannot be found.
Original commit: elastic/x-pack-elasticsearch@90a245423a
* Add config and bin directory to assembly
* Add main method to ESUsersTool so it starts
* Fix bin/esusers to actually start
* Fix ESUsersTool to write files in config/shield by default as each plugin has its own directory after installation
* Changed bin/ and config/ directory to reflect path after installation in ES
Original commit: elastic/x-pack-elasticsearch@7d4165e389
Used the existing infra structure to filter by ip in the netty pipeline
before any other handler is hit, in order to reject as soon as possible.
Right now the connection is simply closed.
The configuration is a simple YAML file which uses allow/deny rules
Original commit: elastic/x-pack-elasticsearch@000e44f8cc
Settings for SSL now all start with `shield` as well. Changed documentation and tests to reflect this.
Original commit: elastic/x-pack-elasticsearch@9dd3bc865e
Alexander Reelsen
uboness
javanna
c-a-m