Make it possible to use Kibana anonymous authentication provider with ES anonymous access. #84074

azasypkin · 2020-11-23T13:27:48Z

This PR makes it possible to use Kibana authentication provider with the Elasticsearch native anonymous access. The gist of the change is that xpack.security.authc.providers.anonymous.<provider-name>.credentials supports third type of credentials: elasticsearch_anonymous_user string literal and provider will not send any Authorization headers to the Elasticsearch in this case.

Setup

Configure anonymous access in Elasticsearch:

xpack.security.authc.anonymous.username: anonymous
xpack.security.authc.anonymous.roles: anonymous

Configure anonymous access in Kibana without specifying any credentials:

xpack.security.authc.providers:
  basic.basic1:
    order: 0
  anonymous.anonymous1:
    order: 1
    credentials: "elasticsearch_anonymous_user"

Log in as a user who has a manage_security privilege and create anonymous role with the privileges you wish anonymous users to have and you're done.

Unresolved questions/issues:

~~It seems reporting doesn't work in this configuration (investigating...)~~ Turned out it wasn't related to this PR

Resolves #35613

… ES anonymous access.

elasticmachine · 2020-11-25T09:20:25Z

Pinging @elastic/kibana-security (Team:Security)

legrego · 2020-11-30T20:29:53Z

There aren't any concrete requirements listed, but do you think this PR resolves #35613? I think from an end-user perspective it does, but we still run the "risk" of running the Kibana system account as the anonymous user (i.e. not specifying elasticsearch.username or elasticsearch.password).

I don't think this is necessarily a problem, but is potentially something we can surface in a security center or similar in the future.

legrego

Haven't tested locally yet, so up to you if you want to respond to feedback now, or wait for me to run this locally (hopefully tomorrow or Wednesday). Thanks for opening this!

x-pack/plugins/security/server/config.ts

+        credentials: schema.maybe(
+          schema.oneOf([
+            schema.object({
+              username: schema.string(),
+              password: schema.string(),
+            }),
+            schema.object({
+              apiKey: schema.oneOf([
+                schema.object({ id: schema.string(), key: schema.string() }),
+                schema.string(),
+              ]),
+            }),
+          ])
+        ),


legrego · 2020-11-30T20:22:24Z

x-pack/plugins/security/server/authentication/providers/anonymous.ts

@@ -164,7 +167,9 @@ export class AnonymousAuthenticationProvider extends BaseAuthenticationProvider
   * @param state State value previously stored by the provider.
   */
  private async authenticateViaAuthorizationHeader(request: KibanaRequest, state?: unknown) {
-    const authHeaders = { authorization: this.httpAuthorizationHeader.toString() };
+    const authHeaders = this.httpAuthorizationHeader


question What do you think about testing for a 401 response in the event that we've attempted to use native anonymous access against a cluster or node that isn't setup for it? We could log a more informative message that way, warning the administrator that their setup isn't configured correctly.

Sure, but it seems we can/should do that for all types of anonymous authentication (if apiKey isn't valid, if username or password isn't valid and if anonymous access isn't configured)?

Added for all cases.

…dentials type to be more explicit.

azasypkin · 2020-12-01T10:56:40Z

There aren't any concrete requirements listed, but do you think this PR resolves #35613? I think from an end-user perspective it does, but we still run the "risk" of running the Kibana system account as the anonymous user (i.e. not specifying elasticsearch.username or elasticsearch.password).

Technically yes since Kibana is usable in this configuration now (ES anonymous access + Kibana with enabled security) assuming anonymous roles give enough privileges for Kibana's internal operations. Whether we provide an ideal UX or not is probably a different question and depends on user requirements that we don't have yet 🙂

I don't think this is necessarily a problem, but is potentially something we can surface in a security center or similar in the future.

Yep, agree.

kibanamachine · 2020-12-01T12:03:17Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 924749c

Metrics [docs]

✅ unchanged

History

💚 Build #90588 succeeded cacd94a
💚 Build #90154 succeeded 56c6eec
💚 Build #89597 succeeded e22d8f70afa393e27ea0d66f166550ea32839085

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

legrego

LGTM, thanks for the edits!

… ES anonymous access. (elastic#84074)

* master: [Lens] Show color in flyout instead of auto (elastic#84532) [Lens] Use index pattern through service instead of reading saved object (elastic#84432) Make it possible to use Kibana anonymous authentication provider with ES anonymous access. (elastic#84074) TelemetryCollectionManager: Use X-Pack strategy as an OSS overwrite (elastic#84477) migrate away from rest_total_hits_as_int (elastic#84508) [Input Control] Custom renderer (elastic#84423) Attempt to more granularly separate App Search vs Workplace Search vs shared GitHub notifications (elastic#84713) [Security Solutino][Case] Case connector alert UI (elastic#82405) [Maps] Support runtime fields in tooltips (elastic#84377) [CCR] Fix row actions in follower index and auto-follow pattern tables (elastic#84433) [Enterprise Search] Migrate shared Indexing Status component (elastic#84571) [maps] remove fields from index-pattern test artifacts (elastic#84379) Add routes for use in Sources Schema (elastic#84579) Changes UI links for drilldowns (elastic#83971) endpoint telemetry cloned endpoint tests (elastic#81498) [Fleet] Handler api key creation errors when Fleet Admin is invalid (elastic#84576)

azasypkin · 2020-12-02T10:26:27Z

7.x/7.11.0: e7b7641

* master: (72 commits) Make alert status fetching more resilient (elastic#84676) [APM] Refactor hooks and context (elastic#84615) Added word break styles to the texts in the item details card. (elastic#84654) [Search] Disable "send to background" when auto-refresh is enabled (elastic#84106) Add readme for new palette service (elastic#84512) Make all providers to preserve original URL when session expires. (elastic#84229) [Lens] Show color in flyout instead of auto (elastic#84532) [Lens] Use index pattern through service instead of reading saved object (elastic#84432) Make it possible to use Kibana anonymous authentication provider with ES anonymous access. (elastic#84074) TelemetryCollectionManager: Use X-Pack strategy as an OSS overwrite (elastic#84477) migrate away from rest_total_hits_as_int (elastic#84508) [Input Control] Custom renderer (elastic#84423) Attempt to more granularly separate App Search vs Workplace Search vs shared GitHub notifications (elastic#84713) [Security Solutino][Case] Case connector alert UI (elastic#82405) [Maps] Support runtime fields in tooltips (elastic#84377) [CCR] Fix row actions in follower index and auto-follow pattern tables (elastic#84433) [Enterprise Search] Migrate shared Indexing Status component (elastic#84571) [maps] remove fields from index-pattern test artifacts (elastic#84379) Add routes for use in Sources Schema (elastic#84579) Changes UI links for drilldowns (elastic#83971) ...

Make it possible to use Kibana anonymous authentication provider with…

56c6eec

… ES anonymous access.

azasypkin force-pushed the issue-xxx-anonymous-and-es branch from e22d8f7 to 56c6eec Compare November 25, 2020 07:40

azasypkin added the v8.0.0 label Nov 25, 2020

azasypkin marked this pull request as ready for review November 25, 2020 09:20

azasypkin requested a review from a team as a code owner November 25, 2020 09:20

Merge branch 'master' into issue-xxx-anonymous-and-es

cacd94a

legrego self-requested a review November 30, 2020 16:35

legrego reviewed Nov 30, 2020

View reviewed changes

azasypkin added 2 commits December 1, 2020 09:06

Merge branch 'master' into issue-xxx-anonymous-and-es

3fbc785

Review#1: add more helpful logs for the fail cases, use dedicated cre…

924749c

…dentials type to be more explicit.

azasypkin requested a review from legrego December 1, 2020 12:04

legrego added the needs_docs label Dec 1, 2020

legrego approved these changes Dec 1, 2020

View reviewed changes

azasypkin merged commit 8981d0e into elastic:master Dec 2, 2020

azasypkin deleted the issue-xxx-anonymous-and-es branch December 2, 2020 08:32

azasypkin mentioned this pull request Dec 2, 2020

[7.x] Make it possible to use Kibana anonymous authentication provider with ES anonymous access. (#84074) #84736

Merged

azasypkin added a commit to azasypkin/kibana that referenced this pull request Dec 2, 2020

Make it possible to use Kibana anonymous authentication provider with…

40dc05b

… ES anonymous access. (elastic#84074)

azasypkin added the backported label Dec 2, 2020

azasypkin mentioned this pull request Dec 3, 2020

[Docs] Document Anonymous authentication provider. #84910

Merged

azasypkin mentioned this pull request Dec 14, 2020

Implement AnonymousAuthenticationProvider. #79985

Merged

jaronoff97 mentioned this pull request Jan 8, 2021

Anonymous User Authentication Failing #87775

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make it possible to use Kibana anonymous authentication provider with ES anonymous access. #84074

Make it possible to use Kibana anonymous authentication provider with ES anonymous access. #84074

azasypkin commented Nov 23, 2020 •

edited by legrego

Loading

elasticmachine commented Nov 25, 2020

legrego commented Nov 30, 2020

legrego left a comment

This comment was marked as resolved.

This comment was marked as resolved.

legrego Nov 30, 2020

azasypkin Dec 1, 2020

azasypkin Dec 1, 2020

azasypkin commented Dec 1, 2020

kibanamachine commented Dec 1, 2020

legrego left a comment

azasypkin commented Dec 2, 2020

Make it possible to use Kibana anonymous authentication provider with ES anonymous access. #84074

Make it possible to use Kibana anonymous authentication provider with ES anonymous access. #84074

Conversation

azasypkin commented Nov 23, 2020 • edited by legrego Loading

Setup

elasticmachine commented Nov 25, 2020

legrego commented Nov 30, 2020

legrego left a comment

Choose a reason for hiding this comment

This comment was marked as resolved.

This comment was marked as resolved.

legrego Nov 30, 2020

Choose a reason for hiding this comment

azasypkin Dec 1, 2020

Choose a reason for hiding this comment

azasypkin Dec 1, 2020

Choose a reason for hiding this comment

azasypkin commented Dec 1, 2020

kibanamachine commented Dec 1, 2020

💚 Build Succeeded

Metrics [docs]

History

legrego left a comment

Choose a reason for hiding this comment

azasypkin commented Dec 2, 2020

azasypkin commented Nov 23, 2020 •

edited by legrego

Loading