sso-auth: issue with group validation #125
Description
Describe the bug
I configured the buzzfeed SSO proxy to allow only specific groups inside of my google organization, but I can still login with an account which is not part of any group specified in the allowed groups.
I'll attach only some of the (relevant) redacted configurations before I paste all the configurations
Upstream config:
- service: kibana
default:
from: kibana.service.ops.company.com
to: http://kibana-logging.logging:5601
options:
allowed_groups:
- group1@company-email.com
- group2@company-email.comLogs when I am logging in with my not allowed user (which is only part of group3@company-email.com but not part of group1 and group2):
{"error":"http: named cookie not present","level":"error","msg":"error authenticating user","remote_address":"x.x.x.x","service":"sso-proxy","time":"2018-11-27 16:17:25.11274"}
{"level":"info","msg":"starting OAuth flow","service":"sso-proxy","sign_in_url":{"Scheme":"https","Opaque":"","User":null,"Host":"sso-auth.service.ops.company.com","Path":"/sign_in","RawPath":"","ForceQuery":false,"RawQuery":"client_id=WTM4bkE3bWhPK0crMkp0QThTMWFwQUFkMWRrUkROcW0%3D\u0026redirect_uri=https%3A%2F%2Fkibana.service.ops.company.com%2Foauth2%2Fcallback\u0026response_type=code\u0026scope=\u0026sig=neUgpMO7aaAHxHHoj70RGot1e9glODgupdmBLM8ig3Y%3D\u0026state=9bsMNh4FKHWboLsCG_pwU9VmrUC5bgEqLukrwgM1QBVyN3qCPnMQpn0ltd17nIFw8O7CVj-eB6t8_6shM9keSTZlQyiquPbU5kaQwQaCC_3Jn0y7cETaei9b7Fnj8amIvMaLtC1VwNBQHrRroB90RuDRRVrvWLXa1m3o0qxHfwfpqwC5RzeokNYk_Jg9IwGMjr80PnfwAsDPs1wlbtiF7lQ%3D\u0026ts=1543335445","Fragment":""},"time":"2018-11-27 16:17:25.11274"}
{"action":"proxy","http_status":302,"level":"info","msg":"","remote_address":"x.x.x.x","request_duration":0.39268000000000003,"request_method":"GET","request_uri":"kibana.service.ops.company.com/ui/favicons/favicon-16x16.png","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"}
{"allowed_groups":null,"level":"info","msg":"validating groups","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"john.doe@company-email.com"}
{"in_groups":[],"level":"info","msg":"authentication complete","remote_address":"x.x.x.x","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"john.doe@company-email.com"}
{"action":"callback","http_status":302,"level":"info","msg":"","remote_address":"x.x.x.x","request_duration":2.855855,"request_method":"GET","request_uri":"kibana.service.ops.company.com/oauth2/callback?code=n4_dBI-clrawxIAbZC8JtUFshHisUEczKNxnCQE4lNENI9vwGucLU9UYIrcidACFIS-kaf2sOvWRjTi5sVBwagzIbW4EKn05IOyuyvnhzgpEh1baQMdt3hT6raowgzX_9EODkFRRDf5-6A6z-L50jH2UhZzmS_7pOwVzzWEr1d55c41nB0r75PSq7UCSnhLACTEdR8uz69jWfOjy3K2aguq1tu83x4apr8vF8LBqtnHOsR_lI4DKOzt9w8RN9xMA3XCEbSueJhRE-7e-sELaAndDOXPrs23od7rYo_pobJVrtVn1uEPGcwHIr2i5YzuW2EEu2ceqvVPAaf9pi6DvhWF4ge0VaeQMmOMZmNR11TX_YX4VpOzRcQ0Zhw_XvaukOFv-5YXuEAjuVJksfm890e0jav3Mo4VVDROPYhBvGrBJWpeNHKPns3RzLvhmfKI1g6Qy3UMSNCEh322cqCmh6LYAYqHycV_A5hFItRlYMFvXOPWV7k_VpI9_nSda5coc5bRLk_Br51g6TU1W4jm8DIna-tQVdQ3d6M5vlzArckYWKBW4A8rVSUbAtUA8_T89sigxg0i0Jx6MHES89S425jsPXzfGSCoATbSTtnq06KMX8uoGdscisRXe1npIb_6tWe9Mdnw%3D\u0026state=9bsMNh4FKHWboLsCG_pwU9VmrUC5bgEqLukrwgM1QBVyN3qCPnMQpn0ltd17nIFw8O7CVj-eB6t8_6shM9keSTZlQyiquPbU5kaQwQaCC_3Jn0y7cETaei9b7Fnj8amIvMaLtC1VwNBQHrRroB90RuDRRVrvWLXa1m3o0qxHfwfpqwC5RzeokNYk_Jg9IwGMjr80PnfwAsDPs1wlbtiF7lQ%3D","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"}
{"action":"proxy","http_status":200,"level":"info","msg":"","remote_address":"x.x.x.x","request_duration":3.2140099999999996,"request_method":"GET","request_uri":"kibana.service.ops.company.com/ui/favicons/favicon-16x16.png","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"john.doe@company-email.com","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36"}
{"action":"ping","http_status":200,"level":"info","msg":"","remote_address":"10.0.4.1:46784","request_duration":0.010053,"request_method":"GET","request_uri":"10.0.4.123:4180/ping","service":"sso-proxy","time":"2018-11-27 16:17:31.11274","user":"","user_agent":"kube-probe/1.11+"}
Expected behavior
Even if it is a missconfiguration on my side I'd expect definetely a more verbose log, which indicates during the login what groups are allowed, and what groups the logged user is attached to. Also I couldn't find any log lines which indicate that the service has successfully read all groups my google organization. I'd expect something like a list of read groups (or the number of successfully read groups using the google admin api credentials).
For instance the log line below should probably show the groups the user john.doe@company-email.com is part of, right? If this is correct, this doesn't work apparently, and I haven't seen any error logs right after starting the service (e. g. "Couldn't read groups from google organization"), nor did I receive a message which says, yes it worked.
{"in_groups":[],"level":"info","msg":"authentication complete","remote_address":"x.x.x.x","service":"sso-proxy","time":"2018-11-27 16:17:25.11274","user":"john.doe@company-email.com"}
Question:
How can I see if pulling the group information from my google organization did work or not?
Should the property in_groups during a login process show the organization groups which the user is part of?