Skip to content

Adjust PKI bootstrap check for delegation#44767

Merged
albertzaharovits merged 4 commits intoelastic:proxied-pkifrom
albertzaharovits:security-pki-delegation-bootstrap-check-twist
Jul 24, 2019
Merged

Adjust PKI bootstrap check for delegation#44767
albertzaharovits merged 4 commits intoelastic:proxied-pkifrom
albertzaharovits:security-pki-delegation-bootstrap-check-twist

Conversation

@albertzaharovits
Copy link
Copy Markdown
Contributor

@albertzaharovits albertzaharovits commented Jul 23, 2019 •
edited
Loading

There is currently a bootstrap check that validates TLS client authentication is enabled (required or optional) in at least one context (transport or http) when there is at least one PKI realm enabled.
That is because clients cannot be authenticated by the PKI realm if there's no channel that supports mutually authn TLS. However, with the new proxied PKI authn scheme, this is no longer true; it is possible to authn via the proxied PKI scheme even if there is no mutually authn TLS channel configured.

This commit relaxes the bootstrap check to only fail if the PKI realm is enabled and does not support delegation.

Relates #34396

@albertzaharovits albertzaharovits added >enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Jul 23, 2019
@albertzaharovits albertzaharovits self-assigned this Jul 23, 2019
@elasticmachine
Copy link
Copy Markdown
Collaborator

elasticmachine commented Jul 23, 2019

Pinging @elastic/es-security

@albertzaharovits albertzaharovits mentioned this pull request Jul 23, 2019
Merged
tvernum
tvernum approved these changes Jul 24, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@tvernum tvernum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

albertzaharovits commented Jul 24, 2019

org.elasticsearch.smoketest.WatcherRestIT > initializationError FAILED
java.io.IOException: Error parsing painless/50_update_scripts
at org.elasticsearch.test.rest.yaml.section.ClientYamlTestSuite.parse(ClientYamlTestSuite.java:77)
at org.elasticsearch.test.rest.yaml.ESClientYamlSuiteTestCase.createParameters(ESClientYamlSuiteTestCase.java:194)
at org.elasticsearch.test.rest.yaml.ESClientYamlSuiteTestCase.createParameters(ESClientYamlSuiteTestCase.java:179)
at org.elasticsearch.smoketest.WatcherRestIT.parameters(WatcherRestIT.java:31)
Caused by:
ParsingException[Error parsing test named [Test transform scripts are updated on execution]]; nested: IllegalArgumentException[Expected [START_OBJECT, found [VALUE_NULL], the skip section is not properly indented];

@elasticmachine run elasticsearch-ci/2

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

albertzaharovits commented Jul 24, 2019

./gradlew :x-pack:plugin:data-frame:qa:single-node-tests:integTestRunner --tests "org.elasticsearch.xpack.dataframe.integration.DataFrameTaskFailedStateIT.testForceStartFailedTransform" -Dtests.seed=C1943C2CDA756B33 -Dtests.security.manager=true -Dtests.locale=vo -Dtests.timezone=America/Monterrey -Dcompiler.java=12 -Druntime.java=11

@elasticmachine run elasticsearch-ci/2

bizybot
bizybot approved these changes Jul 24, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@bizybot bizybot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, Thank you.

@albertzaharovits albertzaharovits merged commit a4bbba3 into elastic:proxied-pki Jul 24, 2019
@albertzaharovits albertzaharovits deleted the security-pki-delegation-bootstrap-check-twist branch July 24, 2019 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tvernum tvernum tvernum approved these changes

+1 more reviewer

@bizybot bizybot bizybot approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@albertzaharovits albertzaharovits

Labels

>enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@albertzaharovits @elasticmachine @bizybot @tvernum