Skip to content

Remove unnecessary details logged for OIDC#48271

Closed
bizybot wants to merge 8 commits intoelastic:masterfrom
bizybot:do-not-log
Closed

Remove unnecessary details logged for OIDC#48271
bizybot wants to merge 8 commits intoelastic:masterfrom
bizybot:do-not-log

Conversation

@bizybot
Copy link
Copy Markdown
Contributor

@bizybot bizybot commented Oct 21, 2019

This commit removes unnecessary details logged for OIDC.

This commit removes unnecessary details logged for
OIDC.
@bizybot bizybot added >bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 v7.5.0 v7.6.0 v6.8.5 labels Oct 21, 2019
@bizybot bizybot requested review from jkakavas and tvernum October 21, 2019 05:21
@elasticmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (:Security/Authentication)

Yogesh Gaikwad added 2 commits October 24, 2019 08:46
- truncate the string keeping first and last 2 chars.
- the `OIDCTokenResponse` did not parse the error
scenario correctly.
- checks for the response status and then on error prints
the response message as warning
Copy link
Copy Markdown
Contributor

@jkakavas jkakavas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a few comments

@bizybot
Copy link
Copy Markdown
Contributor Author

bizybot commented Oct 24, 2019

@elasticmachine run elasticsearch-ci/1

bizybot and others added 2 commits October 24, 2019 17:02
…ecurity/authc/oidc/OpenIdConnectAuthenticator.java

Co-Authored-By: Ioannis Kakavas <ikakavas@protonmail.com>
@jkakavas
Copy link
Copy Markdown
Contributor

I know one should not be using these JWT ID tokens for authentication but given that people use it I am be being more paranoid.

Note that we are not dealing with any and all kinds of JWTs here. This is specifically concerning the OpenID Connect specification and OpenID Connect's ID Tokens, that are not used for authentication.

@bizybot bizybot requested a review from jkakavas October 28, 2019 03:03
@tvernum
Copy link
Copy Markdown
Contributor

tvernum commented Oct 30, 2019

I'll defer to @jkakavas on this one.

@tvernum tvernum removed their request for review October 30, 2019 03:43
@bizybot
Copy link
Copy Markdown
Contributor Author

bizybot commented Oct 30, 2019

Hi @jkakavas, I have addressed your review comments, Could you please take a look when you get some time? Thank you for your time.

@tvernum
Copy link
Copy Markdown
Contributor

tvernum commented Oct 31, 2019

@jkakavas Can you run with this one.
If you think it needs changes and you need another reviewer, I'm happy to look at it again.

@jkakavas
Copy link
Copy Markdown
Contributor

Superseded by #48746

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants