Skip to content

Make Authn and Audit take a HTTP interface when dealing with Rest requests#94990

Merged
albertzaharovits merged 9 commits intoelastic:mainfrom
albertzaharovits:authn-in-header-validator
Apr 4, 2023
Merged

Make Authn and Audit take a HTTP interface when dealing with Rest requests#94990
albertzaharovits merged 9 commits intoelastic:mainfrom
albertzaharovits:authn-in-header-validator

Conversation

@albertzaharovits
Copy link
Copy Markdown
Contributor

@albertzaharovits albertzaharovits commented Apr 3, 2023

AuthN and Audit are NOT going to have access to the Rest
interface anymore, because the AuthenticationService is
going to be invoked before the RestRequest is built.

This refactoring makes the AuthenticationService and
the AuditTrail take as parameters HTTP-related request
interfaces.

@albertzaharovits albertzaharovits added :Security/Security Security issues without another label >refactoring labels Apr 3, 2023
@albertzaharovits albertzaharovits changed the title Audit and failure use the HTTP interface Make Authn and Audit take a HTTP interface when dealing with Rest requests Apr 3, 2023
.with(PRINCIPAL_FIELD_NAME, token.principal())
.withRestUriAndMethod(request)
.withRestOrigin(threadContext)
.withRequestBody(request)
Copy link
Copy Markdown
Contributor Author

@albertzaharovits albertzaharovits Apr 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Authn failed & similar events are going to not display the request body anymore.

import java.util.List;
import java.util.Map;

public interface HttpRequestLineAndHeaders {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New slim interface for HTTP requests which, importantly, doesn't expose access to the contents fo the request body.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: can we call this HttpRequestLite or maybe or HttpNoBodyRequest or maybe change the existing one to HttpRequestWithBody and just call this HttpRequest ? The existing name IMO is hard to mentally parse since request line isn't something we tend to deal with much (and this class doesn't actually expose the raw line). Also, the name limits future uses of this interface to just a line and headers. (just a nitpick, feel free to ignore)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like HttpRequestLite because it's too ambiguous.
HttpNoBodyRequest makes it odd to serve as the base class of a request which does have a body (HttpRequest extends HttpNoBodyRequest). In addition, there are requests with no body (GETs), but this is not that. It's just a part of a full request that might or might not have a body, just that the body is not available yet, or in this particular abstraction.
I also don't like HttpRequestWithBody as it's very specific, as usually it's not important that it has a body; it's assumed to have one in all the many contexts where HTTP requests exist.

I went with HttpPreRequest it's like HttpRequestLite I think but conveys that it's actually part of a full request, more specifically the initial part of such.

final RestRequest wrappedRequest = maybeWrapRestRequest(request);
RemoteHostHeader.process(request, threadContext);
authenticationService.authenticate(wrappedRequest, ActionListener.wrap(authentication -> {
authenticationService.authenticate(wrappedRequest.getHttpRequest(), ActionListener.wrap(authentication -> {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just temporary: the authenticationService.authenticate method is going to be invoked before a RestRequest is built. This is to be handled in the follow-up PR. For now, just call the authenticate method with the HTTP request that's used to construct the RestRequest.

* @return the {@link RestRequest.Method} used in the REST request
* @throws IllegalArgumentException if the HTTP method is invalid
*/
RestRequest.Method method();
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to refactor RestRequest.Method and bring the Method inner class to this interface, but the changeset is going to be huge. Should I go ahead?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it is massive, I would prefer a standalone PR. If it is just moving stuff around, that is pretty quick/easy to review.

@albertzaharovits albertzaharovits marked this pull request as ready for review April 3, 2023 18:00
@elasticsearchmachine elasticsearchmachine added the Team:Security Meta label for security team label Apr 3, 2023
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (Team:Security)

Copy link
Copy Markdown
Contributor

@jakelandis jakelandis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

import java.util.List;
import java.util.Map;

public interface HttpRequestLineAndHeaders {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: can we call this HttpRequestLite or maybe or HttpNoBodyRequest or maybe change the existing one to HttpRequestWithBody and just call this HttpRequest ? The existing name IMO is hard to mentally parse since request line isn't something we tend to deal with much (and this class doesn't actually expose the raw line). Also, the name limits future uses of this interface to just a line and headers. (just a nitpick, feel free to ignore)

* @return the {@link RestRequest.Method} used in the REST request
* @throws IllegalArgumentException if the HTTP method is invalid
*/
RestRequest.Method method();
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it is massive, I would prefer a standalone PR. If it is just moving stuff around, that is pretty quick/easy to review.

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

@elasticsearchmachine run elasticsearch-ci/part-1-fips

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

@elasticsearchmachine run elasticsearch-ci/bwc

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

@elasticsearchmachine update branch

@albertzaharovits
Copy link
Copy Markdown
Contributor Author

@elasticmachine run elasticsearch-ci/part-1-fips

@albertzaharovits albertzaharovits merged commit a8d5723 into elastic:main Apr 4, 2023
@albertzaharovits albertzaharovits deleted the authn-in-header-validator branch April 4, 2023 13:56
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Jun 13, 2023
…uests (elastic#94990)

AuthN and Audit are NOT going to have access to the Rest
interface anymore, because the AuthenticationService is
going to be invoked before the RestRequest is built.

This refactoring makes the AuthenticationService and
the AuditTrail take as parameters HTTP-related request
interfaces.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>refactoring :Security/Security Security issues without another label Team:Security Meta label for security team v8.8.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants