Force user to re-authenticate if token refresh fails with `400` status code. by azasypkin · Pull Request #33774 · elastic/kibana

azasypkin · 2019-03-25T10:08:38Z

Currently if Kibana relies on token auth provider and token refresh fails with 400 (includes all expected token refresh failures that indicate that refresh token is no longer valid) user gets stuck with the expired access/refresh token pair in the cookie and hence 400 invalid grant-like error for all their requests. The only solution in this case is to clear cookies manually.

In this PR we detect 400 error and if it's non-AJAX request we clear session and redirect user to the login page to re-authenticate. Behavior for AJAX requests stayed the same and similar to what we have for saml authentication provider.

/cc @epixa

…s code.

elasticmachine · 2019-03-25T10:08:41Z

Pinging @elastic/kibana-security

azasypkin · 2019-03-25T10:10:39Z

x-pack/plugins/security/server/lib/authentication/__tests__/authenticator.js

      sinon.assert.calledWithExactly(session.clear, notSystemAPIRequest);
    });

+    it('clears session if provider requested it via setting state to `null`.', async () => {


note: these tests are more like integration ones and I don't really like that, but not didn't want to change them too much in this PR.

azasypkin · 2019-03-25T10:15:22Z

x-pack/plugins/security/server/lib/authentication/authenticator.js

+        // If provider owned the session, but failed to authenticate anyway, that likely means that
+        // session is not valid and we should clear it. Also provider can specifically ask to clear
+        // session by setting it to `null` even if authentication attempt didn't fail.
+        if (authenticationResult.state === null || (


note: alternatively (instead of having different meaning for null and undefined) we could use something like this:

class AuthenticationResult { static ClearSession = Symbol('clear session'); ..... } ..... AuthenticationResult.redirect(....., AuthenticationResult.ClearSession);

IMO it'd make sense if we had several different symbols, but it's the only use case I can think of, so using null feels okay to me. What do you think?

Hmmm, what if we changed AuthenticationResult to have a shouldClearSession and shouldUpdateSession method? That way we can enforce the differentiation between null and undefined within AuthenticationResult itself.

Good idea! Will do.

azasypkin · 2019-03-25T10:17:51Z

x-pack/plugins/security/server/lib/authentication/providers/token.js

+        return AuthenticationResult.redirectTo(this._getLoginPageURL(request), null);
+      }
+
      return AuthenticationResult.failed(err);


note: I kept the same behavior for AJAX requests that was before and similar to what we have for saml. If we decide we want to treat AJAX requests differently it'd make sense to do it separately for both token and saml.

azasypkin · 2019-03-25T10:18:40Z

x-pack/plugins/security/server/lib/errors.ts

+ * Extracts error code from Boom and Elasticsearch "native" errors.
+ * @param error Error instance to extract status code from.
+ */
+export function getErrorStatusCode(error: any): number {


note: I'll use these method in PR that fixes #33646

elasticmachine · 2019-03-25T11:56:09Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

kobelb

Works great! One suggestion about the manner in which we differentiate between undefined and null.

kobelb · 2019-03-25T17:51:17Z

x-pack/plugins/security/server/lib/authentication/authenticator.js

+        // If provider owned the session, but failed to authenticate anyway, that likely means that
+        // session is not valid and we should clear it. Also provider can specifically ask to clear
+        // session by setting it to `null` even if authentication attempt didn't fail.
+        if (authenticationResult.state === null || (


Hmmm, what if we changed AuthenticationResult to have a shouldClearSession and shouldUpdateSession method? That way we can enforce the differentiation between null and undefined within AuthenticationResult itself.

kobelb · 2019-03-25T17:54:27Z

x-pack/plugins/security/server/lib/errors.test.ts

+import { errors as esErrors } from 'elasticsearch';
+import * as errors from './errors';
+
+describe('lib/errors', () => {


🥇 for switching this to jest.

elasticmachine · 2019-03-26T11:01:29Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request

…s code. (elastic#33774)

azasypkin · 2019-03-26T14:11:05Z

6.7/6.7.1: a8dcac0
7.0/7.0.0: 815a392
7.x/7.1.0: 85fffc5

* chore(NA): first changes on every package.json order to support new babel 7. chore(NA): build for kbn-pm with babel 7. * chore(NA): patch babel register to load typescrit * chore(NA): first working version with babel 7 replacing typescript compiler. * fix(NA): common preset declaration in order to make it work with babel-loader. * chore(na): organizing babel preset env package json. * chore(NA): mocha tests enabled. * fix(NA): typo on importing * test(NA): majority of x-pack tests ported to use babel-jest * fix(NA): report info button test with babel-jest. * fix(NA): polling service tests. * test(na): fix server plugins plugin tests. * test(NA): batch of test fixs for jest tests under babel-jest hoisting. * chore(NA): add babel plugin to hoist mock prefixed vars on jest tests. * chore(NA): update yarn.lock file. * chore(NA): tests passing. * chore(NA): remove wrong dep * chore(NA): fix tsconfig * chore(NA): skip babel for ts-jest. * chore(NA): selectively apply the plugin to strip off namespace from ts files. * chore(NA): remove not needed changes from ts tests * chore(NA): removed ts-jest dependency. chore(NA): migrate ts tests on x-pack to use babel-jest with the new pattern. * chore(NA): migrate kibana default distribution typescript tests to run with babel-jest and the new test mock pattern. * chore(NA): merge and solve conflicts with master. * chore(NA): fix problems reported by eslint * chore(NA): fix license ovveride for babel-plugin-mock-imports * chore(NA): update jest integration tests for kbn pm * chore(NA): update babel jest integration tests for kbn pm. * test(NA): update jest integration snapshot for kbn pm. * chore(NA): apply changes according to the pull request reviews. * chore(NA): apply changes according to the pull request reviews. * refact(NA): migrate jest tests to the new pattern. * fix(NA): babel 7 polyfill in the tests bundle. * chore(NA): restore needed step in order to compile x-pack with typescript. * chore(NA): change build to compile typescript with babel for the oss code. chore(NA): change transpile typescript task to only transpile types for x-pack. refact(NA): common preset for babel 7 * Revert "chore(NA): change build to compile typescript with babel for the oss code. chore(NA): change transpile typescript task to only transpile types for x-pack. refact(NA): common preset for babel 7" This reverts commit 2707d53. * fix(NA): import paths for tabConfigConst * chore(NA): fix transpiling error on browser tests * chore(NA): simplify kbn babel preset package. * chore(NA): migrate build to use babel transpiler for typescript excluding xpack. * fix(NA): introduced error on test quick task. * fix(NA): fix preset for client side code on build. * fix(NA): build with babel * fix(NA): negated patterns in the end. * fix(NA): kbn_tp_sample_panel_action creation. * fix(NA): babel typescript transform plugin workaround when exporting interface name. * refact(NA): remove not needed type cast to any on jest test. * docs(NA): add developement documentation about jest mocks test pattern. * chore(NA): missing unmerged path. * chore(NA): fix jest tests for template. * [CCR] Client integration tests (table lists) (#33525) * Force user to re-authenticate if token refresh fails with `400` status code. (#33774) * Improve performance of the Logstash Pipeline Viewer (#33793) Resolves #27513. _This PR is a combination of #31293 (the code changes) + #33570 (test updates). These two PRs were individually reviewed and merged into a feature branch. This combo PR here simply sets up the merge from the feature branch to `master`._ Summary of changes, taken from #31293: ## Before this PR The Logstash Pipeline Viewer UI would make a single Kibana API call to fetch all the information necessary to render the Logstash pipeline. This included information necessary to render the detail drawer that opens up when a user clicks on an individual vertex in the pipeline. Naturally, this single API call fetched _a lot_ of data, not just from the Kibana server but also, in turn, from Elasticsearch as well. The "pro" of this approach was that the user would see instantaneous results if they clicked on a vertex in a pipeline and opened the detail drawer for that vertex. The "cons" were the amount of computation Elasticsearch had to perform and the amount of data being transferred over the wire between Elasticsearch and the Kibana server as well as between the Kibana server and the browser. ## With this PR This PR makes the Kibana API call to fetch data necessary for **initially** rendering the pipeline — that is, with the detail drawer closed — much lighter. When the user clicks on a vertex in a pipeline, a second API call is then made to fetch data necessary for the detail drawer. ## Gains, by the numbers Based on a simple, 1-input, 1-filter, and 1-output pipeline. * Before this PR, the Elasticsearch `logstash_stats` API responses (multiple calls were made using the `composite` aggregation over the `date_histogram` aggregation) generated a total of 1228 aggregation buckets (before any `filter_path`s were applied but across all `composite` "pages"). With this PR, the single `logstash_stats` API response (note that this is just for the initial rendering of the pipeline, with the detail drawer closed) generated 12 buckets (also before any `filter_path`s were applied). That's a **99.02% reduction** in number of buckets. * Before this PR, the Elasticsearch `logstash_stats` API responses added up to 70319 bytes. With this PR, the single `logstash_stats` API response for the same pipeline is 746 bytes. That's a **98.93% reduction** in size. * Before this PR, the Elasticsearch `logstash_state` API response was 7718 bytes. With this PR, the API response for the same pipeline is 2328 bytes. That's a **69.83% reduction** in size. * Before this PR the Kibana API response was 51777 bytes. With this PR, the API response for the same pipeline is 2567 bytes (again, note that this is just for the initial rendering of the pipeline, with the detail drawer closed). That's a **95.04% reduction** in size. * [Maps] split settings into layer and source panels (#33788) * [Maps] split settings into layer and source panels * fix SCSS import * [env] exit if starting as root (#21563) * [env] exit if starting as root * fix windows * s/--allow-root * Typescript sample panel action (#33602) * Typescript sample panel action * Update EUI version to match main cabana version * update yarn.lock * add back typings include * use correct relative path * Home page "recent links" should communicate saved object type #21896 (#33694) * adds object type for screen order * adds object type for pointer hovering * Update src/legacy/ui/public/chrome/directives/header_global_nav/components/header.tsx Co-Authored-By: rockfield <philipp.b@ya.ru>

…s code. (#33774)

* chore(NA): first changes on every package.json order to support new babel 7. chore(NA): build for kbn-pm with babel 7. * chore(NA): patch babel register to load typescrit * chore(NA): first working version with babel 7 replacing typescript compiler. * fix(NA): common preset declaration in order to make it work with babel-loader. * chore(na): organizing babel preset env package json. * chore(NA): mocha tests enabled. * fix(NA): typo on importing * test(NA): majority of x-pack tests ported to use babel-jest * fix(NA): report info button test with babel-jest. * fix(NA): polling service tests. * test(na): fix server plugins plugin tests. * test(NA): batch of test fixs for jest tests under babel-jest hoisting. * chore(NA): add babel plugin to hoist mock prefixed vars on jest tests. * chore(NA): update yarn.lock file. * chore(NA): tests passing. * chore(NA): remove wrong dep * chore(NA): fix tsconfig * chore(NA): skip babel for ts-jest. * chore(NA): selectively apply the plugin to strip off namespace from ts files. * chore(NA): remove not needed changes from ts tests * chore(NA): removed ts-jest dependency. chore(NA): migrate ts tests on x-pack to use babel-jest with the new pattern. * chore(NA): migrate kibana default distribution typescript tests to run with babel-jest and the new test mock pattern. * chore(NA): merge and solve conflicts with master. * chore(NA): fix problems reported by eslint * chore(NA): fix license ovveride for babel-plugin-mock-imports * chore(NA): update jest integration tests for kbn pm * chore(NA): update babel jest integration tests for kbn pm. * test(NA): update jest integration snapshot for kbn pm. * chore(NA): apply changes according to the pull request reviews. * chore(NA): apply changes according to the pull request reviews. * refact(NA): migrate jest tests to the new pattern. * fix(NA): babel 7 polyfill in the tests bundle. * chore(NA): restore needed step in order to compile x-pack with typescript. * chore(NA): change build to compile typescript with babel for the oss code. chore(NA): change transpile typescript task to only transpile types for x-pack. refact(NA): common preset for babel 7 * Revert "chore(NA): change build to compile typescript with babel for the oss code. chore(NA): change transpile typescript task to only transpile types for x-pack. refact(NA): common preset for babel 7" This reverts commit 2707d53. * fix(NA): import paths for tabConfigConst * chore(NA): fix transpiling error on browser tests * chore(NA): simplify kbn babel preset package. * chore(NA): migrate build to use babel transpiler for typescript excluding xpack. * fix(NA): introduced error on test quick task. * fix(NA): fix preset for client side code on build. * fix(NA): build with babel * fix(NA): negated patterns in the end. * fix(NA): kbn_tp_sample_panel_action creation. * fix(NA): babel typescript transform plugin workaround when exporting interface name. * refact(NA): remove not needed type cast to any on jest test. * docs(NA): add developement documentation about jest mocks test pattern. * chore(NA): missing unmerged path. * chore(NA): fix jest tests for template. * [CCR] Client integration tests (table lists) (#33525) * Force user to re-authenticate if token refresh fails with `400` status code. (#33774) * Improve performance of the Logstash Pipeline Viewer (#33793) Resolves #27513. _This PR is a combination of #31293 (the code changes) + #33570 (test updates). These two PRs were individually reviewed and merged into a feature branch. This combo PR here simply sets up the merge from the feature branch to `master`._ Summary of changes, taken from #31293: ## Before this PR The Logstash Pipeline Viewer UI would make a single Kibana API call to fetch all the information necessary to render the Logstash pipeline. This included information necessary to render the detail drawer that opens up when a user clicks on an individual vertex in the pipeline. Naturally, this single API call fetched _a lot_ of data, not just from the Kibana server but also, in turn, from Elasticsearch as well. The "pro" of this approach was that the user would see instantaneous results if they clicked on a vertex in a pipeline and opened the detail drawer for that vertex. The "cons" were the amount of computation Elasticsearch had to perform and the amount of data being transferred over the wire between Elasticsearch and the Kibana server as well as between the Kibana server and the browser. ## With this PR This PR makes the Kibana API call to fetch data necessary for **initially** rendering the pipeline — that is, with the detail drawer closed — much lighter. When the user clicks on a vertex in a pipeline, a second API call is then made to fetch data necessary for the detail drawer. ## Gains, by the numbers Based on a simple, 1-input, 1-filter, and 1-output pipeline. * Before this PR, the Elasticsearch `logstash_stats` API responses (multiple calls were made using the `composite` aggregation over the `date_histogram` aggregation) generated a total of 1228 aggregation buckets (before any `filter_path`s were applied but across all `composite` "pages"). With this PR, the single `logstash_stats` API response (note that this is just for the initial rendering of the pipeline, with the detail drawer closed) generated 12 buckets (also before any `filter_path`s were applied). That's a **99.02% reduction** in number of buckets. * Before this PR, the Elasticsearch `logstash_stats` API responses added up to 70319 bytes. With this PR, the single `logstash_stats` API response for the same pipeline is 746 bytes. That's a **98.93% reduction** in size. * Before this PR, the Elasticsearch `logstash_state` API response was 7718 bytes. With this PR, the API response for the same pipeline is 2328 bytes. That's a **69.83% reduction** in size. * Before this PR the Kibana API response was 51777 bytes. With this PR, the API response for the same pipeline is 2567 bytes (again, note that this is just for the initial rendering of the pipeline, with the detail drawer closed). That's a **95.04% reduction** in size. * [Maps] split settings into layer and source panels (#33788) * [Maps] split settings into layer and source panels * fix SCSS import * [env] exit if starting as root (#21563) * [env] exit if starting as root * fix windows * s/--allow-root * Typescript sample panel action (#33602) * Typescript sample panel action * Update EUI version to match main cabana version * update yarn.lock * add back typings include * use correct relative path * Home page "recent links" should communicate saved object type #21896 (#33694) * adds object type for screen order * adds object type for pointer hovering * Update src/legacy/ui/public/chrome/directives/header_global_nav/components/header.tsx Co-Authored-By: rockfield <philipp.b@ya.ru>

Force user to re-authenticate if token refresh fails with 400 statu…

b4a29db

…s code.

azasypkin added bug Fixes for quality problems that affect the customer experience Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// Feature:Security/Authentication Platform Security - Authentication v7.2.0 v6.7.1 v7.0.1 labels Mar 25, 2019

azasypkin requested a review from a team as a code owner March 25, 2019 10:08

azasypkin commented Mar 25, 2019

View reviewed changes

This comment has been minimized.

Sign in to view

azasypkin requested a review from kobelb March 25, 2019 11:57

azasypkin mentioned this pull request Mar 25, 2019

Use refresh token for any access token error with 401 status code and re-authenticate user for any refresh token error with 400 status code. #33777

Merged

kobelb approved these changes Mar 25, 2019

View reviewed changes

azasypkin added 2 commits March 26, 2019 08:53

Merge branch 'master' into issue-xxx-token-refresh

599bacc

Introduce shouldUpdateState and shouldClearState.

20496ef

azasypkin merged commit 961f791 into elastic:master Mar 26, 2019

azasypkin deleted the issue-xxx-token-refresh branch March 26, 2019 11:05

azasypkin added the backport pending label Mar 26, 2019

azasypkin mentioned this pull request Mar 26, 2019

[7.x] Force user to re-authenticate if token refresh fails with 400 status code. (#33774) #33836

Merged

azasypkin added a commit to azasypkin/kibana that referenced this pull request Mar 26, 2019

Force user to re-authenticate if token refresh fails with 400 statu…

84e861d

…s code. (elastic#33774)

azasypkin mentioned this pull request Mar 26, 2019

[7.0] Force user to re-authenticate if token refresh fails with 400 status code. (#33774) #33837

Merged

azasypkin added a commit to azasypkin/kibana that referenced this pull request Mar 26, 2019

Force user to re-authenticate if token refresh fails with 400 statu…

bea6fb6

…s code. (elastic#33774)

azasypkin mentioned this pull request Mar 26, 2019

[6.7] Force user to re-authenticate if token refresh fails with 400 status code. (#33774) #33839

Merged

azasypkin added backported v7.0.0 and removed backport pending v7.0.1 labels Mar 26, 2019

joelgriffith pushed a commit that referenced this pull request Mar 27, 2019

Force user to re-authenticate if token refresh fails with 400 statu…

328af9e

…s code. (#33774)

Conversation

azasypkin commented Mar 25, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Mar 25, 2019

Uh oh!

azasypkin Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

azasypkin Mar 25, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kobelb Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

azasypkin Mar 26, 2019

Choose a reason for hiding this comment

Uh oh!

azasypkin Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

azasypkin Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

elasticmachine commented Mar 25, 2019

💚 Build Succeeded

Uh oh!

kobelb left a comment

Choose a reason for hiding this comment

Uh oh!

kobelb Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

kobelb Mar 25, 2019

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 26, 2019

💚 Build Succeeded

Uh oh!

azasypkin commented Mar 26, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

azasypkin commented Mar 25, 2019 •

edited

Loading

azasypkin Mar 25, 2019 •

edited

Loading

azasypkin commented Mar 26, 2019 •

edited

Loading