Initial commit for multiple authentication by aoguan1990 · Pull Request #1110 · opensearch-project/security-dashboards-plugin

aoguan1990 · 2022-09-23T02:29:10Z

Signed-off-by: Aozixuan Priscilla Guan aoguan@amazon.com

Description

The purpose of this project is to leverage functionalities to allow OpenSearch Dashboards (OSD) users to Login/ Logout from the integrated Login/Logout UI with different authentication methodologies. OSD administer can enable single or multiple authentication type(s) on demand by setting up OpenSearch Dashboards configuration YML. For OpenSearch Dashboards with Security Plugin enabled, at least one authentication type is required.

Why these changes are required?

As for now, OpenSearch Dashboards supports many types of authentications including Basic, OIDC, SAML, LDAP, Proxy and Client-Certificate based authentication. However, only one authentication type can be configured in OpenSearch Dashboard while there is a high demand shows the opposite way. After capturing and analyzing customer requests from both GitHub and OpenSearch Community, the great value of enabling multiple authentication types simultaneously in OpenSearch Dashboards is self-evident.

Related Customer Request

GitHub Issues:
#1112
#2099
#74

OpenSeach Community Issues:
#354
#3164
#10553
#10233
#7015

What is the old behavior before changes and new behavior after changes?

Currently, OpenSearch Dashboards only allows users to login with single authentication type. Users can either use built-in login with username and password, or use single sign-on with external SAML/OIDC IDP. The following pain-points are observed:

OpenSearch Dashboards does not support users to login with built-in login and single sign-on approaches simultaneously
OpenSearch Dashboards does not provide built-in Login UI for single sign-on approach

In order to address the pain-points, this project proposes to utilize integrated and customizable Login/Logout UI to allow users to login/logout OpenSearch Dashboards with multiple authentication types, including Basic, SAML, OIDC and Anonymous.

Issues Resolved

Resolves [Feature-Proposal] Enable Multiple Authentication for OpenSearch Dashboard OpenSearch-Dashboards#2100

Testing

[unit testing, integration testing and manual testing]

Check List

New functionality includes testing
New functionality has been documented
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

codecov-commenter · 2022-09-23T02:40:33Z

Codecov Report

❌ Patch coverage is 62.82051% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.82%. Comparing base (6236fe2) to head (4165aba).
⚠️ Report is 285 commits behind head on main.

Files with missing lines	Patch %	Lines
public/apps/login/login-page.tsx	80.39%	6 Missing and 4 partials ⚠️
public/apps/account/utils.tsx	0.00%	9 Missing ⚠️
public/apps/account/account-app.tsx	44.44%	3 Missing and 2 partials ⚠️
public/apps/account/log-out-button.tsx	66.66%	2 Missing ⚠️
public/utils/logout-utils.tsx	0.00%	2 Missing ⚠️
public/plugin.ts	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1110      +/-   ##
==========================================
- Coverage   72.07%   71.82%   -0.26%     
==========================================
  Files          88       88              
  Lines        1959     2023      +64     
  Branches      258      268      +10     
==========================================
+ Hits         1412     1453      +41     
- Misses        490      508      +18     
- Partials       57       62       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cliu123 · 2022-09-23T18:53:32Z

CI failed.
@peterzhuamazon Is 2.4.0 security plugin artifact available?

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

This reverts commit 892180f508e2fabb31030de5d1178cf68c7820f2. Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Signed-off-by: Craig Perkins <cwperx@amazon.com> Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Signed-off-by: Ryan Liang <jiallian@amazon.com> Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

* Refactor + add support to run saml based integ tests via selenium web driver Signed-off-by: Deepak Devarakonda <devardee@amazon.com> * Add plugins.security.unsupported.restapi.allow_securityconfig_modification in developer guide Signed-off-by: Deepak Devarakonda <devardee@amazon.com> * Add one more test Signed-off-by: Deepak Devarakonda <devardee@amazon.com> * Added tests for checking tenancy retention after logout in SAML Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Lint formatting fixes Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Removed unused imports Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Add plugins.security.unsupported.restapi.allow_securityconfig_modification in developer guide Signed-off-by: Deepak Devarakonda <devardee@amazon.com> * Added License header Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added building the plugin bundles while running ITs Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Signed off the commit Removed a comment no longer required Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added debug loggers for checking IT failures Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added debug loggers for checking IT failures Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added debug loggers for checking IT failures Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added debug loggers for checking IT failures Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added a new stage for debug loggers before cleanup Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added a new stage for debug loggers before cleanup Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added logger to print error recieved from auth info during saml login Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added Docker host N/W Config to allow connection to SAML IDP Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added discovery type config to be single node for passing bootstrap checks Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Debug loggers Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Debug loggers Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Debug loggers Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Reverted run command to see change in error Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Trying with full docker image of OS Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Refactored the integration test yaml to use OS Full Docker image Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Removed all debug loggers Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added selfSigned package for generating certs and integrated with saml-idp Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Deleted checked-in key and cert for saml-idp server Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Reverted use of docker image and testing again with manual build Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Reverted use of docker image and testing again with manual build Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Upgraded version from 2.3 to 2.4 Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Removed debug pointers Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Commented out failing IT temporarily Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Lint formatting fix Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added the commented failing test back again Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Removed assertion from test again to make it pass Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Used a better XPath and improved error logging in tests Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Removed an unused XPath Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added back the assertion for failing IT Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Added steps to run Selenium based Integ Tests Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Commented out the test, will re-enable it again in the fix PR Signed-off-by: Aniketh Jain <anijainc@amazon.com> * Parameterized the getDriver function Signed-off-by: Aniketh Jain <anijainc@amazon.com> Signed-off-by: Deepak Devarakonda <devardee@amazon.com> Signed-off-by: Aniketh Jain <anijainc@amazon.com> Co-authored-by: Deepak Devarakonda <devardee@amazon.com> Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

peternied

Great feature for Dashboard users - thanks for this effort!

I think you found some problems with the previous conventions where switch/casing is used instead of something like an 'authentication handler' interface. This is causing lots of potential gaps where functionality could be missing / broken and its hard to know if it is being exercised. Lets look at a couple of this places with different behavior patterns and see if we can generalize. Then a single auth handler or multiple will look identical at the different code touchpoints and it will be trivial to add more auth types in the future.

Note; I only managed to review ~50% of the file so I might have more feedback when I get time to do the final pass

common/index.ts

public/apps/account/test/__snapshots__/log-out-button.test.tsx.snap

public/apps/account/log-out-button.tsx

public/apps/account/test/log-out-button.test.tsx

public/apps/login/login-page.tsx

public/types.ts

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

public/apps/account/log-out-button.tsx

server/auth/types/authentication_type.ts

server/auth/types/proxy/proxy_auth.ts

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

public/apps/account/utils.tsx

opensearch-trigger-bot · 2022-10-28T21:22:06Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-1110-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 eee08a5f1d91850c741a0085ea5f2beccaf0c343
# Push it to GitHub
git push --set-upstream origin backport/backport-1110-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-1110-to-2.x.

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com> Co-authored-by: Craig Perkins <cwperx@amazon.com> Co-authored-by: Ryan Liang <109499885+RyanL1997@users.noreply.github.com> Co-authored-by: anijain-Amazon <110471048+anijain-Amazon@users.noreply.github.com> Co-authored-by: Deepak Devarakonda <devardee@amazon.com> Co-authored-by: Chang Liu <lc12251109@gmail.com> (cherry picked from commit eee08a5)

aoguan1990 requested a review from a team September 23, 2022 02:29

aoguan1990 and others added 7 commits September 26, 2022 16:16

Initial commit for multiple authentication

d9d7ee7

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Change EUI spacer size and Anonmyous Login button default style

948b8a9

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Revert "Change EUI spacer size and Anonmyous Login button default style"

032c277

This reverts commit 892180f508e2fabb31030de5d1178cf68c7820f2. Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Increment version to 2.4.0.0 (opensearch-project#1096)

eb6d4a8

Signed-off-by: Craig Perkins <cwperx@amazon.com> Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Fixed the tenant switching after timeout (opensearch-project#1090)

2c3235d

Signed-off-by: Ryan Liang <jiallian@amazon.com> Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Change EUI spacer size and Anonmyous Login button default style

c152ad0

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

aoguan1990 force-pushed the multiple_auth_type branch from f0b004f to c152ad0 Compare September 26, 2022 21:16

aoguan1990 and others added 6 commits September 27, 2022 10:15

Merge branch 'opensearch-project:main' into multiple_auth_type

3dc3ff1

Change Login Page content and error message

6be9274

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Resolve log out conflicts

2e6c641

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Resolve log out snapshot conflicts

9103860

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Merge branch 'opensearch-project:main' into multiple_auth_type

3e3f400

Add multi-auth test cases

6774b90

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

aoguan1990 requested a review from zengyan-amazon September 28, 2022 02:04

aoguan1990 and others added 6 commits September 28, 2022 13:48

Add additional login test case and remove comments

74a4bbd

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Change config attribute type for auth.type to string[]

bdb6417

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Fix authtype is empty use case

6689249

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Fix saml test case: authtype validation

0a58de6

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Fix saml test case: saml config

dbd92b4

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Merge branch 'main' into multiple_auth_type

fc90ae5

peternied requested changes Oct 4, 2022

View reviewed changes

aoguan1990 requested a review from peternied October 4, 2022 04:19

aoguan1990 added 2 commits October 3, 2022 23:24

Modify saml and oidc logout

51791a1

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

Fix unit test case

b9debbf

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

cliu123 reviewed Oct 4, 2022

View reviewed changes

public/apps/account/log-out-button.tsx Outdated Show resolved Hide resolved

cliu123 reviewed Oct 4, 2022

View reviewed changes

public/apps/account/log-out-button.tsx Outdated Show resolved Hide resolved

This was referenced Oct 27, 2022

[FEATURE]Enable Anonymous Login along with OIDC Authentication in Multiple Authentication Mode #1124

Closed

[BUG] Failed to register OIDC Routers with OpenSearch Dashboards Client #1163

Closed

cliu123 reviewed Oct 28, 2022

View reviewed changes

server/auth/types/authentication_type.ts Show resolved Hide resolved

cliu123 reviewed Oct 28, 2022

View reviewed changes

server/auth/types/authentication_type.ts Show resolved Hide resolved

cliu123 reviewed Oct 28, 2022

View reviewed changes

server/auth/types/proxy/proxy_auth.ts Show resolved Hide resolved

aoguan1990 requested review from cliu123 and removed request for expani October 28, 2022 15:33

Add spce back

d7113e3

Signed-off-by: Aozixuan Priscilla Guan <aoguan@amazon.com>

aoguan1990 force-pushed the multiple_auth_type branch from 9b0c17f to d7113e3 Compare October 28, 2022 15:59

Merge branch 'main' into multiple_auth_type

4165aba

cliu123 approved these changes Oct 28, 2022

View reviewed changes

RyanL1997 reviewed Oct 28, 2022

View reviewed changes

public/apps/account/utils.tsx Show resolved Hide resolved

RyanL1997 approved these changes Oct 28, 2022

View reviewed changes

cliu123 approved these changes Oct 28, 2022

View reviewed changes

cliu123 merged commit eee08a5 into opensearch-project:main Oct 28, 2022

cliu123 added backport 2.x backport to 2.x branch backport 2.4 backport to 2.4 branch and removed backport 2.x backport to 2.x branch labels Oct 28, 2022

opensearch-trigger-bot bot mentioned this pull request Nov 3, 2022

[Backport 2.x] Initial commit for multiple authentication #1191

Merged

opensearch-trigger-bot bot mentioned this pull request Nov 3, 2022

[Backport 2.4] Initial commit for multiple authentication #1192

Merged

cwperks mentioned this pull request Nov 3, 2022

Add release notes for 2.4.0.0 #1197

Merged

3 tasks

cwperks mentioned this pull request Sep 6, 2023

[FEATURE] Dynamic Sign in options for OpenSearch Dashboards #1573

Open

This was referenced Dec 18, 2023

Backport cookie splitter #1662

Closed

[Backport 1.x] Split up a value into multiple cookie payloads #1702

Closed

Desvelao mentioned this pull request Oct 27, 2025

Merge 4.14.1 into main wazuh/wazuh-security-dashboards-plugin#400

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial commit for multiple authentication#1110

Initial commit for multiple authentication#1110
cliu123 merged 60 commits intoopensearch-project:mainfrom
aoguan1990:multiple_auth_type

aoguan1990 commented Sep 23, 2022 •

edited by peternied

Loading

Uh oh!

codecov-commenter commented Sep 23, 2022 •

edited by codecov bot

Loading

Uh oh!

cliu123 commented Sep 23, 2022

Uh oh!

peternied left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

opensearch-trigger-bot bot commented Oct 28, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Conversation

aoguan1990 commented Sep 23, 2022 • edited by peternied Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Category

Why these changes are required?

What is the old behavior before changes and new behavior after changes?

Issues Resolved

Testing

Check List

Uh oh!

codecov-commenter commented Sep 23, 2022 • edited by codecov bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cliu123 commented Sep 23, 2022

Uh oh!

peternied left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

opensearch-trigger-bot bot commented Oct 28, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

aoguan1990 commented Sep 23, 2022 •

edited by peternied

Loading

codecov-commenter commented Sep 23, 2022 •

edited by codecov bot

Loading