OpenID Connect realm guide #41423

jkakavas · 2019-04-22T21:33:44Z

This commit adds a configuration guide for the newly introduced
OpenID Connect realm. The guide is similar to the style of the
SAML Guide and shares certain parts where applicable (role mapping)
It also contains a short section on how the realm can be used for
authenticating users without Kibana.

This commit adds a configuration guide for the newly introduced OpenID Connect realm. The guide is similar to the style of the SAML Guide and shares certain parts where applicable (role mappign) It also contains a short section on how the realm can be used for authenticating users without Kibana.

elasticmachine · 2019-04-22T21:33:45Z

Pinging @elastic/es-security

jkakavas · 2019-04-23T05:21:06Z

 [7.0.1] Use '--warning-mode all' to show the individual deprecation warnings.
 [7.0.1]       > Could not resolve jdk:linux:12.
 [7.0.1] See https://docs.gradle.org/5.2.1/userguide/command_line_interface.html#sec:command_line_warnings
 [7.0.1]          > Could not get resource 'https://download.java.net/java/GA/jdk12/33/GPL/openjdk-12_linux-x64_bin.xml'.
 [7.0.1]             > Could not GET 'https://download.java.net/java/GA/jdk12/33/GPL/openjdk-12_linux-x64_bin.xml'.
 [7.0.1]                > Read timed out

@elasticmachine please run elasticsearch-ci/packaging-sample

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

tvernum · 2019-04-24T06:16:07Z

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

+    - `id_token token` which means that we want to use the Implicit flow and we also request an oAuth2
+       access token from the OP, that we can potentially use for follow up requests ( UserInfo )
+    - `id_token` which means that we want to use the Implicit flow, but are not interested in getting
+       an oAuth2 token too.


Can we provide any guidance on how to know which one to use?

This seems like the first place where we've fallen into the "you need to understand OIDC in order to configure this", and it would be nice to avoid that.

I made an attempt at suggesting when to use each

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

tvernum · 2019-04-24T10:35:21Z

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

+}
+--------------------------------------------------
+// CONSOLE
+// TEST[skip:These are properly tested in the OpenIDConnectIT suite]


Ideally we wouldn't skip these.
The intent of the docs-snippet testing is not to test the backend functionatlity, but to ensure that the docs content is free of errors, and is kept in sync with the implementation.
When we skip these, we run the risk of the examples being broken (e.g. by changes to the endpoint URL, or the addition of required fields)

Understood. I'll take care of it

I enabled tests for prepare and added // TESTRESPONSE[catch:X] for authenticate and logout as there is no easy way to test them here.

In order to get a succesful response from the integTest cluster for authenticate, we'd need to use the implicit flow and introduce code to sign the ID Token in a // TESTSETUP section so that the cluster can consume it. I don't think it's worth the effort, but I can be swayed

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

x-pack/docs/en/rest-api/security/oidc-prepare-authentication-api.asciidoc

albertzaharovits

Nice job Ioannis!

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

lcawl · 2019-05-03T22:42:33Z

@jkakavas Do you intend this content to be located in the same place as https://www.elastic.co/guide/en/elastic-stack-overview/current/saml-guide.html ? If so, I'll open a PR in stack-docs to pull it in and fix a few inclusions here.

jkakavas · 2019-05-04T07:59:50Z

Aha ! I didnt realize that this was opened against the old file. Do we need to keep both and keep them in sync or should we just keep the new one in the stack docs? If the former is true then feel free to open the relevant stack docs PR, otherwise we could finish the review here and then once approved raise a new pr to the stack docs to pull it in and remove this one / close the PR .

jkakavas · 2019-05-08T10:34:32Z

@elasticmachine run elasticsearch-ci/docbldesx

…lete an authentication in order to get valid tokens in doc tests eitherway

lcawl · 2019-05-08T19:01:24Z

I've cleaned up a few documentation issues.

The new content will be added to the Stack Overview via elastic/stack-docs#328

At some point I think we'll want to add configuration details to the Elasticsearch Reference too (equivalent to https://www.elastic.co/guide/en/elasticsearch/reference/master/configuring-saml-realm.html). But I think we can do that in a subsequent PR (equivalent to #30548)

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

lcawl · 2019-05-10T17:27:22Z

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

+==== Register the RP with an OpenID Connect Provider
+
+The Relying Party ( {es} and the custom web app ) will need to be registered as
+client with the OpenID Connect Provider. Note that when registering the


Suggested change

client with the OpenID Connect Provider. Note that when registering the

a client with the OpenID Connect Provider. Note that when registering the

it is actually one client

OK! I've updated my suggestion

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

lcawl · 2019-05-10T17:31:20Z

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

+"delegating" the authentication to the OpenID Connect Provider ). The OpenID Connect
+APIs require authentication and the necessary authorization level for the authenticated
+user. For this reason, a Service Account user needs to be created and assigned a role
+that gives them the `manage_oidc` cluster privilege. The use of the `manage_token`


Does this cluster privilege need to be added to https://www.elastic.co/guide/en/elastic-stack-overview/master/security-privileges.html ?

Thanks, I created elastic/stack-docs#334

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

jkakavas · 2019-05-16T16:26:02Z

@tvernum do you want to take another look at this? I've tried to handle your original feedback, let me know what you think

tvernum

I haven't re-read the entirety of the docs, but I'm happy with the changes that have been made.

x-pack/docs/en/security/authentication/oidc-guide.asciidoc

This commit adds a configuration guide for the newly introduced OpenID Connect realm. The guide is similar to the style of the SAML Guide and shares certain parts where applicable (role mapping) It also contains a short section on how the realm can be used for authenticating users without Kibana. Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

This commit adds a configuration guide for the newly introduced OpenID Connect realm. The guide is similar to the style of the SAML Guide and shares certain parts where applicable (role mapping) It also contains a short section on how the realm can be used for authenticating users without Kibana. Co-Authored-By: Lisa Cawley <lcawley@elastic.co> Backport of #41423 and #42555

This commit adds a configuration guide for the newly introduced OpenID Connect realm. The guide is similar to the style of the SAML Guide and shares certain parts where applicable (role mapping) It also contains a short section on how the realm can be used for authenticating users without Kibana. Co-Authored-By: Lisa Cawley <lcawley@elastic.co> Backport of elastic#41423 and elastic#42555

This commit adds a configuration guide for the newly introduced OpenID Connect realm. The guide is similar to the style of the SAML Guide and shares certain parts where applicable (role mapping) It also contains a short section on how the realm can be used for authenticating users without Kibana. Co-Authored-By: Lisa Cawley <lcawley@elastic.co> Backport of #41423 and #42555

jkakavas added 4 commits April 23, 2019 00:25

Merge remote-tracking branch 'origin/master' into oidc-guide-doc

cf114d4

mute doc tests

30ab623

SAML->OIDC

23d006a

jkakavas added >docs General docs changes :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 v7.2.0 labels Apr 22, 2019

jkakavas requested review from albertzaharovits and lcawl April 22, 2019 21:33

jkakavas requested a review from tvernum April 23, 2019 05:56

correct typo in command

3e73e73

tvernum reviewed Apr 24, 2019

View reviewed changes

Address feedback

448028d

jkakavas commented Apr 24, 2019

View reviewed changes

x-pack/docs/en/rest-api/security/oidc-prepare-authentication-api.asciidoc Show resolved Hide resolved

albertzaharovits approved these changes May 2, 2019

View reviewed changes

jkakavas added 3 commits May 8, 2019 13:17

Address feedback

0f659df

fix doc tests

cff33b0

Merge remote-tracking branch 'origin/master' into oidc-guide-doc

13ae0d2

jkakavas and others added 3 commits May 8, 2019 13:51

Remove op.name config from docs test cluster

d3803cb

Expect the correct exception for malformed tokens since we can't comp…

09e86d3

…lete an authentication in order to get valid tokens in doc tests eitherway

[DOCS] Fixes links

f4ae9fe

lcawl mentioned this pull request May 8, 2019

Adds OIDC guide to Stack Overview elastic/stack-docs#328

Merged

[DOCS] Fixes OpenID API section

f92a01d

lcawl reviewed May 10, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

lcawl reviewed May 10, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

lcawl reviewed May 10, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

lcawl reviewed May 10, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

lcawl reviewed May 10, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

jkakavas and others added 4 commits May 11, 2019 10:49

Update x-pack/docs/en/security/authentication/oidc-guide.asciidoc

99d35b9

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

Update x-pack/docs/en/security/authentication/oidc-guide.asciidoc

139a41c

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

Update x-pack/docs/en/security/authentication/oidc-guide.asciidoc

107ef46

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

Apply suggestions from code review

0ce4cd9

Co-Authored-By: Lisa Cawley <lcawley@elastic.co>

Merge remote-tracking branch 'origin/master' into oidc-guide-doc

4ab07df

tvernum approved these changes May 20, 2019

View reviewed changes

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

x-pack/docs/en/security/authentication/oidc-guide.asciidoc Outdated Show resolved Hide resolved

jkakavas added 2 commits May 20, 2019 10:52

Address feedback, note that implicit flow is not supported by kibana yet

9947dc4

Merge remote-tracking branch 'origin/master' into oidc-guide-doc

b4cf4bd

jkakavas merged commit 18f3b27 into elastic:master May 20, 2019

jkakavas added the backport pending label May 20, 2019

lcawl mentioned this pull request May 20, 2019

Adds manage_oidc cluster privilege elastic/stack-docs#334

Closed

jkakavas removed the backport pending label May 20, 2019

jkakavas mentioned this pull request May 21, 2019

Add information about manage_oidc privilege elastic/stack-docs#339

Merged

jkakavas mentioned this pull request Jun 4, 2019

[Backport 7.x] OpenID Connect realm guide #42836

Merged

jkakavas mentioned this pull request Jun 4, 2019

[Backport 7.2] OpenID Connect realm guide #42841

Merged

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenID Connect realm guide #41423

OpenID Connect realm guide #41423

jkakavas commented Apr 22, 2019

elasticmachine commented Apr 22, 2019

jkakavas commented Apr 23, 2019

tvernum Apr 24, 2019

jkakavas Apr 24, 2019 •

edited

Loading

tvernum Apr 24, 2019

jkakavas Apr 24, 2019

jkakavas Apr 24, 2019 •

edited

Loading

albertzaharovits left a comment

lcawl commented May 3, 2019

jkakavas commented May 4, 2019 via email

jkakavas commented May 8, 2019

lcawl commented May 8, 2019 •

edited

Loading

lcawl May 10, 2019 •

edited

Loading

jkakavas May 16, 2019

lcawl May 16, 2019

lcawl May 10, 2019

lcawl May 20, 2019

jkakavas commented May 16, 2019

tvernum left a comment

	client with the OpenID Connect Provider. Note that when registering the
	a client with the OpenID Connect Provider. Note that when registering the

OpenID Connect realm guide #41423

OpenID Connect realm guide #41423

Conversation

jkakavas commented Apr 22, 2019

elasticmachine commented Apr 22, 2019

jkakavas commented Apr 23, 2019

tvernum Apr 24, 2019

Choose a reason for hiding this comment

jkakavas Apr 24, 2019 • edited Loading

Choose a reason for hiding this comment

tvernum Apr 24, 2019

Choose a reason for hiding this comment

jkakavas Apr 24, 2019

Choose a reason for hiding this comment

jkakavas Apr 24, 2019 • edited Loading

Choose a reason for hiding this comment

albertzaharovits left a comment

Choose a reason for hiding this comment

lcawl commented May 3, 2019

jkakavas commented May 4, 2019 via email

jkakavas commented May 8, 2019

lcawl commented May 8, 2019 • edited Loading

lcawl May 10, 2019 • edited Loading

Choose a reason for hiding this comment

jkakavas May 16, 2019

Choose a reason for hiding this comment

lcawl May 16, 2019

Choose a reason for hiding this comment

lcawl May 10, 2019

Choose a reason for hiding this comment

lcawl May 20, 2019

Choose a reason for hiding this comment

jkakavas commented May 16, 2019

tvernum left a comment

Choose a reason for hiding this comment

jkakavas Apr 24, 2019 •

edited

Loading

jkakavas Apr 24, 2019 •

edited

Loading

lcawl commented May 8, 2019 •

edited

Loading

lcawl May 10, 2019 •

edited

Loading