Skip to content

Commit a306388

Browse files
BigPandaTooelasticmachine
BigPandaToo
and
elasticmachine
authored
Adds realm name OIDC _security/oidc/prepare and _security/oidc/authenticate APIs responses (#64966)
* This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves #53161 * This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves #53161 * This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves #53161 * This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves #53161 Co-authored-by: Elastic Machine <[email protected]>
1 parent 450fb55 commit a306388

File tree

5 files changed

+40
-12
lines changed

5 files changed

+40
-12
lines changed

‎x-pack/docs/en/rest-api/security/oidc-authenticate-api.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ be used to authenticate this. Useful when multiple realms have been defined.
5858

5959
The following example request exchanges the response that was returned from the
6060
OpenID Connect Provider after a successful authentication, for an {es} access
61-
token and refresh token to be used in subsequent requests. This example is from
61+
token and refresh token to be used in subsequent requests. This example is from
6262
an authentication that uses the authorization code grant flow.
6363

6464
[source,console]

‎x-pack/docs/en/rest-api/security/oidc-prepare-authentication-api.asciidoc‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
=== OpenID Connect Prepare Authentication API
44

55
Creates an oAuth 2.0 authentication request as a URL string based on the
6-
configuration of the respective OpenID Connect authentication realm in {es}.
6+
configuration of the respective OpenID Connect authentication realm in {es}.
77

88
[[security-api-oidc-prepare-authentication-request]]
99
==== {api-request-title}
@@ -16,13 +16,13 @@ configuration of the respective OpenID Connect authentication realm in {es}.
1616
[[security-api-oidc-prepare-authentication-desc]]
1717
==== {api-description-title}
1818

19-
The response of this API is a URL pointing to the Authorization Endpoint of the
20-
configured OpenID Connect Provider and can be used to redirect the browser of
19+
The response of this API is a URL pointing to the Authorization Endpoint of the
20+
configured OpenID Connect Provider and can be used to redirect the browser of
2121
the user in order to continue the authentication process.
2222

2323
{es} exposes all the necessary OpenID Connect related functionality via the
2424
OpenID Connect APIs. These APIs are used internally by {kib} in order to provide
25-
OpenID Connect based authentication, but can also be used by other, custom web
25+
OpenID Connect based authentication, but can also be used by other, custom web
2626
applications or other clients. See also
2727
<<security-api-oidc-authenticate,OpenID Connect authenticate API>>
2828
and <<security-api-oidc-logout,OpenID Connect logout API>>.
@@ -81,7 +81,8 @@ the Authentication Request, as HTTP GET parameters:
8181
{
8282
"redirect" : "http://127.0.0.1:8080/c2id-login?scope=openid&response_type=id_token&redirect_uri=https%3A%2F%2Fmy.fantastic.rp%2Fcb&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I&nonce=WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM&client_id=elasticsearch-rp",
8383
"state" : "4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
84-
"nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM"
84+
"nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM",
85+
"realm" : "oidc1"
8586
}
8687
--------------------------------------------------
8788
// TESTRESPONSE[s/4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I/\$\{body.state\}/]
@@ -109,7 +110,8 @@ the Authentication Request, as HTTP GET parameters:
109110
{
110111
"redirect" : "http://127.0.0.1:8080/c2id-login?scope=openid&response_type=id_token&redirect_uri=https%3A%2F%2Fmy.fantastic.rp%2Fcb&state=lGYK0EcSLjqH6pkT5EVZjC6eIW5YCGgywj2sxROO&nonce=zOBXLJGUooRrbLbQk5YCcyC8AXw3iloynvluYhZ5&client_id=elasticsearch-rp",
111112
"state" : "lGYK0EcSLjqH6pkT5EVZjC6eIW5YCGgywj2sxROO",
112-
"nonce" : "zOBXLJGUooRrbLbQk5YCcyC8AXw3iloynvluYhZ5"
113+
"nonce" : "zOBXLJGUooRrbLbQk5YCcyC8AXw3iloynvluYhZ5",
114+
"realm" : "oidc1"
113115
}
114116
--------------------------------------------------
115117

@@ -134,8 +136,9 @@ the Authentication Request, as HTTP GET parameters:
134136
{
135137
"redirect" : "http://127.0.0.1:8080/c2id-login?login_hint=this_is_an_opaque_string&scope=openid&response_type=id_token&redirect_uri=https%3A%2F%2Fmy.fantastic.rp%2Fcb&state=4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I&nonce=WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM&client_id=elasticsearch-rp",
136138
"state" : "4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I",
137-
"nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM"
139+
"nonce" : "WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM",
140+
"realm" : "oidc1"
138141
}
139142
--------------------------------------------------
140143
// TESTRESPONSE[s/4dbrihtIAt3wBTwo6DxK-vdk-sSyDBV8Yf0AjdkdT5I/\$\{body.state\}/]
141-
// TESTRESPONSE[s/WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM/\$\{body.nonce\}/]
144+
// TESTRESPONSE[s/WaBPH0KqPVdG5HHdSxPRjfoZbXMCicm5v1OiAj0DUFM/\$\{body.nonce\}/]

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/oidc/OpenIdConnectPrepareAuthenticationResponse.java‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66
package org.elasticsearch.xpack.core.security.action.oidc;
77

8+
import org.elasticsearch.Version;
89
import org.elasticsearch.action.ActionResponse;
910
import org.elasticsearch.common.io.stream.StreamInput;
1011
import org.elasticsearch.common.io.stream.StreamOutput;
@@ -28,18 +29,26 @@ public class OpenIdConnectPrepareAuthenticationResponse extends ActionResponse i
2829
* String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
2930
*/
3031
private String nonce;
32+
/*
33+
* String value: name of the realm used to perform authentication.
34+
*/
35+
private String realmName;
3136

32-
public OpenIdConnectPrepareAuthenticationResponse(String authorizationEndpointUrl, String state, String nonce) {
37+
public OpenIdConnectPrepareAuthenticationResponse(String authorizationEndpointUrl, String state, String nonce, String realmName) {
3338
this.authenticationRequestUrl = authorizationEndpointUrl;
3439
this.state = state;
3540
this.nonce = nonce;
41+
this.realmName = realmName;
3642
}
3743

3844
public OpenIdConnectPrepareAuthenticationResponse(StreamInput in) throws IOException {
3945
super(in);
4046
authenticationRequestUrl = in.readString();
4147
state = in.readString();
4248
nonce = in.readString();
49+
if (in.getVersion().onOrAfter(Version.V_7_11_0)) {
50+
realmName = in.readString();
51+
}
4352
}
4453

4554
public String getAuthenticationRequestUrl() {
@@ -54,15 +63,23 @@ public String getNonce() {
5463
return nonce;
5564
}
5665

66+
public String getRealmName() {
67+
return realmName;
68+
}
69+
5770
@Override
5871
public void writeTo(StreamOutput out) throws IOException {
5972
out.writeString(authenticationRequestUrl);
6073
out.writeString(state);
6174
out.writeString(nonce);
75+
if (out.getVersion().onOrAfter(Version.V_7_11_0)) {
76+
out.writeString(realmName);
77+
}
6278
}
6379

6480
public String toString() {
65-
return "{authenticationRequestUrl=" + authenticationRequestUrl + ", state=" + state + ", nonce=" + nonce + "}";
81+
return "{authenticationRequestUrl=" + authenticationRequestUrl + ", state=" + state + ", nonce="
82+
+ nonce + ", realmName" + realmName + "}";
6683
}
6784

6885
@Override
@@ -71,6 +88,9 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
7188
builder.field("redirect", authenticationRequestUrl);
7289
builder.field("state", state);
7390
builder.field("nonce", nonce);
91+
if(realmName != null){
92+
builder.field("realm", realmName);
93+
}
7494
builder.endObject();
7595
return builder;
7696
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectRealm.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ public OpenIdConnectPrepareAuthenticationResponse buildAuthenticationRequestUri(
363363
builder.loginHint(loginHint);
364364
}
365365
return new OpenIdConnectPrepareAuthenticationResponse(builder.build().toURI().toString(),
366-
state.getValue(), nonce.getValue());
366+
state.getValue(), nonce.getValue(), this.name());
367367
}
368368

369369
public boolean isIssuerValid(String issuer) {

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectRealmTests.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ public void testBuildRelyingPartyConfigWithoutOpenIdScope() {
269269
assertThat(response.getAuthenticationRequestUrl(),
270270
equalTo("https://op.example.com/login?scope=scope1+scope2+openid&response_type=code" +
271271
"&redirect_uri=https%3A%2F%2Frp.my.com%2Fcb&state=" + state + "&nonce=" + nonce + "&client_id=rp-my"));
272+
assertThat(response.getRealmName(), equalTo(REALM_NAME));
272273
}
273274

274275
public void testBuildingAuthenticationRequest() {
@@ -292,6 +293,7 @@ public void testBuildingAuthenticationRequest() {
292293
assertThat(response.getAuthenticationRequestUrl(),
293294
equalTo("https://op.example.com/login?scope=openid+scope1+scope2&response_type=code" +
294295
"&redirect_uri=https%3A%2F%2Frp.my.com%2Fcb&state=" + state + "&nonce=" + nonce + "&client_id=rp-my"));
296+
assertThat(response.getRealmName(), equalTo(REALM_NAME));
295297
}
296298

297299
public void testBuilidingAuthenticationRequestWithDefaultScope() {
@@ -313,6 +315,7 @@ public void testBuilidingAuthenticationRequestWithDefaultScope() {
313315
final String nonce = response.getNonce();
314316
assertThat(response.getAuthenticationRequestUrl(), equalTo("https://op.example.com/login?scope=openid&response_type=code" +
315317
"&redirect_uri=https%3A%2F%2Frp.my.com%2Fcb&state=" + state + "&nonce=" + nonce + "&client_id=rp-my"));
318+
assertThat(response.getRealmName(), equalTo(REALM_NAME));
316319
}
317320

318321
public void testBuildLogoutResponse() throws Exception {
@@ -370,6 +373,7 @@ public void testBuildingAuthenticationRequestWithExistingStateAndNonce() {
370373

371374
assertThat(response.getAuthenticationRequestUrl(), equalTo("https://op.example.com/login?scope=openid&response_type=code" +
372375
"&redirect_uri=https%3A%2F%2Frp.my.com%2Fcb&state=" + state + "&nonce=" + nonce + "&client_id=rp-my"));
376+
assertThat(response.getRealmName(), equalTo(REALM_NAME));
373377
}
374378

375379
public void testBuildingAuthenticationRequestWithLoginHint() {
@@ -394,6 +398,7 @@ public void testBuildingAuthenticationRequestWithLoginHint() {
394398
assertThat(response.getAuthenticationRequestUrl(), equalTo("https://op.example.com/login?login_hint=" + thehint +
395399
"&scope=openid&response_type=code&redirect_uri=https%3A%2F%2Frp.my.com%2Fcb&state=" +
396400
state + "&nonce=" + nonce + "&client_id=rp-my"));
401+
assertThat(response.getRealmName(), equalTo(REALM_NAME));
397402
}
398403

399404
private AuthenticationResult authenticateWithOidc(String principal, UserRoleMapper roleMapper, boolean notPopulateMetadata,

0 commit comments

Comments
 (0)