Skip to content

Add delegated authorization (lookup realms) to LDAP #32156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 19, 2018
Merged

Add delegated authorization (lookup realms) to LDAP #32156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
663647e
Add delegated authorization (lookup realms) LDAP
tvernum Jun 25, 2018
f6f0553
Rename method
tvernum Jul 19, 2018
2422ffc
Fix broken test
tvernum Jul 19, 2018
ab8d5cd
Merge branch 'security-lookup-realms' into lookup-realm/ldap
tvernum Jul 19, 2018
d47c8c5
Fix import
tvernum Jul 19, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...ore/src/main/java/org/elasticsearch/xpack/core/security/authc/ldap/LdapRealmSettings.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
import org.elasticsearch.common.unit.TimeValue;
import org.elasticsearch.xpack.core.security.authc.ldap.support.LdapMetaDataResolverSettings;
import org.elasticsearch.xpack.core.security.authc.support.CachingUsernamePasswordRealmSettings;
import org.elasticsearch.xpack.core.security.authc.support.DelegatedAuthorizationSettings;
import org.elasticsearch.xpack.core.security.authc.support.mapper.CompositeRoleMapperSettings;

import java.util.HashSet;
Expand Down Expand Up @@ -37,6 +38,7 @@ public static Set<Setting<?>> getSettings(String type) {
assert LDAP_TYPE.equals(type) : "type [" + type + "] is unknown. expected one of [" + AD_TYPE + ", " + LDAP_TYPE + "]";
settings.addAll(LdapSessionFactorySettings.getSettings());
settings.addAll(LdapUserSearchSessionFactorySettings.getSettings());
settings.addAll(DelegatedAuthorizationSettings.getSettings());
}
settings.addAll(LdapMetaDataResolverSettings.getSettings());
return settings;
Expand Down
95 changes: 62 additions & 33 deletions .../plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/ldap/LdapRealm.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,20 @@
import com.unboundid.ldap.sdk.LDAPException;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.message.ParameterizedMessage;
import org.elasticsearch.core.internal.io.IOUtils;
import org.elasticsearch.ElasticsearchTimeoutException;
import org.elasticsearch.action.ActionListener;
import org.elasticsearch.action.support.ContextPreservingActionListener;
import org.elasticsearch.common.collect.MapBuilder;
import org.elasticsearch.common.unit.TimeValue;
import org.elasticsearch.common.util.concurrent.AbstractRunnable;
import org.elasticsearch.common.util.concurrent.ThreadContext;
import org.elasticsearch.core.internal.io.IOUtils;
import org.elasticsearch.license.XPackLicenseState;
import org.elasticsearch.threadpool.ThreadPool;
import org.elasticsearch.threadpool.ThreadPool.Names;
import org.elasticsearch.watcher.ResourceWatcherService;
import org.elasticsearch.xpack.core.security.authc.AuthenticationResult;
import org.elasticsearch.xpack.core.security.authc.Realm;
import org.elasticsearch.xpack.core.security.authc.RealmConfig;
import org.elasticsearch.xpack.core.security.authc.RealmSettings;
import org.elasticsearch.xpack.core.security.authc.ldap.LdapRealmSettings;
Expand All @@ -31,6 +33,7 @@
import org.elasticsearch.xpack.security.authc.ldap.support.LdapSession;
import org.elasticsearch.xpack.security.authc.ldap.support.SessionFactory;
import org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm;
import org.elasticsearch.xpack.security.authc.support.DelegatedAuthorizationSupport;
import org.elasticsearch.xpack.security.authc.support.UserRoleMapper;
import org.elasticsearch.xpack.security.authc.support.UserRoleMapper.UserData;
import org.elasticsearch.xpack.security.authc.support.mapper.CompositeRoleMapper;
Expand All @@ -53,7 +56,7 @@ public final class LdapRealm extends CachingUsernamePasswordRealm {
private final UserRoleMapper roleMapper;
private final ThreadPool threadPool;
private final TimeValue executionTimeout;

private DelegatedAuthorizationSupport delegatedRealms;

public LdapRealm(String type, RealmConfig config, SSLService sslService,
ResourceWatcherService watcherService,
Expand Down Expand Up @@ -118,6 +121,7 @@ static SessionFactory sessionFactory(RealmConfig config, SSLService sslService,
*/
@Override
protected void doAuthenticate(UsernamePasswordToken token, ActionListener<AuthenticationResult> listener) {
assert delegatedRealms != null : "Realm has not been initialized correctly";
// we submit to the threadpool because authentication using LDAP will execute blocking I/O for a bind request and we don't want
// network threads stuck waiting for a socket to connect. After the bind, then all interaction with LDAP should be async
final CancellableLdapRunnable<AuthenticationResult> cancellableLdapRunnable = new CancellableLdapRunnable<>(listener,
Expand Down Expand Up @@ -159,6 +163,14 @@ private ContextPreservingActionListener<LdapSession> contextPreservingListener(L
sessionListener);
}

@Override
public void initialize(Iterable<Realm> realms, XPackLicenseState licenseState) {
if (delegatedRealms != null) {
throw new IllegalStateException("Realm has already been initialized");
}
delegatedRealms = new DelegatedAuthorizationSupport(realms, config, licenseState);
}

@Override
public void usageStats(ActionListener<Map<String, Object>> listener) {
super.usageStats(ActionListener.wrap(usage -> {
Expand All @@ -171,39 +183,56 @@ public void usageStats(ActionListener<Map<String, Object>> listener) {
}

private static void buildUser(LdapSession session, String username, ActionListener<AuthenticationResult> listener,
UserRoleMapper roleMapper) {
UserRoleMapper roleMapper, DelegatedAuthorizationSupport delegatedAuthz) {
assert delegatedAuthz != null : "DelegatedAuthorizationSupport is null";
if (session == null) {
listener.onResponse(AuthenticationResult.notHandled());
} else if (delegatedAuthz.hasDelegation()) {
delegatedAuthz.resolve(username, listener);
} else {
boolean loadingGroups = false;
try {
final Consumer<Exception> onFailure = e -> {
IOUtils.closeWhileHandlingException(session);
listener.onFailure(e);
};
session.resolve(ActionListener.wrap((ldapData) -> {
final Map<String, Object> metadata = MapBuilder.<String, Object>newMapBuilder()
.put("ldap_dn", session.userDn())
.put("ldap_groups", ldapData.groups)
.putAll(ldapData.metaData)
.map();
final UserData user = new UserData(username, session.userDn(), ldapData.groups,
metadata, session.realm());
roleMapper.resolveRoles(user, ActionListener.wrap(
roles -> {
IOUtils.close(session);
String[] rolesArray = roles.toArray(new String[roles.size()]);
listener.onResponse(AuthenticationResult.success(
new User(username, rolesArray, null, null, metadata, true))
);
}, onFailure
));
}, onFailure));
loadingGroups = true;
} finally {
if (loadingGroups == false) {
session.close();
}
lookupUserFromSession(username, session, roleMapper, listener);
}
}

@Override
protected void handleCachedAuthentication(User user, ActionListener<AuthenticationResult> listener) {
if (delegatedRealms.hasDelegation()) {
delegatedRealms.resolve(user.principal(), listener);
} else {
super.handleCachedAuthentication(user, listener);
}
}

private static void lookupUserFromSession(String username, LdapSession session, UserRoleMapper roleMapper,
ActionListener<AuthenticationResult> listener) {
boolean loadingGroups = false;
try {
final Consumer<Exception> onFailure = e -> {
IOUtils.closeWhileHandlingException(session);
listener.onFailure(e);
};
session.resolve(ActionListener.wrap((ldapData) -> {
final Map<String, Object> metadata = MapBuilder.<String, Object>newMapBuilder()
.put("ldap_dn", session.userDn())
.put("ldap_groups", ldapData.groups)
.putAll(ldapData.metaData)
.map();
final UserData user = new UserData(username, session.userDn(), ldapData.groups,
metadata, session.realm());
roleMapper.resolveRoles(user, ActionListener.wrap(
roles -> {
IOUtils.close(session);
String[] rolesArray = roles.toArray(new String[roles.size()]);
listener.onResponse(AuthenticationResult.success(
new User(username, rolesArray, null, null, metadata, true))
);
}, onFailure
));
}, onFailure));
loadingGroups = true;
} finally {
if (loadingGroups == false) {
session.close();
}
}
}
Expand Down Expand Up @@ -233,7 +262,7 @@ public void onResponse(LdapSession session) {
resultListener.onResponse(AuthenticationResult.notHandled());
} else {
ldapSessionAtomicReference.set(session);
buildUser(session, username, resultListener, roleMapper);
buildUser(session, username, resultListener, roleMapper, delegatedRealms);
}
}

Expand Down
24 changes: 20 additions & 4 deletions ...ain/java/org/elasticsearch/xpack/security/authc/support/CachingUsernamePasswordRealm.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,10 +142,16 @@ private void handleResult(ListenableFuture<Tuple<AuthenticationResult, UserWithH
UserWithHash userWithHash = result.v2();
if (userWithHash.verify(token.credentials())) {
if (userWithHash.user.enabled()) {
User user = userWithHash.user;
logger.debug("realm [{}] authenticated user [{}], with roles [{}]",
name(), token.principal(), user.roles());
listener.onResponse(AuthenticationResult.success(user));
handleCachedAuthentication(userWithHash.user, ActionListener.wrap(cacheResult -> {
if (cacheResult.isAuthenticated()) {
logger.debug("realm [{}] authenticated user [{}], with roles [{}]",
name(), token.principal(), cacheResult.getUser().roles());
} else {
logger.debug("realm [{}] authenticated user [{}] from cache, but then failed [{}]",
name(), token.principal(), cacheResult.getMessage());
}
listener.onResponse(cacheResult);
}, listener::onFailure));
} else {
// re-auth to see if user has been enabled
cache.invalidate(token.principal(), future);
Expand All @@ -167,6 +173,16 @@ private void handleResult(ListenableFuture<Tuple<AuthenticationResult, UserWithH
}
}

/**
* {@code handleCachedAuthentication} is called when a {@link User} is retrieved from the cache.
* The first {@code user} parameter is the user object that was found in the cache.
* The default implementation returns a {@link AuthenticationResult#success(User) success result} with the
* provided user, but sub-classes can return a different {@code User} object, or an unsuccessful result.
*/
protected void handleCachedAuthentication(User user, ActionListener<AuthenticationResult> listener) {
listener.onResponse(AuthenticationResult.success(user));
}

private void handleFailure(ListenableFuture<Tuple<AuthenticationResult, UserWithHash>> future, boolean createdAndStarted,
UsernamePasswordToken token, Exception e, ActionListener<AuthenticationResult> listener) {
cache.invalidate(token.principal(), future);
Expand Down
14 changes: 14 additions & 0 deletions .../src/test/java/org/elasticsearch/xpack/security/authc/ldap/ActiveDirectoryRealmTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
import org.elasticsearch.common.util.concurrent.ThreadContext;
import org.elasticsearch.env.Environment;
import org.elasticsearch.env.TestEnvironment;
import org.elasticsearch.license.TestUtils;
import org.elasticsearch.license.XPackLicenseState;
import org.elasticsearch.test.ESTestCase;
import org.elasticsearch.threadpool.TestThreadPool;
import org.elasticsearch.threadpool.ThreadPool;
Expand All @@ -48,6 +50,7 @@
import java.security.AccessController;
import java.security.PrivilegedExceptionAction;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Map;

Expand Down Expand Up @@ -91,6 +94,7 @@ public class ActiveDirectoryRealmTests extends ESTestCase {
private ThreadPool threadPool;
private Settings globalSettings;
private SSLService sslService;
private XPackLicenseState licenseState;

@BeforeClass
public static void setNumberOfLdapServers() {
Expand Down Expand Up @@ -125,6 +129,7 @@ public void start() throws Exception {
resourceWatcherService = new ResourceWatcherService(Settings.EMPTY, threadPool);
globalSettings = Settings.builder().put("path.home", createTempDir()).build();
sslService = new SSLService(globalSettings, TestEnvironment.newEnvironment(globalSettings));
licenseState = new TestUtils.UpdatableLicenseState();
}

@After
Expand Down Expand Up @@ -163,6 +168,7 @@ public void testAuthenticateUserPrincipleName() throws Exception {
ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool);
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
realm.authenticate(new UsernamePasswordToken("CN=ironman", new SecureString(PASSWORD)), future);
Expand All @@ -179,6 +185,7 @@ public void testAuthenticateSAMAccountName() throws Exception {
ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool);
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

// Thor does not have a UPN of form [email protected]
PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
Expand All @@ -203,6 +210,7 @@ public void testAuthenticateCachesSuccessfulAuthentications() throws Exception {
ActiveDirectorySessionFactory sessionFactory = spy(new ActiveDirectorySessionFactory(config, sslService, threadPool));
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

int count = randomIntBetween(2, 10);
for (int i = 0; i < count; i++) {
Expand All @@ -221,6 +229,7 @@ public void testAuthenticateCachingCanBeDisabled() throws Exception {
ActiveDirectorySessionFactory sessionFactory = spy(new ActiveDirectorySessionFactory(config, sslService, threadPool));
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

int count = randomIntBetween(2, 10);
for (int i = 0; i < count; i++) {
Expand All @@ -239,6 +248,7 @@ public void testAuthenticateCachingClearsCacheOnRoleMapperRefresh() throws Excep
ActiveDirectorySessionFactory sessionFactory = spy(new ActiveDirectorySessionFactory(config, sslService, threadPool));
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

int count = randomIntBetween(2, 10);
for (int i = 0; i < count; i++) {
Expand Down Expand Up @@ -287,6 +297,7 @@ private void doUnauthenticatedLookup(boolean pooled) throws Exception {
try (ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool)) {
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

PlainActionFuture<User> future = new PlainActionFuture<>();
realm.lookupUser("CN=Thor", future);
Expand All @@ -304,6 +315,7 @@ public void testRealmMapsGroupsToRoles() throws Exception {
ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool);
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
realm.authenticate(new UsernamePasswordToken("CN=ironman", new SecureString(PASSWORD)), future);
Expand All @@ -320,6 +332,7 @@ public void testRealmMapsUsersToRoles() throws Exception {
ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool);
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

PlainActionFuture<AuthenticationResult> future = new PlainActionFuture<>();
realm.authenticate(new UsernamePasswordToken("CN=Thor", new SecureString(PASSWORD)), future);
Expand All @@ -338,6 +351,7 @@ public void testRealmUsageStats() throws Exception {
ActiveDirectorySessionFactory sessionFactory = new ActiveDirectorySessionFactory(config, sslService, threadPool);
DnRoleMapper roleMapper = new DnRoleMapper(config, resourceWatcherService);
LdapRealm realm = new LdapRealm(LdapRealmSettings.AD_TYPE, config, sessionFactory, roleMapper, threadPool);
realm.initialize(Collections.singleton(realm), licenseState);

PlainActionFuture<Map<String, Object>> future = new PlainActionFuture<>();
realm.usageStats(future);
Expand Down
Loading