Create enrollment token #73573

BigPandaToo · 2021-05-31T20:38:15Z

Method to be called by the startup process while elasticsearch is in the
enrollment mode to obtain an
enrollment token used to enroll a new node to the cluster or an enrollment
token to configure Kibana to communicate with a secured elasticsearch
cluster

Resolve: #71438
Related: #72129

Method to be called by the startup process while elasticsearch is in the enrollment mode to obtain an enrollment token used to enroll a new node to the cluster. Resolve: elastic#71438 Related: elastic#72129

elasticmachine · 2021-05-31T20:38:59Z

Pinging @elastic/es-security (Team:Security)

enrollment mode to obtain an enrollment token used to enroll a new node to the cluster. Resolve: elastic#71438 Related: elastic#72129

BigPandaToo · 2021-06-03T17:22:47Z

@elasticmachine update branch

x-pack/docs/en/security/authorization/privileges.asciidoc

...nt/rest-high-level/src/main/java/org/elasticsearch/client/security/user/privileges/Role.java

x-pack/docs/en/security/authorization/privileges.asciidoc

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java

...ain/java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java

...rc/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/CommandLineHttpClient.java

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

BigPandaToo · 2021-06-09T12:38:56Z

@elasticmachine update branch

BigPandaToo · 2021-06-09T20:16:41Z

@elasticmachine update branch

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

albertzaharovits

Please address my comments, then I think it's good to merge.

Worth noting that the token, as proposed herein, includes addresses for all the cluster nodes.
In practice connection information for the node that generated the token ought be enough, and we're trying to keep the token short. CC @jkakavas you might have opinions, I'm fine either way.

BigPandaToo · 2021-06-21T20:26:07Z

Please address my comments, then I think it's good to merge.

Worth noting that the token, as proposed herein, includes addresses for all the cluster nodes.
In practice connection information for the node that generated the token ought be enough, and we're trying to keep the token short. CC @jkakavas you might have opinions, I'm fine either way.

That's not true. Address for the first node returned by /_nodes/http API is only incuded. We can be more selective and filter local only or master only node...

jkakavas

Please address my comments, then I think it's good to merge.
Worth noting that the token, as proposed herein, includes addresses for all the cluster nodes.
In practice connection information for the node that generated the token ought be enough, and we're trying to keep the token short. CC @jkakavas you might have opinions, I'm fine either way.

That's not true. Address for the first node returned by /_nodes/http API is only incuded. We can be more selective and filter local only or master only node...

Yes, we only want to return local info. The idea is that you get a token from the node that you want to talk to in the enrollment process. I don't think we should depend on the local node being the first in the response. We should limit the response by passing _local in the request

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

jkakavas · 2021-06-22T06:58:44Z

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

+
+        if (httpCode != HttpURLConnection.HTTP_OK) {
+            logger.error("Error " + httpCode + "when calling GET " + url + ". ResponseBody: " +
+                (httpResponseApiKey == null ? "" : httpResponseApiKey.getResponseBody()));


httpResponseApiKey can't be null, can it?

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

...ty/src/test/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentTokenTests.java

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

...ty/src/test/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentTokenTests.java

BigPandaToo · 2021-06-22T08:13:45Z

@elasticmachine update branch

jkakavas · 2021-06-22T20:00:34Z

...ty/src/test/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentTokenTests.java

+        assertThat(ex.getMessage(), Matchers.containsString("Unexpected response code [400] from calling GET "));
+    }
+
+    public void testFailedRetrieveHttpInfoNoCaInKeystore() throws Exception {


these do not have to do with failing to retrieve http info right and are not similar to testFailedRetrieveHttpInfo. Can we rename this and the following methods?

jkakavas

LGTM, please change the test method names and we're good to merge, thanks for the iterations!

jkakavas · 2021-06-23T16:49:43Z

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java

+        if (Strings.isNullOrEmpty(apiKey) || Strings.isNullOrEmpty(apiId)) {
+            throw new IllegalStateException("Could not create an api key.");
+        }
+        return Base64.getEncoder().encodeToString((apiId + ":" + apiKey).getBytes(StandardCharsets.UTF_8));


Missed that in the review @BigPandaToo . I don;t think there is need to base64 encode the API key before we put it as a value in the token, as the token itself will be Base64 encoded.

I think the length gains are more significant than the additiional effort the consumers of the token need to make to base64 the string before using it in the Authorization header and this behavior is also consistent with the create api key API .

Can you please tackle this change in a short follow up PR ?

Right, forgot that it won't be used directly

No need for base64 encode the API key before we put it as a value in the token, as the token itself will be Base64 encoded A follow up PR for: elastic#73573

A follow up PR for: elastic#73573

No need for base64 encode the API key before we put it as a value in the token, as the token itself will be Base64 encoded A follow up PR for: #73573

* Calculate SHA256 fingerprint for enrollment token A follow up PR for: #73573 * Adding a test fix Resolves: #74525

* Create enrollment token Method to be called by the startup process while elasticsearch is in the enrollment mode to obtain an enrollment token used to enroll a new node to the cluster. Resolve: elastic#71438 Related: elastic#72129

No need for base64 encode the API key before we put it as a value in the token, as the token itself will be Base64 encoded A follow up PR for: elastic#73573

* Calculate SHA256 fingerprint for enrollment token A follow up PR for: elastic#73573 * Adding a test fix Resolves: elastic#74525

Create enrollment token

314b8a3

Method to be called by the startup process while elasticsearch is in the enrollment mode to obtain an enrollment token used to enroll a new node to the cluster. Resolve: elastic#71438 Related: elastic#72129

BigPandaToo added :Security/Security Security issues without another label v8.0.0 labels May 31, 2021

elasticmachine added the Team:Security Meta label for security team label May 31, 2021

BigPandaToo requested a review from albertzaharovits May 31, 2021 20:39

BigPandaToo marked this pull request as draft May 31, 2021 20:40

adding test

0bac5be

BigPandaToo marked this pull request as ready for review June 1, 2021 08:04

BigPandaToo mentioned this pull request Jun 1, 2021

Create enrollment token API #72186

Closed

BigPandaToo marked this pull request as draft June 1, 2021 18:59

rdnm added this to In development in Security On by Default Implementation Tracking Jun 3, 2021

Method to be called by the startup process while elasticsearch is in the

913d679

enrollment mode to obtain an enrollment token used to enroll a new node to the cluster. Resolve: elastic#71438 Related: elastic#72129

BigPandaToo marked this pull request as ready for review June 3, 2021 17:08

Merge branch 'master' into Create_Enrollment_Token

124a37d

albertzaharovits reviewed Jun 7, 2021

View reviewed changes

x-pack/docs/en/security/authorization/privileges.asciidoc Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 7, 2021

View reviewed changes

...nt/rest-high-level/src/main/java/org/elasticsearch/client/security/user/privileges/Role.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 7, 2021

View reviewed changes

x-pack/docs/en/security/authorization/privileges.asciidoc Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 7, 2021

View reviewed changes

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java Show resolved Hide resolved

albertzaharovits reviewed Jun 7, 2021

View reviewed changes

...ain/java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilegeResolver.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 8, 2021

View reviewed changes

...rc/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/CommandLineHttpClient.java Show resolved Hide resolved

albertzaharovits reviewed Jun 8, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 8, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Outdated Show resolved Hide resolved

jkakavas self-requested a review June 8, 2021 20:28

albertzaharovits reviewed Jun 8, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Outdated Show resolved Hide resolved

elasticmachine and others added 2 commits June 9, 2021 07:38

Merge branch 'master' into Create_Enrollment_Token

41f373a

Addressing PR feedback

0eebac8

albertzaharovits reviewed Jun 18, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Show resolved Hide resolved

albertzaharovits reviewed Jun 18, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 18, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jun 18, 2021

View reviewed changes

...ecurity/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java Show resolved Hide resolved

albertzaharovits approved these changes Jun 18, 2021

View reviewed changes

Addressing PR feedback

2a576c6

jkakavas reviewed Jun 22, 2021

View reviewed changes

elasticmachine and others added 2 commits June 22, 2021 03:13

Merge branch 'master' into Create_Enrollment_Token

a8d17d3

Addressing PR feedback

7f1585e

BigPandaToo requested a review from jkakavas June 22, 2021 16:21

jkakavas reviewed Jun 22, 2021

View reviewed changes

jkakavas approved these changes Jun 22, 2021

View reviewed changes

Addressing PR feedback

b194ba6

BigPandaToo merged commit b706e8a into elastic:master Jun 23, 2021

Security On by Default Implementation Tracking automation moved this from Implementation Milestone 1 ( June 18th ) to Completed Jun 23, 2021

jkakavas reviewed Jun 23, 2021

View reviewed changes

BigPandaToo mentioned this pull request Jun 23, 2021

Not encoding the Api Key in Enrollment token #74510

Merged

BigPandaToo added a commit to BigPandaToo/elasticsearch that referenced this pull request Jun 23, 2021

Calculate SHA256 fingerprint for enrollment token

60f7af6

A follow up PR for: elastic#73573

BigPandaToo mentioned this pull request Jun 23, 2021

Calculate SHA256 fingerprint for enrollment token #74511

Merged

BigPandaToo added a commit that referenced this pull request Jun 23, 2021

Not encoding the Api Key in Enrollment token (#74510)

00a1ae1

No need for base64 encode the API key before we put it as a value in the token, as the token itself will be Base64 encoded A follow up PR for: #73573

BigPandaToo added a commit that referenced this pull request Jun 24, 2021

Calculate SHA256 fingerprint for enrollment token (#74511)

c37f9f1

* Calculate SHA256 fingerprint for enrollment token A follow up PR for: #73573 * Adding a test fix Resolves: #74525

jakelandis added v8.0.0-alpha1 >enhancement and removed v8.0.0 labels Jul 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create enrollment token #73573

Create enrollment token #73573

BigPandaToo commented May 31, 2021 •

edited

elasticmachine commented May 31, 2021

BigPandaToo commented Jun 3, 2021

BigPandaToo commented Jun 9, 2021

BigPandaToo commented Jun 9, 2021

albertzaharovits left a comment

BigPandaToo commented Jun 21, 2021

jkakavas left a comment

jkakavas Jun 22, 2021

BigPandaToo commented Jun 22, 2021

jkakavas Jun 22, 2021

jkakavas left a comment

jkakavas Jun 23, 2021

BigPandaToo Jun 23, 2021

Create enrollment token #73573

Create enrollment token #73573

Conversation

BigPandaToo commented May 31, 2021 • edited

elasticmachine commented May 31, 2021

BigPandaToo commented Jun 3, 2021

BigPandaToo commented Jun 9, 2021

BigPandaToo commented Jun 9, 2021

albertzaharovits left a comment

Choose a reason for hiding this comment

BigPandaToo commented Jun 21, 2021

jkakavas left a comment

Choose a reason for hiding this comment

jkakavas Jun 22, 2021

Choose a reason for hiding this comment

BigPandaToo commented Jun 22, 2021

jkakavas Jun 22, 2021

Choose a reason for hiding this comment

jkakavas left a comment

Choose a reason for hiding this comment

jkakavas Jun 23, 2021

Choose a reason for hiding this comment

BigPandaToo Jun 23, 2021

Choose a reason for hiding this comment

BigPandaToo commented May 31, 2021 •

edited