[7.x] Adjust validation for OIDC endpoint (#37159) #37303
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This change adjusts validation of query parameters in the /api/security/v1/oidc endpoint. It was discovered during manual testing that Google's OP is sending extra parameters than the ones identified in https://tools.ietf.org/html/rfc6749#section-4.1.2 which is refernced by https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse (for instance auth_user and session_state). The existing validation rules only allowed the expected query parameters but this means that Kibana wouldn't be able to complete OpenID Connect authentication with Google acting as the OP. As dictated in the standard (RFC6749), "The client MUST ignore unrecognized response parameters." so we should allow but discard any extra parameters we do not recognize and not throw an error. Furthermore, it adds stricter validation for the issuer and all pararameters of type URI when these are present.
jkakavas
added
backport
Team:Security
|
Pinging @elastic/kibana-security |
💚 Build Succeeded |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adjusts validation of query parameters in the
/api/security/v1/oidc endpoint. It was discovered during manual
testing that Google's OP is sending extra parameters than the ones
identified in https://tools.ietf.org/html/rfc6749#section-4.1.2
which is refernced by
https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
(for instance auth_user and session_state). The existing validation
rules only allowed the expected query parameters but this
means that Kibana wouldn't be able to complete OpenID Connect
authentication with Google acting as the OP.
As dictated in the standard (RFC6749), "The client MUST ignore
unrecognized response parameters." so we should allow but discard
any extra parameters we do not recognize and not throw an error.
Furthermore, it adds stricter validation for the issuer and all
pararameters of type URI when these are present.