Commits on May 29, 2019

1. Adjust validation for OIDC endpoint (elastic#37159) …

   This change adjusts validation of query parameters in the
   /api/security/v1/oidc endpoint. It was discovered during manual
   testing that Google's OP is sending extra parameters than the ones
   identified in https://tools.ietf.org/html/rfc6749#section-4.1.2
   which is refernced by
   https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse
   (for instance auth_user and session_state). The existing validation
   rules only allowed the expected query parameters but this
   means that Kibana wouldn't be able to complete OpenID Connect
   authentication with Google acting as the OP.
   As dictated in the standard (RFC6749), "The client MUST ignore
   unrecognized response parameters." so we should allow but discard
   any extra parameters we do not recognize and not throw an error.
   Furthermore, it adds stricter validation for the issuer and all
   pararameters of type URI when these are present.

   

   jkakavas committed May 29, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for d0330d5
   • Browse repository at this point

   Copy the full SHA

   d0330d5 View commit details

   Browse the repository at this point in the history