Move audit filter before authn to log those failures as well #14535

soltysh · 2017-06-08T20:59:15Z

@mfojtik @smarterclayton this change is logging authn failures in audit, this is the sample output:

AUDIT: id="b6d649e5-452e-456f-8af2-7f3f8d56f24a" ip="127.0.0.1" method="GET" user="<none>" groups="<none>" as="<self>" asgroups="<lookup>" namespace="<none>" uri="/oauth/authorize?response_type=token&client_id=openshift-challenging-client"                                                                                                                                                                                                                                        
AUDIT: id="b6d649e5-452e-456f-8af2-7f3f8d56f24a" response="401"

@sttts @liggitt @deads2k fyi

soltysh · 2017-06-08T20:59:44Z

@mpbarrett fyi

smarterclayton · 2017-06-08T21:18:19Z

And it even looks easy to backport... :)

smarterclayton · 2017-06-08T21:19:10Z

So if we do this are we loosing the info from the user that is loaded during authentication?

sttts · 2017-06-09T05:55:09Z

So if we do this are we loosing the info from the user that is loaded during authentication?

Looks like.

I wonder whether we can't have both: put a fallback filter before authn, but keep the full-featured one where it is. If the later does not trigger (we can use a context value to know that), the fallback one will log the authn error.

We haven't thought about this in advanced auditing either, but there we carry around the audit event in the context already.

smarterclayton · 2017-06-09T15:05:32Z

Yeah I was thinking along those lines as well. Full featured, then catch all in fallback.

…

On Fri, Jun 9, 2017 at 1:55 AM, Dr. Stefan Schimanski < ***@***.***> wrote: So if we do this are we loosing the info from the user that is loaded during authentication? Looks like. I wonder whether we can't have both: put a fallback filter before authn, but keep the full-featured one where it is. If the later does not trigger (we can use a context value to know that), the fallback one will log the authn error. We haven't thought about this in advanced auditing either, but there we carry around the audit event in the context already. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14535 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p1JCz7VF49NqampDLzLR60cPN0ojks5sCN4-gaJpZM4N0nZ0> .

soltysh · 2017-06-14T10:25:27Z

@sttts @smarterclayton I've pushed current state with proposed changes from you guys, but it looks like I'm currently getting a bit more requests than I expected. Checkout this output: https://paste.fedoraproject.org/paste/ZZwM0dB7YQLypbXVqq5qiw and search for lines with user=<???> which are coming from the new filter, should limit the output to only authorization or dig why the original audit did not caught them?

soltysh · 2017-06-14T10:28:28Z

Nvmd wrt to those double lines, it looks like my flag isn't working as I expected it to be :/

soltysh · 2017-06-14T10:44:51Z

Of course I forgot to update the context mapper with new context data, updated, now it should be good. I still need to update the user to be reasonable.

sttts · 2017-06-14T10:46:15Z

pkg/cmd/server/origin/audit.go

+	apirequest "k8s.io/apiserver/pkg/endpoints/request"
+)
+
+const AUDIT_TRIGGERED = "audittriggered"


do we capital case constants?

sttts · 2017-06-14T10:50:19Z

pkg/cmd/server/origin/audit.go

+func (a *auditResponseWriter) WriteHeader(code int) {
+	ctx, ok := a.requestContextMapper.Get(a.req)
+	if !ok {
+		glog.Errorf("Unable to get RequestContextMapper and read context data!")


worth a panic

we're returning 500 in the original audit, I'll do the same here.

sttts · 2017-06-14T10:52:56Z

pkg/cmd/server/origin/audit.go

+
+var _ http.ResponseWriter = &auditResponseWriter{}
+
+type auditResponseWriter struct {


a good comment would be nice. It doesn't sound like this is just the fallback for the upstream audit handler. Maybe call it authFallbackAuditResponseWriter?

sttts · 2017-06-14T10:54:30Z

pkg/cmd/server/origin/audit.go

+
+// withAuditWrapper decorates a http.Handler with audit logging information for all the
+// requests coming to the server. If out is nil, no decoration takes place.
+func withAuditWrapper(handler http.Handler, requestContextMapper apirequest.RequestContextMapper, out io.Writer) http.Handler {


in fact there is no relation between WithAudit and this, isn't there? Would prefer WithAuditTriggeredMarker or something like that and an additional WithAudit call in the handler chain builder

sttts · 2017-06-14T10:54:48Z

pkg/cmd/server/origin/audit.go

+
+// withAuthnAudit decorates a http.Handler with audit logging ONLY information
+// related to failed Authn requests.
+func withAuthnAudit(handler http.Handler, requestContextMapper apirequest.RequestContextMapper, out io.Writer) http.Handler {


WithAuthFallbackAudit

soltysh · 2017-06-14T12:30:23Z

I've addressed @sttts comments. The remaining piece, I'm currently working on, is adding information about auth methods used for authentication.

soltysh · 2017-06-14T15:00:16Z

pkg/cmd/server/handlers/authentication.go

 		user, ok, err := authenticator.AuthenticateRequest(req)
 		if err != nil || !ok {
+			ctx = apirequest.WithValue(ctx, AuditAuthnUser, user)
+			ctx = apirequest.WithValue(ctx, AuditAuthnError, err)


@smarterclayton I've tried this approach to get the user and error and return that in the fallback audit logs, but it doesn't work :/ @sttts proposed we change AuthenticateRequest signature by extending its return type with additional []AuthenticationResult which will provide the information about user and method, with possibility to extend that in the future. We'd upstream this into 1.8, obviously. The only problem is that it might require a bit more work, and we're just closing 3.6. The other approach is to duplicate the logic responsible for getting user information in the fallback audit, and for token requests we'd just say it's that. wdyt?

@mfojtik @pweil- fyi, since this is one of must have for 3.6

soltysh · 2017-06-14T15:00:58Z

[test]

smarterclayton · 2017-06-14T15:49:46Z

As long as it's reasonably reliable, yes

…

On Wed, Jun 14, 2017 at 11:22 AM, OpenShift Bot ***@***.***> wrote: continuous-integration/openshift-jenkins/test Running ( https://ci.openshift.redhat.com/jenkins/job/test_pull_request_origin/2219/) (Base Commit: c7a38d7 <c7a38d7> ) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14535 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p5YEsHvHLkuI6qi_xnRum1lLqNlbks5sD_rKgaJpZM4N0nZ0> .

soltysh · 2017-06-16T12:38:43Z

Here's the current sample output:

AUDIT: id="abfadeb6-f52c-4e67-9e07-726e35992a89" ip="127.0.0.1" method="GET" user="mysillyusername" uri="/oauth/authorize?response_type=token&client_id=openshift-challenging-client"
AUDIT: id="abfadeb6-f52c-4e67-9e07-726e35992a89" response="401"

AUDIT: id="5db6d679-9820-4100-890c-4c9b297e7eec" ip="127.0.0.1" method="GET" user="<bearer>" uri="/api/v1/namespaces/test/pods"
AUDIT: id="5db6d679-9820-4100-890c-4c9b297e7eec" response="401"

soltysh · 2017-06-16T12:39:54Z

pkg/cmd/server/origin/audit.go

+
+// getUsername returns username or information on the authn method being used.
+func getUsername(req *http.Request) string {
+	auth := strings.TrimSpace(req.Header.Get("Authorization"))


@liggitt || @enj mind double checking if I'm missing something here?

mfojtik · 2017-06-16T12:40:00Z

@soltysh love it.

liggitt · 2017-06-16T12:54:02Z

pkg/cmd/server/origin/audit.go

+	}
+
+	// other tokens
+	token := strings.TrimSpace(req.URL.Query().Get("access_token"))


logging URLs before the auth filter can expose the query params

liggitt · 2017-06-16T12:54:26Z

pkg/cmd/server/origin/audit.go

+	}
+
+	// check basic auth
+	const basicScheme string = "Basic "


we don't support basic auth to our API, what is making use of this?

Wasn't sure if we support or not, but I found the code in origin, so I've implemented it also here.

liggitt · 2017-06-16T12:54:54Z

pkg/cmd/server/origin/audit.go

+	if len(parts) > 1 && strings.ToLower(parts[0]) == "bearer" {
+		token := parts[1]
+		// Empty bearer tokens aren't valid
+		if len(token) == 0 {


doing this to detect Authorization: Bearer doesn't seem very useful

it also draws a false distinction between empty bearer tokens and present but invalid bearer tokens

I've tried with wrong and empty Bearer token and haven't seen any difference, I'll leave just the bearer check and will go with that.

liggitt · 2017-06-16T12:56:32Z

pkg/cmd/server/origin/audit.go

+}
+
+// getUsername returns username or information on the authn method being used.
+func getUsername(req *http.Request) string {


this doesn't account for client cert auth

liggitt · 2017-06-16T15:39:27Z

pkg/cmd/server/origin/audit.go

+		return
+	}
+	id := uuid.NewRandom().String()
+	line := fmt.Sprintf("%s AUDIT: id=%q ip=%q method=%q user=%q uri=%q\n",


presenting the results of getUsername() as user=... seems wrong... it can attribute a request to a specific user pre-authentication, when it should be clearer that this is information the user presented that has not been verified in any way

What else are you proposing?

liggitt · 2017-06-16T15:40:15Z

pkg/cmd/server/origin/audit.go

+	}
+
+	// cert authn
+	if req.TLS != nil && len(req.TLS.PeerCertificates) > 0 {


this will be confused by an auth proxy that presents a client cert and communicates user info in headers

How can I fix this?

openshift-bot · 2017-06-16T17:32:10Z

continuous-integration/openshift-jenkins/test FAILURE (https://ci.openshift.redhat.com/jenkins/job/test_pull_request_origin/2314/) (Base Commit: 4aa3720) (PR Branch Commit: 33007d2)

openshift-merge-robot · 2017-07-25T19:01:20Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: soltysh
We suggest the following additional approver: deads2k

Assign the PR to them by writing /assign @deads2k in a comment when ready.

No associated issue. Update pull-request body to add a reference to an issue, or get approval with /approve no-issue

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

pkg/cmd/OWNERS

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

openshift-merge-robot · 2017-07-28T22:08:27Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: soltysh
We suggest the following additional approver: deads2k

Assign the PR to them by writing /assign @deads2k in a comment when ready.

No associated issue. Update pull-request body to add a reference to an issue, or get approval with /approve no-issue

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

pkg/cmd/OWNERS

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

openshift-merge-robot · 2017-07-28T22:36:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: soltysh
We suggest the following additional approver: deads2k

Assign the PR to them by writing /assign @deads2k in a comment when ready.

No associated issue. Update pull-request body to add a reference to an issue, or get approval with /approve no-issue

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

pkg/cmd/OWNERS

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

soltysh · 2017-08-14T22:00:34Z

@sttts ptal the audit bits, it's mostly copy&paste of the upstream handler. I'm wondering if we should just make it a public method instead of copying it here
@liggitt for the getUsername part, since you've had objections there. Is it sufficient or we need more usecases to cover.

soltysh · 2017-08-14T22:01:03Z

(3) [SCCFSI] audit log needs to capture all login events without turning on debug levels

sttts · 2017-08-15T06:50:56Z

pkg/cmd/server/origin/audit.go

+		}
+
+		// if there already exists an audit event in the context we don't need to do anything
+		if ae := request.AuditEventFrom(ctx); ae != nil {


that's a lot of copied code. Don't like this. What are our options?

Yeah, me neither. I was thinking about making this whole thing a helper function in audit upstream, wdyt?

What was the reason to not do the same as this PR in upstream?

Not sure, I think I can give it a try.

If we get rid of maintaining our fork, go for it.

soltysh · 2017-08-23T12:41:36Z

This is waiting for upstream PR kubernetes/kubernetes#51119

openshift-merge-robot · 2017-09-02T08:04:09Z

@soltysh PR needs rebase

soltysh · 2017-09-06T10:43:00Z

This is waiting for #16106 and #16110 to land since they are changing authn and authz bits.

soltysh · 2017-09-18T15:03:42Z

I'm closing this in favor of #16128 where I'll include the changes from this PR.

soltysh force-pushed the authn_audit branch from cba3d50 to c22f456 Compare June 14, 2017 10:23

soltysh force-pushed the authn_audit branch from c22f456 to d8e1136 Compare June 14, 2017 10:44

sttts reviewed Jun 14, 2017

View reviewed changes

soltysh force-pushed the authn_audit branch from d8e1136 to 53d7e77 Compare June 14, 2017 12:27

soltysh force-pushed the authn_audit branch from 53d7e77 to 42e6065 Compare June 14, 2017 14:55

soltysh commented Jun 14, 2017

View reviewed changes

soltysh force-pushed the authn_audit branch from 42e6065 to a008a21 Compare June 16, 2017 12:36

soltysh commented Jun 16, 2017

View reviewed changes

liggitt reviewed Jun 16, 2017

View reviewed changes

soltysh force-pushed the authn_audit branch from a008a21 to 33007d2 Compare June 16, 2017 15:12

liggitt reviewed Jun 16, 2017

View reviewed changes

openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 24, 2017

openshift-merge-robot assigned liggitt and deads2k Jul 25, 2017

openshift-merge-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2017

openshift-merge-robot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 28, 2017

soltysh force-pushed the authn_audit branch 2 times, most recently from 7442b22 to b9872bc Compare August 14, 2017 21:58

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 14, 2017

sttts reviewed Aug 15, 2017

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 17, 2017

soltysh added 2 commits September 1, 2017 15:37

UPSTREAM: 51119: Allow audit to log authorization failures

b23e9bd

Allow audit to log authorization failures - origin changes

547439a

soltysh force-pushed the authn_audit branch from b9872bc to 547439a Compare September 1, 2017 15:27

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 1, 2017

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 2, 2017

soltysh closed this Sep 18, 2017

soltysh deleted the authn_audit branch September 18, 2017 15:04


		var _ http.ResponseWriter = &auditResponseWriter{}

		type auditResponseWriter struct {

Move audit filter before authn to log those failures as well #14535

Move audit filter before authn to log those failures as well #14535

Conversation

soltysh commented Jun 8, 2017

soltysh commented Jun 8, 2017

smarterclayton commented Jun 8, 2017

smarterclayton commented Jun 8, 2017

sttts commented Jun 9, 2017

smarterclayton commented Jun 9, 2017 via email

soltysh commented Jun 14, 2017

soltysh commented Jun 14, 2017

soltysh commented Jun 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soltysh commented Jun 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soltysh commented Jun 14, 2017

smarterclayton commented Jun 14, 2017 via email

soltysh commented Jun 16, 2017

Choose a reason for hiding this comment

mfojtik commented Jun 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-bot commented Jun 16, 2017

openshift-merge-robot commented Jul 25, 2017

openshift-merge-robot commented Jul 28, 2017

openshift-merge-robot commented Jul 28, 2017

soltysh commented Aug 14, 2017

soltysh commented Aug 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soltysh commented Aug 23, 2017

openshift-merge-robot commented Sep 2, 2017

soltysh commented Sep 6, 2017 • edited Loading

soltysh commented Sep 18, 2017

soltysh commented Sep 6, 2017 •

edited

Loading