Cookie length should be less than or equal to 4096

22

If you put ES in debug mode, you can access the authorization header, and inspect the received JWT token coming from Kibana.

23

As I saw Kibana got all SAML groups. Here is log:

["info","readonlyrest_kbn:readonlyrest_kbn:sideserver:redirectWithResolvedIdentity"],"pid":1,"message":"obtained identity from external connector: {\"issuer\":\"https://keycloak.local/auth/realms/master\",\"sessionIndex\":\"c87ceaf9-9ca2-446b-bd35-b33c793351a2::b81e93ab-fd17-466b-809e-e98d43225d57\",\"nameID\":\"justuser\",\"nameIDFormat\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\",\"samlGroups\":[\"thisisgroup\"],\"user\":\"justuser\",\"configObject\":{\"buttonName\":\"master SSO\",\"enabled\":true,\"type\":\"saml\",\"issuer\":\"c07eb4b5-67ec-40c4-99a7-e5aec833eb87\",\"entryPoint\":\"https://keycloak.local/auth/realms/master/protocol/saml\",\"kibanaExternalHost\":\"kibana.dc01.kube.master.com\",\"protocol\":\"https\",\"usernameParameter\":\"nameID\",\"groupsParameter\":\"samlGroups\",\"logoutUrl\":\"https://keycloak.local/auth/realms/master/broker/saml/endpoint\",\"routePrefix\":\"/ror_kbn_sso_saml_kc\",\"name\":\"saml_kc\",\"callbackUrl\":\"https://kibana.dc01.kube.master.com/ror_kbn_sso_saml_kc/assert\",\"logoutCallbackUrl\":\"https://kibana.dc01.kube.master.com/ror_kbn_sso_saml_kc/notifylogout\",\"privateCert\":null,\"cert\":null,\"decryptionPvk\":null,\"path\":\"/saml/consume\",\"host\":\"localhost\",\"identifierFormat\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\"authnContext\":\"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport\",\"acceptedClockSkewMs\":0,\"validateInResponseTo\":false,\"requestIdExpirationPeriodMs\":28800000,\"cacheProvider\":{\"cacheKeys\":{},\"options\":{\"keyExpirationPeriodMs\":28800000}},\"signatureAlgorithm\":\"sha1\"}}"}
24

Found the issue, the JWT that ROR Enterprise forwarded to ES didn’t include the groups array. Making a new build for you as we speak.

25

https://readonlyrest-data.s3-eu-west-1.amazonaws.com/tmp/kibana/readonlyrest_kbn_enterprise-1.18.3-pre6-20190726_es6.7.1.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ/20190726/eu-west-1/s3/aws4_request&X-Amz-Date=20190726T132047Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=ae2ec448cd82550625a56525f614f6197048f40004da078d0b3d665ab92e2e99

26

Thanks! This build works. Need some time till Monday for tests.

1 Like
27

Great! Keep me posted :slight_smile:

28

Hello @sscarduzio!
When I restart Kibana container I always catch “Invalid cookie” message. Is it possible to avoid this behavior? My customers have to clear cookies after each restart, it’s annoying.

29

Oh yep I know what you mean. Will add it to Jira, will take care of this during these days. :+1:

30

Thanks! Looking forward to it!

1 Like
31

Hello @sscarduzio!
Found a new issue with the new build. I can’t access ReadonlyREST config from Kibana now, but I don’t see any denied messages in the ES.
I’ve checked on one of the previous build, before you changed cookie storage, and it has access to RoR config.
I guess, now it resolves groups from SAML in the wrong order.

32

Error in the JS console when try to access RoR config from Kibana

manifest.json:1 Manifest: Line: 1, column: 1, Unexpected token.
vendors.bundle.dll.js:316 GET https://kibana.dev.local/api/readonlyrest_kbn/settings 500
(anonymous) @ vendors.bundle.dll.js:316
sendReq @ vendors.bundle.dll.js:316
serverRequest @ vendors.bundle.dll.js:316
processQueue @ vendors.bundle.dll.js:316
(anonymous) @ vendors.bundle.dll.js:316
$digest @ vendors.bundle.dll.js:316
$apply @ vendors.bundle.dll.js:316
bootstrapApply @ vendors.bundle.dll.js:316
invoke @ vendors.bundle.dll.js:316
doBootstrap @ vendors.bundle.dll.js:316
bootstrap @ vendors.bundle.dll.js:316
chrome.bootstrap @ commons.bundle.js:10
LegacyPlatformService.start @ commons.bundle.js:10
CoreSystem.start @ commons.bundle.js:10
(anonymous) @ readonlyrest_kbn.bundle.js:1
Promise.then (async)
964 @ readonlyrest_kbn.bundle.js:1
__webpack_require__ @ readonlyrest_kbn.bundle.js:1
checkDeferredModules @ readonlyrest_kbn.bundle.js:1
(anonymous) @ readonlyrest_kbn.bundle.js:1
(anonymous) @ readonlyrest_kbn.bundle.js:1
33

Hey @sscarduzio!
Any updates?

34

Hi @Maligos,

Thanks for the wait. Here is the latest available build with a ton of bug fixes:

https://readonlyrest-data.s3-eu-west-1.amazonaws.com/tmp/kibana/readonlyrest_kbn_enterprise-1.18.5-pre3_es6.7.1.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ/20190807/eu-west-1/s3/aws4_request&X-Amz-Date=20190807T135107Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=365df12b5ed650af1c3d1a7e7eeaec8b870695b771dc263627efced88340440b

35

Hello @sscarduzio!

Issue with RoR config is solved in the new release, but Invalid Cookie still happens(

36

oh no, very strange! Will review.

37

https://readonlyrest-data.s3-eu-west-1.amazonaws.com/tmp/kibana/readonlyrest_kbn_enterprise-1.18.5-pre4_es6.7.1.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ/20190808/eu-west-1/s3/aws4_request&X-Amz-Date=20190808T100140Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=9d8db4f27e227b9c35b2abb1ac9b1cc6e7f8517026eaef174781d4a97b8a29b1

38

Again. After deploy a new version:

{"statusCode":400,"error":"Bad Request","message":"Invalid cookie value"}
39

Hello @sscarduzio!
Do you have a new build for test?

40

I found the issue, man this was really difficult. The bug was in the SAML library. Soon will give you a build.

41

https://readonlyrest-data.s3-eu-west-1.amazonaws.com/build/1.18.5-pre6/trial/20190813/enterprise/readonlyrest_kbn_enterprise-1.18.5-pre6-20190813_es6.7.1.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ/20190813/eu-west-1/s3/aws4_request&X-Amz-Date=20190813T154725Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=19f11542d59a64f3079f69134b0fdb963dd2f22a3fe166fa2393772fa1a84f46