Hello,
When upgrading our ElasticSearch/Kibana stack to 7.17.4 and ROR 1.41.0 we ran into a problem with how URLs are handled resulting in a non-functional Kibana.
I have isolated the problem to the ROR 1.40.0 and 1.41.0 Kibana plugins, they seem to be rewriting the Kibana URLs incorrectly.
My guess it is a side effect of the basepath handling fixes introduced in 1.40.0
What we’re seeing:
After login the user is redirected to https://<kibana>/s/default, which results in a 404 error from Kibana.
Changing the URL to https://<kibana>/home/app also results in a 404 but the Kibana access log shows a GET request to https://<kibana>/s/default/home/app.
In fact, all URLs get prepended with /s/default, resulting in a 404.
Authentication to ES succeeds, I can use Cerebro to browse the ES cluster no problem. Kibana also shows successful authentication.
I have also ruled out our Ingress setup (tested with multiple types and without) and Istio being the problem. Everything is pointing me towards these 2 specific versions of ROR.
Our setup is ES/Kibana 7.14.4 on Kubernetes using ECK operator 2.1.0, ROR Pro version 1.41.0
Relevant log lines (redacted and shortened):
ES:
{"type": "server", "timestamp": "2022-07-12T13:04:23,398Z", "level": "INFO", "component": "t.b.r.a.l.AccessControlLoggingDecorator", "cluster.name": "<REDACTED>", "node.name": "<REDACTED>", "message": "\u001B[36mALLOWED by { name: '::PUBLIC-RW::', policy: ALLOW, rules: [ldap_auth,indices] req={ ID:796915808-2042415205#131551, TYP:RRUserMetadataRequest, CGR:Some(<REDACTED>), USR:<REDACTED>, BRS:true, KDX:null, ACT:cluster:ror/user_metadata/get, OA:127.0.0.1/32, XFF:null, DA:<REDACTED>/32, IDX:<N/A>, MET:GET, PTH:/_readonlyrest/metadata/current_user, CNT:<N/A>, HDR:Authorization=<OMITTED>, accept-encoding=gzip,deflate, accept=*/*, content-length=0, host=<REDACTED>:9200, user-agent=node-fetch/1.0 (+https://github.com/bitinn/node-fetch), x-b3-sampled=1, x-b3-spanid=b9a2f5107467bfd5, x-b3-traceid=34334a4fb71b6b44b9a2f5107467bfd5, x-forwarded-proto=http, x-request-id=c57f3d00-94e0-9130-b878-5bb7cd4d4567, HIS:[::PUBLIC-RW::-> RULES:[ldap_auth->true, indices->true] RESOLVED:[user=<REDACTED>;group=<REDACTED>;av_groups=<REDACTED>]], }\u001B[0m", "cluster.uuid": "3XAXSVvURQGDZu75TrKpZw", "node.id": "-AjLxM1FSHOqFEpVc0KlQg" }
Kibana:
{"type":"response","@timestamp":"2022-07-12T13:04:23+00:00","tags":[],"pid":7,"method":"get","statusCode":302,"req":{"url":"/s/default/","method":"get","headers":{"host":"<REDACTED>"},"referer":"https://<REDACTED>/login?nextUrl=%2F"},"res":{"statusCode":302,"responseTime":12},"message":"GET /s/default/ 302 12ms"}
{"type":"response","@timestamp":"2022-07-12T13:04:23+00:00","tags":[],"pid":7,"method":"get","statusCode":404,"req":{"url":"/s/default","method":"get","headers":{"host":"<REDACTED>"},"referer":"https://<REDACTED>/login?nextUrl=%2F"},"res":{"statusCode":404,"responseTime":35,"contentLength":60},"message":"GET /s/default 404 35ms - 60.0B"}
{"type":"response","@timestamp":"2022-07-12T13:11:37+00:00","tags":[],"pid":7,"method":"get","statusCode":404,"req":{"url":"/s/default/app/home","method":"get","headers":{"host":"<REDACTED>"},"res":{"statusCode":404,"responseTime":29,"contentLength":60},"message":"GET /s/default/app/home 404 29ms - 60.0B"}
