Can't get x-proxy-roles to recognize mapping roles

145 views

Skip to first unread message

Brian Walsh

unread,

Jul 30, 2016, 10:25:18 PM7/30/16

to Search Guard

Hi.

Thanks for a great product. I was able to get going quickly and have the proxy_auth_domain running.

Question: I can't seem to get it to recognize the x-proxy-roles. I would have expected it to accept the x-proxy-roles value and look up sg_roles

$ curl -k -H "X-Forwarded-For: 1.2.3.4" -H"x-proxy-user: worf" https://localhost:9200/_searchguard/authinfo

{"user":"User [name=worf, roles=[]]","remote_address":"1.2.3.4:43772","sg_roles":["sg_public","sg_role_klingons1","sg_role_starfleet"],"principal":null,"peer_certificates":"0"}

$ curl -k -H "X-Forwarded-For: 1.2.3.4" -H"x-proxy-user: worf" -H"x-proxy-roles: captains" https://localhost:9200/_searchguard/authinfo

{"user":"User [name=worf, roles=[]]","remote_address":"1.2.3.4:43778","sg_roles":["sg_public","sg_role_klingons1","sg_role_starfleet"],"principal":null,"peer_certificates":"0"}

$ curl -k -H "X-Forwarded-For: 1.2.3.4" -H"x-proxy-user: janeway" -H"x-proxy-roles: captains" https://localhost:9200/_searchguard/authinfo

{"user":"User [name=janeway, roles=[]]","remote_address":"1.2.3.4:43780","sg_roles":["sg_public"],"principal":null,"peer_certificates":"0"}

Brian Walsh

unread,

Jul 30, 2016, 10:42:14 PM7/30/16

to Search Guard

Additional information:

[2016-07-31 02:40:28,823][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [User-Agent=curl/7.38.0, Host=localhost:9200, Accept=*/*, x-proxy-user=janeway, x-proxy-roles=captains]

[2016-07-31 02:40:28,824][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value janeway

[2016-07-31 02:40:28,824][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value captains

[2016-07-31 02:40:28,825][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'janeway' is in cache? false (cache size: 0)

[2016-07-31 02:40:28,826][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] janeway (-1827115326) not cached, return from noop backend directly

[2016-07-31 02:40:28,826][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'User [name=janeway, roles=[]]' is authenticated

SG

unread,

Jul 31, 2016, 5:49:33 AM7/31/16

to search...@googlegroups.com

looks like https://github.com/floragunncom/search-guard/issues/162

Which version of search guard do you use?

> --
> You received this message because you are subscribed to the Google Groups "Search Guard" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
> To post to this group, send email to search...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/8bf18069-4924-4365-a39a-f7b1167a6080%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

Brian Walsh

unread,

Jul 31, 2016, 11:53:30 AM7/31/16

to Search Guard

Thank you so much for the quick response.

I'm running 2.3.3 via https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle

What version do you recommend ( I'd ideally like this to work with 5.0 alpha )

drwxr-xr-x 10 elasticsearch elasticsearch 4096 Jul 31 01:55 elasticsearch-2.3.3-localhost

-rw-r--r-- 1 elasticsearch elasticsearch 58961889 Jun 30 06:40 elasticsearch-4DD5ED74-7B2A-4662-8048-425634E6A694.tar.gz

drwxr-xr-x 3 elasticsearch elasticsearch 4096 Jul 31 01:54 search-guard-ssl

drwxr-xr-x 5 elasticsearch elasticsearch 4096 Jul 31 01:58 searchguard-client

SG

unread,

Jul 31, 2016, 1:57:22 PM7/31/16

to search...@googlegroups.com, br...@bwalsh.com

try this: https://cdn.filestackcontent.com/XW1zYS6QNSboc1PYqPvs

> To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/147becd1-f745-4122-952b-e0de8cb28314%40googlegroups.com.

Brian Walsh

unread,

Jul 31, 2016, 6:48:18 PM7/31/16

to Search Guard, br...@bwalsh.com

Thanks for another quick response.

I tried that image, but there seems to be an issue. I can't get it initialized.

# client log

$ ./sgadmin.sh

Connect to localhost:9300

Clustername: elasticsearch

Clusterstate: GREEN

Number of nodes: 1

Number of data nodes: 1

searchguard index does not exists, attempt to create it ... done

Populate config from /searchguard/searchguard-client/plugins/search-guard-2/sgconfig

Will update 'config' with plugins/search-guard-2/sgconfig/sg_config.yml

SUCC Configuration for 'config' created or updated

Will update 'roles' with plugins/search-guard-2/sgconfig/sg_roles.yml

SUCC Configuration for 'roles' created or updated

Will update 'rolesmapping' with plugins/search-guard-2/sgconfig/sg_roles_mapping.yml

SUCC Configuration for 'rolesmapping' created or updated

Will update 'internalusers' with plugins/search-guard-2/sgconfig/sg_internal_users.yml

SUCC Configuration for 'internalusers' created or updated

Will update 'actiongroups' with plugins/search-guard-2/sgconfig/sg_action_groups.yml

SUCC Configuration for 'actiongroups' created or updated

FAIL: Expected 5 config types for node ET6r5TdXTwC3tfDkD7T52g but got only []

Done with failures

# server log

[2016-07-31 22:45:28,600][DEBUG][common.compress.lzf ] using decoder[VanillaChunkDecoder]

[2016-07-31 22:45:28,671][DEBUG][cluster.service ] [localhost] processing [put-mapping [config]]: execute

[2016-07-31 22:45:28,691][DEBUG][cluster.metadata ] [localhost] [searchguard] create_mapping [config] with source [{"config":{"properties":{"searchguard":{"properties":{"dynamic":{"properties":{"authc":{"properties":{"basic_internal_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"clientcert_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"host_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"jwt_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"config":{"properties":{"jwt_header":{"type":"string"},"signing_key":{"type":"string"}}},"type":{"type":"string"}}},"order":{"type":"long"}}},"kerberos_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"config":{"properties":{"acceptor_principal":{"type":"string"},"krb_debug":{"type":"boolean"},"strip_realm_from_principal":{"type":"boolean"}}},"type":{"type":"string"}}},"order":{"type":"long"}}},"ldap":{"properties":{"authentication_backend":{"properties":{"config":{"properties":{"enable_ssl":{"type":"boolean"},"enable_ssl_client_auth":{"type":"boolean"},"enable_start_tls":{"type":"boolean"},"hosts":{"type":"string"},"userbase":{"type":"string"},"usersearch":{"type":"string"},"verify_hostnames":{"type":"boolean"}}},"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"proxy_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"config":{"properties":{"roles_header":{"type":"string"},"user_header":{"type":"string"}}},"type":{"type":"string"}}},"order":{"type":"long"}}}}},"authz":{"properties":{"roles_from_another_ldap":{"properties":{"authorization_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"}}},"roles_from_myldap":{"properties":{"authorization_backend":{"properties":{"config":{"properties":{"enable_ssl":{"type":"boolean"},"enable_ssl_client_auth":{"type":"boolean"},"enable_start_tls":{"type":"boolean"},"hosts":{"type":"string"},"resolve_nested_roles":{"type":"boolean"},"rolebase":{"type":"string"},"rolename":{"type":"string"},"rolesearch":{"type":"string"},"userbase":{"type":"string"},"userrolename":{"type":"string"},"usersearch":{"type":"string"},"verify_hostnames":{"type":"boolean"}}},"type":{"type":"string"}}},"enabled":{"type":"boolean"}}}}},"http":{"properties":{"anonymous_auth_enabled":{"type":"boolean"},"xff":{"properties":{"enabled":{"type":"boolean"},"internalProxies":{"type":"string"},"proxiesHeader":{"type":"string"},"remoteIpHeader":{"type":"string"}}}}}}}}}}}}]

[2016-07-31 22:45:28,709][DEBUG][cluster.service ] [localhost] cluster state updated, version [5], source [put-mapping [config]]

[2016-07-31 22:45:28,713][DEBUG][cluster.service ] [localhost] publishing cluster state version [5]

[2016-07-31 22:45:28,714][DEBUG][cluster.service ] [localhost] set local cluster state to version 5

[2016-07-31 22:45:28,724][DEBUG][cluster.service ] [localhost] processing [put-mapping [config]]: took 52ms done applying updated cluster_state (version: 5, uuid: L1znv5DKTxCh7ZWH9G_f-Q)

[2016-07-31 22:45:28,980][DEBUG][cluster.service ] [localhost] processing [put-mapping [roles]]: execute

[2016-07-31 22:45:28,990][DEBUG][cluster.metadata ] [localhost] [searchguard] create_mapping [roles] with source [{"roles":{"properties":{"sg_all_access":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_kibana4":{"properties":{"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}},"?kibana":{"properties":{"*":{"type":"string"}}}}}}},"sg_kibana4_server":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"?kibana":{"properties":{"*":{"type":"string"}}}}}}},"sg_kibana4_testindex":{"properties":{"indices":{"properties":{"?kibana":{"properties":{"*":{"type":"string"}}},"test*":{"properties":{"*":{"type":"string"}}}}}}},"sg_logstash":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*beat*":{"properties":{"*":{"type":"string"}}},"logstash-*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readall":{"properties":{"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readonly_and_monitor":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readonly_dlsfls":{"properties":{"indices":{"properties":{"/\\S*/":{"properties":{"*":{"type":"string"},"_dls_":{"type":"string"},"_fls_":{"type":"string"}}}}}}},"sg_role_starfleet":{"properties":{"indices":{"properties":{"pub*":{"properties":{"*":{"type":"string"}}},"sf":{"properties":{"alumni":{"type":"string"},"public":{"type":"string"},"ships":{"type":"string"},"students":{"type":"string"}}}}}}},"sg_role_starfleet_captains":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"pub*":{"properties":{"*":{"type":"string"}}},"sf":{"properties":{"*":{"type":"string"}}}}}}},"sg_transport_client":{"properties":{"cluster":{"type":"string"}}}}}}]

[2016-07-31 22:45:29,001][DEBUG][cluster.service ] [localhost] cluster state updated, version [6], source [put-mapping [roles]]

[2016-07-31 22:45:29,002][DEBUG][cluster.service ] [localhost] publishing cluster state version [6]

[2016-07-31 22:45:29,002][DEBUG][cluster.service ] [localhost] set local cluster state to version 6

[2016-07-31 22:45:29,019][DEBUG][cluster.service ] [localhost] processing [put-mapping [roles]]: took 38ms done applying updated cluster_state (version: 6, uuid: ohhZkrEIQZmnhcpueULRPw)

[2016-07-31 22:45:29,077][DEBUG][cluster.service ] [localhost] processing [put-mapping [rolesmapping]]: execute

[2016-07-31 22:45:29,088][DEBUG][cluster.metadata ] [localhost] [searchguard] create_mapping [rolesmapping] with source [{"rolesmapping":{"properties":{"sg_all_access":{"properties":{"users":{"type":"string"}}},"sg_kibana4":{"properties":{"users":{"type":"string"}}},"sg_kibana4_server":{"properties":{"users":{"type":"string"}}},"sg_kibana4_testindex":{"properties":{"users":{"type":"string"}}},"sg_logstash":{"properties":{"users":{"type":"string"}}},"sg_public":{"properties":{"users":{"type":"string"}}},"sg_readall":{"properties":{"users":{"type":"string"}}},"sg_readonly_dlsfls":{"properties":{"users":{"type":"string"}}},"sg_role_klingons1":{"properties":{"backendroles":{"type":"string"},"hosts":{"type":"string"},"users":{"type":"string"}}},"sg_role_starfleet":{"properties":{"backendroles":{"type":"string"},"hosts":{"type":"string"},"users":{"type":"string"}}},"sg_role_starfleet_captains":{"properties":{"backendroles":{"type":"string"}}}}}}]

[2016-07-31 22:45:29,091][DEBUG][cluster.service ] [localhost] cluster state updated, version [7], source [put-mapping [rolesmapping]]

[2016-07-31 22:45:29,093][DEBUG][cluster.service ] [localhost] publishing cluster state version [7]

[2016-07-31 22:45:29,093][DEBUG][cluster.service ] [localhost] set local cluster state to version 7

[2016-07-31 22:45:29,107][DEBUG][cluster.service ] [localhost] processing [put-mapping [rolesmapping]]: took 29ms done applying updated cluster_state (version: 7, uuid: OTKBaYE1R0GExtuT7cr0FA)

[2016-07-31 22:45:29,159][DEBUG][cluster.service ] [localhost] processing [put-mapping [internalusers]]: execute

[2016-07-31 22:45:29,164][DEBUG][cluster.metadata ] [localhost] [searchguard] create_mapping [internalusers] with source [{"internalusers":{"properties":{"admin":{"properties":{"hash":{"type":"string"}}},"dlsflsuser":{"properties":{"hash":{"type":"string"}}},"kibanaro":{"properties":{"hash":{"type":"string"}}},"kibanaserver":{"properties":{"hash":{"type":"string"}}},"kirk":{"properties":{"hash":{"type":"string"},"roles":{"type":"string"}}},"logstash":{"properties":{"hash":{"type":"string"}}},"mister_picard":{"properties":{"hash":{"type":"string"},"username":{"type":"string"}}},"readall":{"properties":{"hash":{"type":"string"}}},"spock":{"properties":{"hash":{"type":"string"},"roles":{"type":"string"}}},"test":{"properties":{"hash":{"type":"string"}}},"worf":{"properties":{"hash":{"type":"string"}}}}}}]

[2016-07-31 22:45:29,165][DEBUG][cluster.service ] [localhost] cluster state updated, version [8], source [put-mapping [internalusers]]

[2016-07-31 22:45:29,165][DEBUG][cluster.service ] [localhost] publishing cluster state version [8]

[2016-07-31 22:45:29,165][DEBUG][cluster.service ] [localhost] set local cluster state to version 8

[2016-07-31 22:45:29,181][DEBUG][cluster.service ] [localhost] processing [put-mapping [internalusers]]: took 21ms done applying updated cluster_state (version: 8, uuid: pOEM-rQMTlCeAjCIa85fMA)

[2016-07-31 22:45:29,229][DEBUG][cluster.service ] [localhost] processing [put-mapping [actiongroups]]: execute

[2016-07-31 22:45:29,234][DEBUG][cluster.metadata ] [localhost] [searchguard] create_mapping [actiongroups] with source [{"actiongroups":{"properties":{"ALL":{"type":"string"},"CLUSTER_ALL":{"type":"string"},"CLUSTER_MONITOR":{"type":"string"},"CREATE_INDEX":{"type":"string"},"CRUD":{"type":"string"},"DATA_ACCESS":{"type":"string"},"DELETE":{"type":"string"},"GET":{"type":"string"},"INDEX":{"type":"string"},"MANAGE":{"type":"string"},"MANAGE_ALIASES":{"type":"string"},"MONITOR":{"type":"string"},"READ":{"type":"string"},"SEARCH":{"type":"string"},"SUGGEST":{"type":"string"},"WRITE":{"type":"string"}}}}]

[2016-07-31 22:45:29,242][DEBUG][cluster.service ] [localhost] cluster state updated, version [9], source [put-mapping [actiongroups]]

[2016-07-31 22:45:29,245][DEBUG][cluster.service ] [localhost] publishing cluster state version [9]

[2016-07-31 22:45:29,246][DEBUG][cluster.service ] [localhost] set local cluster state to version 9

[2016-07-31 22:45:29,254][DEBUG][cluster.service ] [localhost] processing [put-mapping [actiongroups]]: took 24ms done applying updated cluster_state (version: 9, uuid: 2l_KY_5rSRevsvpgrlDk2w)

[2016-07-31 22:45:38,244][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:45:39,012][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:45:41,053][DEBUG][indices.memory ] [localhost] recalculating shard indexing buffer, total is [101.5mb] with [1] active shards, each shard set to indexing=[101.5mb], translog=[64kb]

[2016-07-31 22:45:48,245][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:45:49,013][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:45:58,246][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:45:59,015][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:46:08,246][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:46:09,016][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:46:11,054][DEBUG][indices.memory ] [localhost] recalculating shard indexing buffer, total is [101.5mb] with [1] active shards, each shard set to indexing=[101.5mb], translog=[64kb]

[2016-07-31 22:46:18,251][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:46:19,017][DEBUG][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve null

[2016-07-31 22:46:19,018][ERROR][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [localhost] Unable to load all configurations types. Loaded '[]' but should '[config, roles, rolesmapping, internalusers, actiongroups]'

[2016-07-31 22:46:19,019][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [localhost] Retrieved config due to config update request and will now update config change listeners

[2016-07-31 22:46:19,362][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine.

javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?

at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)

at sun.security.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1561)

at org.jboss.netty.handler.ssl.SslHandler.closeEngine(SslHandler.java:591)

at org.jboss.netty.handler.ssl.SslHandler.channelDisconnected(SslHandler.java:583)

at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)

at org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:396)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.close(AbstractNioWorker.java:360)

at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:93)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)

at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)

at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)

at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)

at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

[2016-07-31 22:46:19,368][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine.