Setting elastic password from stored hash

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/DefaultAuthenticationFailureHandler.java

@@ -7,6 +7,7 @@
 package org.elasticsearch.xpack.core.security.authc;
 
 import org.elasticsearch.ElasticsearchSecurityException;
+import org.elasticsearch.ElasticsearchStatusException;
 import org.elasticsearch.common.util.concurrent.ThreadContext;
 import org.elasticsearch.rest.RestRequest;
 import org.elasticsearch.rest.RestStatus;
@@ -20,12 +21,15 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 
+import static org.elasticsearch.rest.RestStatus.INTERNAL_SERVER_ERROR;
 import static org.elasticsearch.xpack.core.security.support.Exceptions.authenticationError;
+import static org.elasticsearch.xpack.core.security.support.Exceptions.internalServerError;
 
 /**
  * The default implementation of a {@link AuthenticationFailureHandler}. This
  * handler will return an exception with a RestStatus of 401 and default failure
- * response headers like 'WWW-Authenticate'
+ * response headers like 'WWW-Authenticate' or an ElasticSecurityException with a
+ * RestStatus of 500 (INTERNAL_SERVER_ERROR)
  */
 public class DefaultAuthenticationFailureHandler implements AuthenticationFailureHandler {
     private volatile Map<String, List<String>> defaultFailureResponseHeaders;
@@ -126,7 +130,7 @@ public ElasticsearchSecurityException authenticationRequired(String action, Thre
 
     /**
      * Creates an instance of {@link ElasticsearchSecurityException} with
-     * {@link RestStatus#UNAUTHORIZED} status.
+     * {@link RestStatus#UNAUTHORIZED} or {@link RestStatus#INTERNAL_SERVER_ERROR}status.
      * <p>
      * Also adds default failure response headers as configured for this
      * {@link DefaultAuthenticationFailureHandler}
@@ -137,7 +141,10 @@ public ElasticsearchSecurityException authenticationRequired(String action, Thre
      * @param message error message
      * @param t cause, if it is an instance of
      *            {@link ElasticsearchSecurityException} asserts status is
-     *            RestStatus.UNAUTHORIZED and adds headers to it, else it will
+     *            RestStatus.UNAUTHORIZED and adds headers to it,
+     *            if it is an instance of {@link ElasticsearchStatusException}
+     *            with status code 500 (INTERNAL_SERVER_ERROR) set status to
+     *            RestStatus.INTERNAL_SERVER_ERROR, else it will
      *            create a new instance of {@link ElasticsearchSecurityException}
      * @param args error message args
      * @return instance of {@link ElasticsearchSecurityException}
@@ -160,6 +167,9 @@ private ElasticsearchSecurityException createAuthenticationError(final String me
             } else {
                 containsNegotiateWithToken = false;
             }
+        } else if (t instanceof ElasticsearchStatusException && ((ElasticsearchStatusException) t).status() == INTERNAL_SERVER_ERROR) {
+            ese = internalServerError(message, t, args);
+            containsNegotiateWithToken = false;
         } else {
             ese = authenticationError(message, t, args);
             containsNegotiateWithToken = false;

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/support/Exceptions.java

@@ -34,4 +34,8 @@ public static ElasticsearchSecurityException authorizationError(String msg, Obje
     public static ElasticsearchSecurityException authorizationError(String msg, Exception cause, Object... args) {
         return new ElasticsearchSecurityException(msg, RestStatus.FORBIDDEN, cause, args);
     }
+
+    public static ElasticsearchSecurityException internalServerError(String msg, Throwable cause, Object... args) {
+        return new ElasticsearchSecurityException(msg, RestStatus.INTERNAL_SERVER_ERROR, cause, args);
+    }
 }

x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/test/SecuritySingleNodeTestCase.java

@@ -56,9 +56,9 @@
 public abstract class SecuritySingleNodeTestCase extends ESSingleNodeTestCase {
 
     private static SecuritySettingsSource SECURITY_DEFAULT_SETTINGS = null;
-    private static CustomSecuritySettingsSource customSecuritySettingsSource = null;
     private static RestClient restClient = null;
     private static SecureString BOOTSTRAP_PASSWORD = null;
+    protected static CustomSecuritySettingsSource customSecuritySettingsSource = null;
 
     @BeforeClass
     public static void generateBootstrapPassword() {
@@ -239,9 +239,9 @@ protected boolean transportSSLEnabled() {
         return randomBoolean();
     }
 
-    private class CustomSecuritySettingsSource extends SecuritySettingsSource {
+    protected class CustomSecuritySettingsSource extends SecuritySettingsSource {
 
-        private CustomSecuritySettingsSource(boolean sslEnabled, Path configDir, ESIntegTestCase.Scope scope) {
+        public CustomSecuritySettingsSource(boolean sslEnabled, Path configDir, ESIntegTestCase.Scope scope) {
             super(sslEnabled, configDir, scope);
         }
 

x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/authc/esnative/PasswordHashAndBootstrapPasswordIntegTests.java

@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+package org.elasticsearch.xpack.security.authc.esnative;
+
+import org.elasticsearch.ElasticsearchStatusException;
+import org.elasticsearch.action.admin.cluster.health.ClusterHealthResponse;
+import org.elasticsearch.cluster.health.ClusterHealthStatus;
+import org.elasticsearch.cluster.health.ClusterIndexHealth;
+import org.elasticsearch.common.Priority;
+import org.elasticsearch.common.settings.MockSecureSettings;
+import org.elasticsearch.common.settings.SecureString;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.rest.RestStatus;
+import org.elasticsearch.test.SecuritySingleNodeTestCase;
+import org.elasticsearch.xpack.core.security.user.ElasticUser;
+
+import java.util.Map;
+
+import static java.util.Collections.singletonMap;
+import static org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken.basicAuthHeaderValue;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.notNullValue;
+
+public class PasswordHashAndBootstrapPasswordIntegTests extends SecuritySingleNodeTestCase {
+
+    @Override
+    public Settings nodeSettings() {
+        Settings customSettings = customSecuritySettingsSource.nodeSettings(0, Settings.EMPTY);
+        MockSecureSettings mockSecuritySettings = new MockSecureSettings();
+        mockSecuritySettings.setString("autoconfiguration.password_hash", // password1
+            "{PBKDF2_STRETCH}1000$JnmgicthPZkczB8MaQeJiV6IX43h7mSfPSzESqnYYSA=$OZKH5XFNK+M65mcKal6zgugWRcpl6wUXmSQZ6hPy+iw=");
+        mockSecuritySettings.setString("bootstrap.password", "password");
+        Settings.Builder builder = Settings.builder().put(customSettings, true);
+        builder.setSecureSettings(mockSecuritySettings);
+        return builder.build();
+    }
+
+    @Override
+    protected boolean addMockHttpTransport() {
+        return false;
+    }
+
+    @Override
+    protected boolean transportSSLEnabled() { return false; }
+
+    public void testBootstrapPwdAuthenticatePwdHashNotIndexNotCreated() {
+        ElasticsearchStatusException e = expectThrows( ElasticsearchStatusException.class,
+            () ->  client()
+                .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                    new SecureString("password1".toCharArray()))))
+                .admin()
+                .cluster()
+                .prepareHealth().setWaitForEvents(Priority.LANGUID).setWaitForGreenStatus()
+                .get() );
+
+        assertThat(e.status(), equalTo(RestStatus.UNAUTHORIZED));
+
+        ClusterHealthResponse response = client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                new SecureString("password".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth().setWaitForEvents(Priority.LANGUID).setWaitForGreenStatus()
+            .get();
+
+        assertThat(response, notNullValue());
+        assertThat(response.isTimedOut(), equalTo(false));
+        assertThat(response.status(), equalTo(RestStatus.OK));
+        assertThat(response.getStatus(), equalTo(ClusterHealthStatus.GREEN));
+        boolean securityIndexCreated = false;
+        for (Map.Entry<String, ClusterIndexHealth>  indexEntry: response.getIndices().entrySet()) {
+            if (indexEntry.getKey().startsWith(".security")) {
+                securityIndexCreated = true;
+                break;
+            }
+        }
+        assertFalse(securityIndexCreated);
+    }
+}

x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/authc/esnative/PasswordHashPromotionIntegTests.java

@@ -0,0 +1,155 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+package org.elasticsearch.xpack.security.authc.esnative;
+
+import org.elasticsearch.ElasticsearchStatusException;
+import org.elasticsearch.action.admin.cluster.health.ClusterHealthResponse;
+import org.elasticsearch.action.support.PlainActionFuture;
+import org.elasticsearch.client.Client;
+import org.elasticsearch.cluster.health.ClusterHealthStatus;
+import org.elasticsearch.cluster.health.ClusterIndexHealth;
+import org.elasticsearch.common.Priority;
+import org.elasticsearch.common.Strings;
+import org.elasticsearch.common.settings.MockSecureSettings;
+import org.elasticsearch.common.settings.SecureString;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.rest.RestStatus;
+import org.elasticsearch.test.SecuritySettingsSource;
+import org.elasticsearch.test.SecuritySingleNodeTestCase;
+import org.elasticsearch.xpack.core.security.action.user.PutUserAction;
+import org.elasticsearch.xpack.core.security.action.user.PutUserRequest;
+import org.elasticsearch.xpack.core.security.action.user.PutUserResponse;
+import org.elasticsearch.xpack.core.security.user.ElasticUser;
+
+import java.util.Map;
+import java.util.concurrent.ExecutionException;
+
+import static java.util.Collections.singletonMap;
+import static org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken.basicAuthHeaderValue;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.notNullValue;
+
+public class PasswordHashPromotionIntegTests extends SecuritySingleNodeTestCase {
+
+    @Override
+    public Settings nodeSettings() {
+        Settings customSettings = customSecuritySettingsSource.nodeSettings(0, Settings.EMPTY);
+        MockSecureSettings mockSecuritySettings = new MockSecureSettings();
+        mockSecuritySettings.setString("autoconfiguration.password_hash",
+            "{PBKDF2_STRETCH}1000$JnmgicthPZkczB8MaQeJiV6IX43h7mSfPSzESqnYYSA=$OZKH5XFNK+M65mcKal6zgugWRcpl6wUXmSQZ6hPy+iw=");
+        Settings.Builder builder = Settings.builder().put(customSettings, false); // don't bring in bootstrap.password
+        builder.setSecureSettings(mockSecuritySettings);
+        return builder.build();
+    }
+
+    @Override
+    protected boolean addMockHttpTransport() {
+        return false;
+    }
+
+    @Override
+    protected boolean transportSSLEnabled() { return false; }
+
+    public void testAuthenticate() {
+        ClusterHealthResponse response = client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                new SecureString("password1".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth()
+            .setWaitForEvents(Priority.LANGUID)
+            .setWaitForNodes(Integer.toString(1))
+            .setWaitForGreenStatus()
+            .get();
+
+        assertThat(response, notNullValue());
+        assertThat(response.isTimedOut(), equalTo(false));
+        assertThat(response.status(), equalTo(RestStatus.OK));
+        assertThat(response.getStatus(), equalTo(ClusterHealthStatus.GREEN));
+        assertTrue(securityIndexExists());
+
+        // Now as the document exists let's try to authenticate again
+        response = client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                new SecureString("password1".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth()
+            .get();
+
+        assertThat(response, notNullValue());
+        assertThat(response.status(), equalTo(RestStatus.OK));
+    }
+
+    public void testInvalidPasswordHashNoSecurityIndex() {
+        ElasticsearchStatusException e = expectThrows( ElasticsearchStatusException.class,
+            () -> client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                new SecureString("password".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth()
+            .get() );
+
+        assertThat(e.status(), equalTo(RestStatus.UNAUTHORIZED));
+        assertFalse(securityIndexExists());
+    }
+
+    public void testSecurityIndexExistsButElasticuserNot() throws Exception {
+        // Create a user to create the Index
+        createUser("user", SecuritySettingsSource.TEST_PASSWORD_HASHED.toCharArray(), Strings.EMPTY_ARRAY);
+        assertTrue(securityIndexExists());
+
+        ClusterHealthResponse response = client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue(ElasticUser.NAME,
+                new SecureString("password1".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth().setWaitForEvents(Priority.LANGUID).setWaitForGreenStatus()
+            .get();
+        assertThat(response, notNullValue());
+        assertThat(response.isTimedOut(), equalTo(false));
+        assertThat(response.status(), equalTo(RestStatus.OK));
+    }
+
+    // TODO: Add a test a test where we index the document for the elastic user manually and then we try to authenticate with the
+    // autoconfigured password hash and it fails
+
+    private void createUser(String username, char[] password, String[] roles) throws ExecutionException, InterruptedException {
+        final PutUserRequest putUserRequest = new PutUserRequest();
+        putUserRequest.username(username);
+        putUserRequest.roles(roles);
+        putUserRequest.passwordHash(password);
+        PlainActionFuture<PutUserResponse> listener = new PlainActionFuture<>();
+        final Client client = client().filterWithHeader(
+            Map.of("Authorization", basicAuthHeaderValue("test_user", new SecureString("x-pack-test-password"
+                .toCharArray()))));
+        client.execute(PutUserAction.INSTANCE, putUserRequest, listener);
+        final PutUserResponse putUserResponse = listener.get();
+        assertTrue(putUserResponse.created());
+    }
+
+    private boolean securityIndexExists () {
+        ClusterHealthResponse response = client()
+            .filterWithHeader(singletonMap("Authorization", basicAuthHeaderValue("test_user",
+                new SecureString("x-pack-test-password".toCharArray()))))
+            .admin()
+            .cluster()
+            .prepareHealth().setWaitForEvents(Priority.LANGUID).setWaitForGreenStatus()
+            .get();
+
+        boolean securityIndexExists = false;
+        for (Map.Entry<String, ClusterIndexHealth>  indexEntry: response.getIndices().entrySet()) {
+            if (indexEntry.getKey().startsWith(".security")) {
+                securityIndexExists = true;
+                break;
+            }
+        }
+        return securityIndexExists;
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/GenerateInitialBuiltinUsersPasswordListener.java

@@ -48,13 +48,15 @@ public void accept(SecurityIndexManager.State previousState, SecurityIndexManage
                     elasticPassword.getChars(),
                     DocWriteRequest.OpType.CREATE,
                     WriteRequest.RefreshPolicy.IMMEDIATE,
+                    this::outputOnError,
                     ActionListener.wrap(result -> {
                         nativeUsersStore
                             .updateReservedUser(
                                 KibanaSystemUser.NAME,
                                 kibanaSystemPassword.getChars(),
                                 DocWriteRequest.OpType.CREATE,
                                 WriteRequest.RefreshPolicy.IMMEDIATE,
+                                this::outputOnError,
                                 ActionListener.wrap(
                                     r -> {
                                         outputOnSuccess(elasticPassword, kibanaSystemPassword);