[jira] [Work logged] (KNOX-2961) KnoxSSO Token Invalidation

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-2961?focusedWorklogId=882891&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-882891 ]

ASF GitHub Bot logged work on KNOX-2961:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 02/Oct/23 12:07
            Start Date: 02/Oct/23 12:07
    Worklog Time Spent: 10m 
      Work Description: zeroflag commented on code in PR #797:
URL: https://github.com/apache/knox/pull/797#discussion_r1342597594


##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/SSOCookieFederationFilter.java:
##########
@@ -188,8 +194,25 @@ private void sendRedirectToLoginURL(HttpServletRequest request, HttpServletRespo
   }
 
   @Override
-  protected void handleValidationError(HttpServletRequest request, HttpServletResponse response,
-                                       int status, String error) throws IOException {
+  protected void handleValidationError(HttpServletRequest request, HttpServletResponse response, int status, String error) throws IOException {
+    if (error != null && error.startsWith("Token") && error.endsWith("disabled")) {
+      LOGGER.invalidSsoCookie();
+      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+      removeAuthenticationToken(request, response);
+      SessionInvalidators.KNOX_SSO_INVALIDATOR.getSessionInvalidators().forEach(sessionInvalidator -> {
+        sessionInvalidator.onAuthenticationError(request, response);
+      });
+      final boolean doGlobalLogout = request.getAttribute("doGlobalLogout") == null ? false

Review Comment:
   `doGlobalLogout` should be a constant, it is used in `Pac4jDispatcherFilter` too.



##########
gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java:
##########
@@ -224,6 +224,20 @@ protected void evictExpiredTokens() {
     } catch (SQLException e) {
       log.errorRemovingTokensFromDatabase(e.getMessage(), e);
     }
+
+    //removing disabled KnoxSSO cookies since they are no longer needed
+    try {
+      final Set<String> disabledKnoxSsoCookies = tokenDatabase.getDisabledKnoxSsoCookies();
+      if (!disabledKnoxSsoCookies.isEmpty()) {
+        log.removingDisabledKnoxSsoCookiesFromDatabase(disabledKnoxSsoCookies.size(),
+            String.join(", ", disabledKnoxSsoCookies.stream().map(tokenId -> Tokens.getTokenIDDisplayText(tokenId)).collect(Collectors.toSet())));
+        for (String tokenId : disabledKnoxSsoCookies) {

Review Comment:
   How many tokens do we expect to have normally? If it's a lot then maybe having a dedicated sql delete statement would be better.



##########
gateway-spi/src/main/java/org/apache/knox/gateway/session/SessionInvalidators.java:
##########
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.session;
+
+import java.util.HashSet;
+import java.util.Set;
+
+public enum SessionInvalidators {
+
+  KNOX_SSO_INVALIDATOR;
+
+  private final Set<SessionInvalidator> sessionInvalidators = new HashSet<>();
+
+  public void registerSessionInvalidator(SessionInvalidator sessionInvalidator) {

Review Comment:
   What happens after a topology undeployent? Do we need to unregister the previously registered invalidator?





Issue Time Tracking
-------------------

    Worklog Id:     (was: 882891)
    Time Spent: 20m  (was: 10m)

> KnoxSSO Token Invalidation
> --------------------------
>
>                 Key: KNOX-2961
>                 URL: https://issues.apache.org/jira/browse/KNOX-2961
>             Project: Apache Knox
>          Issue Type: New Feature
>          Components: KnoxSSO, Server, TokenManagementUI
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 2.1.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> There is a need for a new feature that would allow a pre-configured superuser to invalidate previously issued Knox SSO tokens for (a) particular user(s) in case there is a malicious attack in terms of one (or more) of those users' SSO tokens got compromised.
> In phase I, the following changes have to be implemented:
>  - Knox SSO cookie validation using PAM, LDAP, and Pac4j authentication/federation
>  - The token Management page should be updated in a way such that it'll contain only one compact table with all the information we need of a generated token (is impersonated, is Knox SSO cookie, available actions)
>  - Knox SSO cookies on the new token management UI can be disabled (invalidated), but not revoked.
>  - Disabled KnoxSSO cookies should be removed from the underlying token state service within the configure eviction period even if they were not expired
> In phase II, the token management page should be updated with the following improvements:
>  * pre-configured superusers can view tokens of others and not only theirs
>  * batch operations should be able to be executed using the available actions to make it easier for a superuser to disable one's tokens in a round



--
This message was sent by Atlassian Jira
(v8.20.10#820010)