Adding a warning header when a license is about to expire #64948

BigPandaToo · 2020-11-11T16:05:08Z

This implementation will add the warning header
if the license is going to expire in less than
{LICENSE_EXPIRATION_WARNING_PERIOD} days.
The messages added:

Warning: 299 Elasticsearch-8.0.0-###"Your license will expire in [N] days. Contact your administrator or update your license for continued use of features"

or

Warning: 299 Elasticsearch-8.0.0-### "Your license expires today. Contact your administrator or update your license for continued use of features"

If license has expired less than
{GRACE_PERIOD_DURATION} days ago following
warning is added:

Warning: 299 Elasticsearch-8.0.0-### "Your license expired on ["EEEE, MMMM dd, yyyy" ]. Contact your administrator or update your license for continued use of features"

Both {LICENSE_EXPIRATION_WARNING_PERIOD}
and {GRACE_PERIOD_DURATION} are currently 7 days.

The message will be added to each request unless
authentication fails.
Note: with this change all warning headers will be removed
from a response if authentication fails.

Resolves #60562

Resolves elastic#60562

BigPandaToo · 2020-11-11T16:52:18Z

@elasticmachine update branch

BigPandaToo · 2020-11-11T16:59:13Z

@elasticmachine update branch

BigPandaToo · 2020-11-11T18:35:29Z

@elasticmachine run elasticsearch-ci/bwc

BigPandaToo · 2020-11-11T19:13:56Z

@elasticmachine run elasticsearch-ci/bwc

BigPandaToo · 2020-11-11T19:53:07Z

@elasticmachine update branch

BigPandaToo · 2020-11-11T19:55:34Z

@elasticmachine update branch

BigPandaToo · 2020-11-12T09:41:33Z

@elasticmachine update branch

…on to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves elastic#53161

jkakavas

I left a few comments. I also think we need to elaborate on the PR description ( it's not clear what through SECURITY_IP_FILTER means ) and add a couple of sentences on why we add the check on checkFeature and more especially why we think this is enough for solving the issue this PR is meant to.

We also need some tests that ensure we are indeed adding the warning header under the circumstances we expect it to be added

x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java

elasticmachine · 2020-11-17T18:44:36Z

Pinging @elastic/es-security (Team:Security)

…aml/metadata/{realm} Related to elastic#49018

BigPandaToo · 2020-11-17T22:36:57Z

@elasticmachine update branch

BigPandaToo · 2020-11-30T19:17:03Z

@elasticmachine update branch

x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java

.../plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/SecurityRestFilter.java

messages; changing "today" calculation; adding a test case for failing authN to make sure we remove the warning header

tvernum

LGTM, but I'd like to hear from @tbrooks8 before we merge.
(and if we can switch to assertThat, that would be good too)

...k/plugin/security/src/internalClusterTest/java/org/elasticsearch/license/LicensingTests.java

BigPandaToo · 2020-12-03T17:52:52Z

@elasticmachine update branch

Tim-Brooks

LGTM

jkakavas

Just some nits suggestions and a question regarding if removing all warning headers on authentication failure is intentional

.../plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/SecurityRestFilter.java

x-pack/plugin/core/src/test/java/org/elasticsearch/test/SecuritySettingsSourceField.java

...k/plugin/security/src/internalClusterTest/java/org/elasticsearch/license/LicensingTests.java

x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java

...k/plugin/security/src/internalClusterTest/java/org/elasticsearch/license/LicensingTests.java

BigPandaToo · 2020-12-04T10:04:09Z

Just some nits suggestions and a question regarding if removing all warning headers on authentication failure is intentional

@jkakavas Yes, it is intentional (see Tim's comment above). If Authentication fails it does make sense to not reveal any additional information

jkakavas

LGTM

BigPandaToo · 2020-12-04T11:40:59Z

@elasticmachine update branch

) * This change adds a warning header when a license is about to expire Resolves elastic#60562 * This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves elastic#53161 * Adding doc for the new API introduced by elastic#64517 - /_security/saml/metadata/{realm} Related to elastic#49018 * Adding a warning header when a license is about to expire Resolves elastic#60562 * Addressing the PR feedback * Switching back to adding the header during featureCheck to allow warnings when authentication is disabled as well. Adding filterHeader implementation to SecurityRestFilter exception handling to remove all the warnings if authentication fails. * Changing the wording for "expired" message to be consistent with the log messages; changing "today" calculation; adding a test case for failing authN to make sure we remove the warning header * Small changes in the way we verify header in tests * Nit changes Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

) * Adding a warning header when a license is about to expire (#64948) * This change adds a warning header when a license is about to expire Resolves #60562 * This change adds realm name of the realm used to perform authentication to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves #53161 * Adding doc for the new API introduced by #64517 - /_security/saml/metadata/{realm} Related to #49018 * Adding a warning header when a license is about to expire Resolves #60562 * Addressing the PR feedback * Switching back to adding the header during featureCheck to allow warnings when authentication is disabled as well. Adding filterHeader implementation to SecurityRestFilter exception handling to remove all the warnings if authentication fails. * Changing the wording for "expired" message to be consistent with the log messages; changing "today" calculation; adding a test case for failing authN to make sure we remove the warning header * Small changes in the way we verify header in tests * Nit changes Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> * Resolving backporting issue: adding copyMapWithRemovedEntry() util function Fixing unused imports Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

This change adds a warning header when a license is about to expire

f85a624

Resolves elastic#60562

BigPandaToo marked this pull request as draft November 11, 2020 16:05

Merge branch 'master' into Warning_header

af38237

BigPandaToo marked this pull request as ready for review November 11, 2020 16:54

Merge branch 'master' into Warning_header

70461a2

BigPandaToo marked this pull request as draft November 11, 2020 16:59

BigPandaToo marked this pull request as ready for review November 11, 2020 19:54

Merge branch 'master' into Warning_header

f6e3ceb

BigPandaToo marked this pull request as draft November 11, 2020 19:55

elasticmachine and others added 2 commits November 12, 2020 04:41

Merge branch 'master' into Warning_header

e52f231

This change adds realm name of the realm used to perform authenticati…

1002999

…on to the responses of _security/oidc/authenticate and _security/oidc/authenticate APIs Resolves elastic#53161

BigPandaToo marked this pull request as ready for review November 12, 2020 20:09

BigPandaToo requested review from jkakavas and tvernum November 12, 2020 20:09

jkakavas reviewed Nov 17, 2020

View reviewed changes

BigPandaToo added Team:Security Meta label for security team v7.11.0 v8.0.0 labels Nov 17, 2020

BigPandaToo added the :Security/License License functionality for commercial features label Nov 17, 2020

Adding doc for the new API introduced by elastic#64517 - /_security/s…

7b1b8da

…aml/metadata/{realm} Related to elastic#49018

Merge branch 'master' into Warning_header

ffcd72b

Merge branch 'master' into Warning_header

39e7ca7

tvernum reviewed Dec 1, 2020

View reviewed changes

Changing the wording for "expired" message to be consistent with the log

d27df6f

messages; changing "today" calculation; adding a test case for failing authN to make sure we remove the warning header

BigPandaToo requested a review from tvernum December 1, 2020 20:12

tvernum approved these changes Dec 3, 2020

View reviewed changes

...k/plugin/security/src/internalClusterTest/java/org/elasticsearch/license/LicensingTests.java Outdated Show resolved Hide resolved

BigPandaToo requested a review from Tim-Brooks December 3, 2020 09:32

elasticmachine and others added 2 commits December 3, 2020 12:52

Merge branch 'master' into Warning_header

a3f2eba

Small changes in the way we verify header in tests

b8773e3

Tim-Brooks approved these changes Dec 4, 2020

View reviewed changes

jkakavas reviewed Dec 4, 2020

View reviewed changes

Nit changes

8dc8b9c

jkakavas self-requested a review December 4, 2020 10:48

jkakavas approved these changes Dec 4, 2020

View reviewed changes

Merge branch 'master' into Warning_header

a939ae8

BigPandaToo merged commit 0b586c2 into elastic:master Dec 4, 2020

BigPandaToo mentioned this pull request Dec 4, 2020

Adding a warning header when a license is about to expire #64948 #65900

Merged

pugnascotia added the >enhancement label Dec 16, 2020

stevejgordon mentioned this pull request Dec 17, 2020

7.11.0 Meta Ticket elastic/elasticsearch-net#5198

Closed

BigPandaToo deleted the Warning_header branch April 19, 2021 13:51

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021

pgomulka mentioned this pull request Jul 27, 2021

Warning headers are removed on any failure #75739

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding a warning header when a license is about to expire #64948

Adding a warning header when a license is about to expire #64948

BigPandaToo commented Nov 11, 2020 •

edited

Loading

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 12, 2020

jkakavas left a comment

elasticmachine commented Nov 17, 2020

BigPandaToo commented Nov 17, 2020

BigPandaToo commented Nov 30, 2020

tvernum left a comment

BigPandaToo commented Dec 3, 2020

Tim-Brooks left a comment

jkakavas left a comment

BigPandaToo commented Dec 4, 2020

jkakavas left a comment

BigPandaToo commented Dec 4, 2020

Adding a warning header when a license is about to expire #64948

Adding a warning header when a license is about to expire #64948

Conversation

BigPandaToo commented Nov 11, 2020 • edited Loading

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 11, 2020

BigPandaToo commented Nov 12, 2020

jkakavas left a comment

Choose a reason for hiding this comment

elasticmachine commented Nov 17, 2020

BigPandaToo commented Nov 17, 2020

BigPandaToo commented Nov 30, 2020

tvernum left a comment

Choose a reason for hiding this comment

BigPandaToo commented Dec 3, 2020

Tim-Brooks left a comment

Choose a reason for hiding this comment

jkakavas left a comment

Choose a reason for hiding this comment

BigPandaToo commented Dec 4, 2020

jkakavas left a comment

Choose a reason for hiding this comment

BigPandaToo commented Dec 4, 2020

BigPandaToo commented Nov 11, 2020 •

edited

Loading