[7.x] Improve session idle timeout, add session lifespan (#49855) (#5…

…1740)

This adds an absolute session timeout (lifespan) to user sessions.
It also improves the existing session timeout toast and the overall
user experience in several ways.

docs/settings/security-settings.asciidoc

@@ -49,10 +49,16 @@ is set to `true` if `server.ssl.certificate` and `server.ssl.key` are set. Set
 this to `true` if SSL is configured outside of {kib} (for example, you are
 routing requests through a load balancer or proxy).
 
-`xpack.security.sessionTimeout`::
+`xpack.security.session.idleTimeout`::
 Sets the session duration (in milliseconds). By default, sessions stay active
-until the browser is closed. When this is set to an explicit timeout, closing the
-browser still requires the user to log back in to {kib}.
+until the browser is closed. When this is set to an explicit idle timeout, closing
+the browser still requires the user to log back in to {kib}.
+
+`xpack.security.session.lifespan`::
+Sets the maximum duration (in milliseconds), also known as "absolute timeout". By
+default, a session can be renewed indefinitely. When this value is set, a session
+will end once its lifespan is exceeded, even if the user is not idle. NOTE: if
+`idleTimeout` is not set, this setting will still cause sessions to expire.
 
 `xpack.security.loginAssistanceMessage`::
 Adds a message to the login screen. Useful for displaying information about maintenance windows, links to corporate sign up pages etc.

docs/user/security/authentication/index.asciidoc

@@ -188,9 +188,10 @@ The following sections apply both to <<saml>> and <<oidc>>
 
 Once the user logs in to {kib} Single Sign-On, either using SAML or OpenID Connect, {es} issues access and refresh tokens
 that {kib} encrypts and stores them in its own session cookie. This way, the user isn't redirected to the Identity Provider
-for every request that requires authentication. It also means that the {kib} session depends on the `xpack.security.sessionTimeout` 
-setting and the user is automatically logged out if the session expires. An access token that is stored in the session cookie 
-can expire, in  which case {kib} will automatically renew it with a one-time-use refresh token and store it in the same cookie.
+for every request that requires authentication. It also means that the {kib} session depends on the <<security-ui-settings,
+`xpack.security.session.idleTimeout` and `xpack.security.session.lifespan`>> settings, and the user is automatically logged
+out if the session expires. An access token that is stored in the session cookie can expire, in which case {kib} will
+automatically renew it with a one-time-use refresh token and store it in the same cookie.
 
 {kib} can only determine if an access token has expired if it receives a request that requires authentication. If both access
 and refresh tokens have already expired (for example, after 24 hours of inactivity), {kib} initiates a new "handshake" and

docs/user/security/securing-kibana.asciidoc

@@ -56,16 +56,31 @@ xpack.security.encryptionKey: "something_at_least_32_characters"
 For more information, see <<security-settings-kb,Security Settings in {kib}>>.
 --
 
-. Optional: Change the default session duration. By default, sessions stay
-active until the browser is closed. To change the duration, set the
-`xpack.security.sessionTimeout` property in the `kibana.yml` configuration file.
-The timeout is specified in milliseconds. For example, set the timeout to 600000
-to expire sessions after 10 minutes:
+. Optional: Set a timeout to expire idle sessions. By default, a session stays
+active until the browser is closed. To define a sliding session expiration, set
+the `xpack.security.session.idleTimeout` property in the `kibana.yml`
+configuration file. The idle timeout is specified in milliseconds. For example,
+set the idle timeout to 600000 to expire idle sessions after 10 minutes:
 +
 --
 [source,yaml]
 --------------------------------------------------------------------------------
-xpack.security.sessionTimeout: 600000
+xpack.security.session.idleTimeout: 600000
+--------------------------------------------------------------------------------
+--
+
+. Optional: Change the maximum session duration or "lifespan" -- also known as
+the "absolute timeout". By default, a session stays active until the browser is
+closed. If an idle timeout is defined, a session can still be extended
+indefinitely. To define a maximum session lifespan, set the
+`xpack.security.session.lifespan` property in the `kibana.yml` configuration
+file. The lifespan is specified in milliseconds. For example, set the lifespan
+to 28800000 to expire sessions after 8 hours:
++
+--
+[source,yaml]
+--------------------------------------------------------------------------------
+xpack.security.session.lifespan: 28800000
 --------------------------------------------------------------------------------
 --
 

src/dev/build/tasks/os_packages/docker_generator/resources/bin/kibana-docker

@@ -182,6 +182,9 @@ kibana_vars=(
     xpack.security.loginAssistanceMessage
     xpack.security.secureCookies
     xpack.security.sessionTimeout
+    xpack.security.session.idleTimeout
+    xpack.security.session.lifespan
+    xpack.security.loginAssistanceMessage
     xpack.security.public.protocol
     xpack.security.public.hostname
     xpack.security.public.port

src/legacy/core_plugins/status_page/index.js

@@ -26,6 +26,11 @@ export default function (kibana) {
         hidden: true,
         url: '/status',
       },
+      injectDefaultVars(server) {
+        return {
+          isStatusPageAnonymous: server.config().get('status.allowAnonymous'),
+        };
+      }
     }
   });
 }

src/plugins/status_page/kibana.json

@@ -0,0 +1,6 @@
+{
+  "id": "status_page",
+  "version": "kibana",
+  "server": false,
+  "ui": true
+}

src/plugins/status_page/public/index.ts

@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializer } from 'kibana/public';
+import { StatusPagePlugin, StatusPagePluginSetup, StatusPagePluginStart } from './plugin';
+
+export const plugin: PluginInitializer<StatusPagePluginSetup, StatusPagePluginStart> = () =>
+  new StatusPagePlugin();

src/plugins/status_page/public/plugin.ts

@@ -0,0 +1,39 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Plugin, CoreSetup } from 'kibana/public';
+
+export class StatusPagePlugin implements Plugin<StatusPagePluginSetup, StatusPagePluginStart> {
+  public setup(core: CoreSetup) {
+    const isStatusPageAnonymous = core.injectedMetadata.getInjectedVar(
+      'isStatusPageAnonymous'
+    ) as boolean;
+
+    if (isStatusPageAnonymous) {
+      core.http.anonymousPaths.register('/status');
+    }
+  }
+
+  public start() {}
+
+  public stop() {}
+}
+
+export type StatusPagePluginSetup = ReturnType<StatusPagePlugin['setup']>;
+export type StatusPagePluginStart = ReturnType<StatusPagePlugin['start']>;

x-pack/legacy/plugins/security/index.js

@@ -30,7 +30,10 @@ export const security = (kibana) => new kibana.Plugin({
       enabled: Joi.boolean().default(true),
       cookieName: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
       encryptionKey: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
-      sessionTimeout: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
+      session: Joi.object({
+        idleTimeout: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
+        lifespan: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
+      }).default(),
       secureCookies: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
       public: Joi.any().description('This key is handled in the new platform security plugin ONLY'),
       loginAssistanceMessage: Joi.string().default(),
@@ -46,9 +49,10 @@ export const security = (kibana) => new kibana.Plugin({
     }).default();
   },
 
-  deprecations: function ({ unused, rename }) {
+  deprecations: function ({ rename, unused }) {
     return [
       unused('authorization.legacyFallback.enabled'),
+      rename('sessionTimeout', 'session.idleTimeout'),
       rename('authProviders', 'authc.providers'),
       (settings, log) => {
         const hasSAMLProvider = get(settings, 'authc.providers', []).includes('saml');
@@ -103,7 +107,11 @@ export const security = (kibana) => new kibana.Plugin({
 
       return {
         secureCookies: securityPlugin.__legacyCompat.config.secureCookies,
-        sessionTimeout: securityPlugin.__legacyCompat.config.sessionTimeout,
+        session: {
+          tenant: server.newPlatform.setup.core.http.basePath.serverBasePath,
+          idleTimeout: securityPlugin.__legacyCompat.config.session.idleTimeout,
+          lifespan: securityPlugin.__legacyCompat.config.session.lifespan,
+        },
         enableSpaceAwarePrivileges: server.config().get('xpack.spaces.enabled'),
       };
     },

x-pack/legacy/plugins/security/public/hacks/on_session_timeout.js

@@ -7,28 +7,20 @@
 import _ from 'lodash';
 import { uiModules } from 'ui/modules';
 import { isSystemApiRequest } from 'ui/system_api';
-import { Path } from 'plugins/xpack_main/services/path';
 import { npSetup } from 'ui/new_platform';
 
-/**
- * Client session timeout is decreased by this number so that Kibana server
- * can still access session content during logout request to properly clean
- * user session up (invalidate access tokens, redirect to logout portal etc.).
- * @type {number}
- */
-
 const module = uiModules.get('security', []);
 module.config(($httpProvider) => {
   $httpProvider.interceptors.push((
     $q,
   ) => {
 
-    const isUnauthenticated = Path.isUnauthenticated();
+    const isAnonymous = npSetup.core.http.anonymousPaths.isAnonymous(window.location.pathname);
 
     function interceptorFactory(responseHandler) {
       return function interceptor(response) {
-        if (!isUnauthenticated && !isSystemApiRequest(response.config)) {
-          npSetup.plugins.security.sessionTimeout.extend();
+        if (!isAnonymous && !isSystemApiRequest(response.config)) {
+          npSetup.plugins.security.sessionTimeout.extend(response.config.url);
         }
         return responseHandler(response);
       };

x-pack/legacy/plugins/security/public/views/logged_out/logged_out.tsx

@@ -31,7 +31,7 @@ chrome
             }
           >
             <EuiButton href={chrome.addBasePath('/')}>
-              <FormattedMessage id="xpack.security.loggedOut.login" defaultMessage="Login" />
+              <FormattedMessage id="xpack.security.loggedOut.login" defaultMessage="Log in" />
             </EuiButton>
           </AuthenticationStatePage>
         </I18nContext>,

x-pack/package.json

@@ -209,6 +209,7 @@
     "bluebird": "3.5.5",
     "boom": "^7.2.0",
     "brace": "0.11.1",
+    "broadcast-channel": "^3.0.3",
     "chroma-js": "^1.4.1",
     "classnames": "2.2.6",
     "concat-stream": "1.6.2",

x-pack/plugins/security/public/plugin.ts

@@ -13,30 +13,34 @@ import {
 } from './session';
 
 export class SecurityPlugin implements Plugin<SecurityPluginSetup, SecurityPluginStart> {
+  private sessionTimeout!: SessionTimeout;
+
   public setup(core: CoreSetup) {
     const { http, notifications, injectedMetadata } = core;
     const { basePath, anonymousPaths } = http;
     anonymousPaths.register('/login');
     anonymousPaths.register('/logout');
     anonymousPaths.register('/logged_out');
 
-    const sessionExpired = new SessionExpired(basePath);
+    const tenant = `${injectedMetadata.getInjectedVar('session.tenant', '')}`;
+    const sessionExpired = new SessionExpired(basePath, tenant);
     http.intercept(new UnauthorizedResponseHttpInterceptor(sessionExpired, anonymousPaths));
-    const sessionTimeout = new SessionTimeout(
-      injectedMetadata.getInjectedVar('sessionTimeout', null) as number | null,
-      notifications,
-      sessionExpired,
-      http
-    );
-    http.intercept(new SessionTimeoutHttpInterceptor(sessionTimeout, anonymousPaths));
+    this.sessionTimeout = new SessionTimeout(notifications, sessionExpired, http, tenant);
+    http.intercept(new SessionTimeoutHttpInterceptor(this.sessionTimeout, anonymousPaths));
 
     return {
       anonymousPaths,
-      sessionTimeout,
+      sessionTimeout: this.sessionTimeout,
     };
   }
 
-  public start() {}
+  public start() {
+    this.sessionTimeout.start();
+  }
+
+  public stop() {
+    this.sessionTimeout.stop();
+  }
 }
 
 export type SecurityPluginSetup = ReturnType<SecurityPlugin['setup']>;