Merge remote-tracking branch 'upstream/main' into unknown-ds-fix

DarshitChanpura · May 10, 2024 · a45e592 · a45e592
2 parents 60d9910 + 9662025
commit a45e592
Show file tree

Hide file tree

Showing 19 changed files with 138 additions and 44 deletions.
diff --git a/.github/actions/run-cypress-tests/action.yml b/.github/actions/run-cypress-tests/action.yml
@@ -11,6 +11,10 @@ inputs:
   yarn_command:
     description: 'The yarn command to start running cypress tests'
     required: true
+  osd_base_path:
+    description: 'The base path for OpenSearch Dashboards'
+    required: false
+    default: ''
 
 runs:
   using: "composite"
@@ -56,14 +60,22 @@ runs:
       if: ${{ runner.os == 'Linux' }}
       run: |
         cd ./OpenSearch-Dashboards/plugins/security-dashboards-plugin
-        yarn runIdp
+        if [ -z "${{ inputs.osd_base_path }}" ]; then
+          yarn runIdp &
+        else
+          yarn runIdp --basePath ${{ inputs.osd_base_path }} &
+        fi
       shell: bash
 
     - name: Run OpenSearch Dashboards with provided configuration
       if: ${{ runner.os == 'Linux' }}
       run: |
         cd ./OpenSearch-Dashboards
-        nohup yarn start --no-base-path --no-watch --csp.warnLegacyBrowsers=false | tee dashboard.log &
+        if [ -z "${{ inputs.osd_base_path }}" ]; then
+          nohup yarn start --no-base-path --no-watch --csp.warnLegacyBrowsers=false | tee dashboard.log &
+        else
+          nohup yarn start --no-watch --csp.warnLegacyBrowsers=false | tee dashboard.log &
+        fi
       shell: bash
 
     # Check if OSD is ready with a max timeout of 600 seconds

diff --git a/.github/workflows/cypress-test-multiauth-e2e.yml b/.github/workflows/cypress-test-multiauth-e2e.yml
@@ -17,6 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-latest ]
+        basePath: [ "", "/osd" ]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -61,7 +62,7 @@ jobs:
                         metadata_url: http://localhost:7000/metadata
                       sp:
                         entity_id: https://localhost:9200
-                      kibana_url: http://localhost:5601
+                      kibana_url: http://localhost:5601${{ matrix.basePath }}
                       exchange_key: 6aff3042-1327-4f3d-82f0-40a157ac4464
                   authentication_backend:
                     type: noop
@@ -82,14 +83,30 @@ jobs:
           opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
           opensearch_security.readonly_mode.roles: ["kibana_read_only"]
           opensearch_security.cookie.secure: false
-          server.xsrf.allowlist: ["/_plugins/_security/api/authtoken", "/_opendistro/_security/api/authtoken", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/logout"]
+          server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/logout"]
           opensearch_security.auth.type: ["basicauth","saml"]
           opensearch_security.auth.multiple_auth_enabled: true
           opensearch_security.auth.anonymous_auth_enabled: false
           home.disableWelcomeScreen: true
           EOT
 
+      - name: Run OSD with basePath
+        if: ${{ matrix.basePath != '' }}
+        run: |
+          echo "server.basePath: \"${{ matrix.basePath }}\"" >> opensearch_dashboards_multiauth.yml
+          echo "server.rewriteBasePath: true" >> opensearch_dashboards_multiauth.yml
+
+      - name: Run Cypress Tests with basePath
+        if: ${{ matrix.basePath != '' }}
+        uses: ./.github/actions/run-cypress-tests
+        with:
+          security_config_file: config_multiauth.yml
+          dashboards_config_file: opensearch_dashboards_multiauth.yml
+          yarn_command: 'yarn cypress:run --browser chrome --headless --env loginMethod=saml_multiauth,basePath=${{ matrix.basePath }} --spec "test/cypress/e2e/saml/*.js"'
+          osd_base_path: ${{ matrix.basePath }}
+
       - name: Run Cypress Tests
+        if: ${{ matrix.basePath == '' }}
         uses: ./.github/actions/run-cypress-tests
         with:
           security_config_file: config_multiauth.yml

diff --git a/.github/workflows/cypress-test-oidc-e2e.yml b/.github/workflows/cypress-test-oidc-e2e.yml
@@ -21,6 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-latest ]
+        basePath: [ "", "/osd" ]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -62,7 +63,7 @@ jobs:
           chmod +x kcadm.sh
           echo "Creating client"
           ./kcadm.sh config credentials --server http://localhost:8080/auth --realm master --user admin --password admin
-          CID=$(./kcadm.sh create clients -r master -s clientId=opensearch -s secret="${{ env.TEST_KEYCLOAK_CLIENT_SECRET }}" -s 'attributes."access.token.lifespan"=60' -s 'redirectUris=["http://localhost:5603/auth/openid/login", "http://localhost:5601", "http://localhost:5601/auth/openid/login"]' -i)
+          CID=$(./kcadm.sh create clients -r master -s clientId=opensearch -s secret="${{ env.TEST_KEYCLOAK_CLIENT_SECRET }}" -s 'attributes."access.token.lifespan"=60' -s 'redirectUris=["http://localhost:5603${{ matrix.basePath }}/auth/openid/login", "http://localhost:5601${{ matrix.basePath }}", "http://localhost:5601${{ matrix.basePath }}/auth/openid/login"]' -i)
           ./kcadm.sh get clients/$CID/installation/providers/keycloak-oidc-keycloak-json > tmp
           echo "Getting client secret for dashboards configuration purpose"
           CLIENT_SECRET=$(grep -o '"secret" : "[^"]*' tmp | grep -o '[^"]*$')
@@ -129,13 +130,28 @@ jobs:
           opensearch_security.openid.connect_url: "http://127.0.0.1:8080/auth/realms/master/.well-known/openid-configuration"
           opensearch_security.openid.client_id: "opensearch"
           opensearch_security.openid.client_secret: "${{ env.TEST_KEYCLOAK_CLIENT_SECRET }}"
-          opensearch_security.auth.type: ["openid"]
-          opensearch_security.auth.multiple_auth_enabled: true
-          opensearch_security.ui.openid.login.buttonname: "OIDC"
+          opensearch_security.openid.base_redirect_url: http://localhost:5601${{ matrix.basePath }}
+          opensearch_security.auth.type: "openid"
           home.disableWelcomeScreen: true
           EOT
 
+      - name: Run OSD with basePath
+        if: ${{ matrix.basePath != '' }}
+        run: |
+          echo "server.basePath: \"${{ matrix.basePath }}\"" >> opensearch_dashboards_openid.yml
+          echo "server.rewriteBasePath: true" >> opensearch_dashboards_openid.yml
+
+      - name: Run Cypress Tests with basePath
+        if: ${{ matrix.basePath != '' }}
+        uses: ./.github/actions/run-cypress-tests
+        with:
+          security_config_file: config_openid.yml
+          dashboards_config_file: opensearch_dashboards_openid.yml
+          yarn_command: 'yarn cypress:run --browser chrome --headless --spec "test/cypress/e2e/oidc/*.js" --env basePath=${{ matrix.basePath }}'
+          osd_base_path: ${{ matrix.basePath }}
+
       - name: Run Cypress Tests
+        if: ${{ matrix.basePath == '' }}
         uses: ./.github/actions/run-cypress-tests
         with:
           security_config_file: config_openid.yml

diff --git a/.github/workflows/cypress-test-saml-e2e.yml b/.github/workflows/cypress-test-saml-e2e.yml
@@ -17,6 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-latest ]
+        basePath: [ "", "/osd" ]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -61,7 +62,7 @@ jobs:
                         metadata_url: http://localhost:7000/metadata
                       sp:
                         entity_id: https://localhost:9200
-                      kibana_url: http://localhost:5601
+                      kibana_url: http://localhost:5601${{ matrix.basePath }}
                       exchange_key: 6aff3042-1327-4f3d-82f0-40a157ac4464
                   authentication_backend:
                     type: noop
@@ -82,14 +83,30 @@ jobs:
           opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
           opensearch_security.readonly_mode.roles: ["kibana_read_only"]
           opensearch_security.cookie.secure: false
-          server.xsrf.allowlist: ["/_plugins/_security/api/authtoken", "/_opendistro/_security/api/authtoken", "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/logout"]
+          server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/acs/idpinitiated", "/_opendistro/_security/saml/logout"]
           opensearch_security.auth.type: ["saml"]
           opensearch_security.auth.multiple_auth_enabled: true
           opensearch_security.auth.anonymous_auth_enabled: false
           home.disableWelcomeScreen: true
           EOT
 
+      - name: Run OSD with basePath
+        if: ${{ matrix.basePath != '' }}
+        run: |
+          echo "server.basePath: \"${{ matrix.basePath }}\"" >> opensearch_dashboards_saml.yml
+          echo "server.rewriteBasePath: true" >> opensearch_dashboards_saml.yml
+
+      - name: Run Cypress Tests with basePath
+        if: ${{ matrix.basePath != '' }}
+        uses: ./.github/actions/run-cypress-tests
+        with:
+          security_config_file: config_saml.yml
+          dashboards_config_file: opensearch_dashboards_saml.yml
+          yarn_command: 'yarn cypress:run --browser chrome --headless --spec "test/cypress/e2e/saml/*.js" --env basePath=${{ matrix.basePath }}'
+          osd_base_path: ${{ matrix.basePath }}
+
       - name: Run Cypress Tests
+        if: ${{ matrix.basePath == '' }}
         uses: ./.github/actions/run-cypress-tests
         with:
           security_config_file: config_saml.yml

diff --git a/package.json b/package.json
@@ -19,7 +19,7 @@
     "lint:es": "node ../../scripts/eslint",
     "lint:style": "node ../../scripts/stylelint",
     "lint": "yarn run lint:es && yarn run lint:style",
-    "runIdp": "node ./test/jest_integration/runIdpServer.js &",
+    "runIdp": "node ./test/jest_integration/runIdpServer.js",
     "test:jest_server": "ADMIN_PASSWORD=$ADMIN_PASSWORD node ./test/run_jest_tests.js --config ./test/jest.config.server.js",
     "test:jest_ui": "node ./test/run_jest_tests.js --config ./test/jest.config.ui.js",
     "prepare": "husky install"
@@ -30,14 +30,15 @@
     "@types/hapi__wreck": "^15.0.1",
     "cypress": "^13.6.0",
     "cypress-mochawesome-reporter": "^3.3.0",
+    "eslint-plugin-cypress": "^2.8.1",
+    "eslint-plugin-unused-imports": "3.1.0",
     "gulp-rename": "2.0.0",
+    "husky": "^8.0.0",
     "jose": "^5.2.4",
+    "minimist": "^1.2.8",
     "saml-idp": "^1.2.1",
     "selfsigned": "^2.0.1",
-    "typescript": "4.0.2",
-    "eslint-plugin-cypress": "^2.8.1",
-    "eslint-plugin-unused-imports": "3.1.0",
-    "husky": "^8.0.0"
+    "typescript": "4.0.2"
   },
   "dependencies": {
     "@hapi/cryptiles": "5.0.0",

diff --git a/public/apps/configuration/panels/auth-view/auth-view.tsx b/public/apps/configuration/panels/auth-view/auth-view.tsx
@@ -53,7 +53,17 @@ export function AuthView(props: AppDependencies) {
   }, [props.coreStart.http, dataSource]);
 
   if (isEmpty(authentication)) {
-    return <InstructionView config={props.config} />;
+    return (
+      <>
+        <SecurityPluginTopNavMenu
+          {...props}
+          dataSourcePickerReadOnly={false}
+          setDataSource={setDataSource}
+          selectedDataSource={dataSource}
+        />
+        <InstructionView config={props.config} />
+      </>
+    );
   }
 
   if (dataSourceEnabled && dataSource === undefined) {

diff --git a/public/apps/configuration/panels/permission-list/permission-list.tsx b/public/apps/configuration/panels/permission-list/permission-list.tsx
@@ -210,6 +210,7 @@ export function PermissionList(props: AppDependencies) {
       const actionGroups = await fetchActionGroups(props.coreStart.http, dataSource.id);
       setActionGroupDict(actionGroups);
       setPermissionList(await mergeAllPermissions(actionGroups));
+      setErrorFlag(false);
     } catch (e) {
       console.log(e);
       setErrorFlag(true);

diff --git a/public/apps/configuration/panels/role-list.tsx b/public/apps/configuration/panels/role-list.tsx
@@ -119,6 +119,7 @@ export function RoleList(props: AppDependencies) {
         const rawRoleMappingData = await fetchRoleMapping(props.coreStart.http, dataSource.id);
         const processedData = transformRoleData(rawRoleData, rawRoleMappingData);
         setRoleData(processedData);
+        setErrorFlag(false);
       } catch (e) {
         console.log(e);
         setErrorFlag(true);

diff --git a/public/apps/configuration/panels/user-list.tsx b/public/apps/configuration/panels/user-list.tsx
@@ -120,6 +120,7 @@ export function UserList(props: AppDependencies) {
         );
         setCurrentUsername((await getAuthInfo(props.coreStart.http)).user_name);
         setUserData(await userDataPromise);
+        setErrorFlag(false);
       } catch (e) {
         console.log(e);
         setErrorFlag(true);

diff --git a/public/apps/login/login-page.tsx b/public/apps/login/login-page.tsx
@@ -84,7 +84,7 @@ export function extractNextUrlFromWindowLocation(): string {
   const urlParams = new URLSearchParams(window.location.search);
   let nextUrl = urlParams.get('nextUrl');
   if (!nextUrl || nextUrl.toLowerCase().includes('//')) {
-    nextUrl = encodeURIComponent('/');
+    return '';
   } else {
     nextUrl = encodeURIComponent(nextUrl);
     const hash = window.location.hash || '';

diff --git a/public/apps/login/test/__snapshots__/login-page.test.tsx.snap b/public/apps/login/test/__snapshots__/login-page.test.tsx.snap
@@ -121,7 +121,7 @@ exports[`Login page renders renders with config value for multiauth 1`] = `
         aria-label="openid_login_button"
         className="test-btn-style"
         data-test-subj="submit"
-        href="/app/opensearch-dashboards/auth/openid/captureUrlFragment?nextUrl=%2F"
+        href="/app/opensearch-dashboards/auth/openid/captureUrlFragment"
         iconType="http://localhost:5601/images/test.png"
         size="s"
         type="prime"
@@ -141,7 +141,7 @@ exports[`Login page renders renders with config value for multiauth 1`] = `
         aria-label="saml_login_button"
         className="test-btn-style"
         data-test-subj="submit"
-        href="/app/opensearch-dashboards/auth/saml/captureUrlFragment?nextUrl=%2F"
+        href="/app/opensearch-dashboards/auth/saml/captureUrlFragment"
         iconType="http://localhost:5601/images/test.png"
         size="s"
         type="prime"
@@ -292,7 +292,7 @@ exports[`Login page renders renders with config value for multiauth with anonymo
         aria-label="openid_login_button"
         className="test-btn-style"
         data-test-subj="submit"
-        href="/app/opensearch-dashboards/auth/openid/captureUrlFragment?nextUrl=%2F"
+        href="/app/opensearch-dashboards/auth/openid/captureUrlFragment"
         iconType="http://localhost:5601/images/test.png"
         size="s"
         type="prime"
@@ -312,7 +312,7 @@ exports[`Login page renders renders with config value for multiauth with anonymo
         aria-label="saml_login_button"
         className="test-btn-style"
         data-test-subj="submit"
-        href="/app/opensearch-dashboards/auth/saml/captureUrlFragment?nextUrl=%2F"
+        href="/app/opensearch-dashboards/auth/saml/captureUrlFragment"
         iconType="http://localhost:5601/images/test.png"
         size="s"
         type="prime"

diff --git a/public/apps/login/test/login-page.test.tsx b/public/apps/login/test/login-page.test.tsx
@@ -91,7 +91,7 @@ describe('test extractNextUrlFromWindowLocation', () => {
     const originalLocation = window.location;
     delete window.location;
     window.location = new URL('http://localhost:5601/app/home');
-    expect(extractNextUrlFromWindowLocation()).toEqual('?nextUrl=%2F');
+    expect(extractNextUrlFromWindowLocation()).toEqual('');
   });
 });
 

diff --git a/server/auth/types/openid/routes.ts b/server/auth/types/openid/routes.ts
@@ -336,8 +336,10 @@ export class OpenIdAuthRoutes {
                 }
                 let params = new URLSearchParams(window.location.search);
                 let nextUrl = params.get("nextUrl");
-                finalUrl = "login?nextUrl=" + encodeURIComponent(nextUrl);
-                finalUrl += "&redirectHash=" + encodeURIComponent(redirectHash);
+                finalUrl = "login?redirectHash=" + encodeURIComponent(redirectHash);
+                if (!!nextUrl) {
+                  finalUrl += "&nextUrl=" + encodeURIComponent(nextUrl);
+                }
                 window.location.replace(finalUrl);
               `,
         });

diff --git a/server/auth/types/saml/routes.ts b/server/auth/types/saml/routes.ts
@@ -314,8 +314,10 @@ export class SamlAuthRoutes {
                   }
                  let params = new URLSearchParams(window.location.search);
                  let nextUrl = params.get("nextUrl");
-                 finalUrl = "login?nextUrl=" + encodeURIComponent(nextUrl);
-                 finalUrl += "&redirectHash=" + encodeURIComponent(redirectHash);
+                 finalUrl = "login?redirectHash=" + encodeURIComponent(redirectHash);
+                 if (!!nextUrl) {
+                   finalUrl += "&nextUrl=" + encodeURIComponent(nextUrl);
+                 }
                  window.location.replace(finalUrl);
                 `,
         });

diff --git a/server/session/security_cookie.ts b/server/session/security_cookie.ts
@@ -59,7 +59,7 @@ export function getSecurityCookieOptions(
       // TODO: with setting redirect attributes to support OIDC and SAML,
       //       we need to do additional cookie validation in AuthenticationHandlers.
       // if SAML fields present
-      if (sessionStorage.saml && sessionStorage.saml.requestId && sessionStorage.saml.nextUrl) {
+      if (sessionStorage.saml && sessionStorage.saml.requestId) {
         return { isValid: true, path: '/' };
       }