[RORDEV-1562] testing #80
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| #!/bin/bash -e | ||
|
|
||
| docker compose --profile ENT --profile PRO --profile FREE rm --stop --force |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| server.name: kibana-ror | ||
| server.host: 0.0.0.0 | ||
|
|
||
| elasticsearch.username: kibana | ||
| elasticsearch.password: kibana | ||
| elasticsearch.ssl.verificationMode: none | ||
|
|
||
| # generated with: | ||
| # $ openssl req -x509 -batch -nodes -days 3650 -newkey rsa:2048 -keyout kibana.key -out kibana.crt | ||
| server.ssl.enabled: true | ||
| server.ssl.certificate: /usr/share/kibana/config/kibana.crt | ||
| server.ssl.key: /usr/share/kibana/config/kibana.key | ||
| server.ssl.redirectHttpFromPort: 80 | ||
|
|
||
| readonlyrest_kbn.logLevel: info | ||
| readonlyrest_kbn.cookiePass: '12312313123213123213123abcdefghijklm' | ||
| readonlyrest_kbn: | ||
| auth: | ||
| signature_key: "9yzBfnLaTYLfGPzyKW9es76RKYhUVgmuv6ZtehaScj5msGpBpa5FWpwk295uJYaaffTFnQC5tsknh2AguVDaTrqCLfM5zCTqdE4UGNL73h28Bg4dPrvTAFQyygQqv4xfgnevBED6VZYdfjXAQLc8J8ywaHQQSmprZqYCWGE6sM3vzNUEWWB3kmGrEKa4sGbXhmXZCvL6NDnEJhXPDJAzu9BMQxn8CzVLqrx6BxDgPYF8gZCxtyxMckXwCaYXrxAGbjkYH69F4wYhuAdHSWgRAQCuWwYmWCA6g39j4VPge5pv962XYvxwJpvn23Y5KvNZ5S5c6crdG4f4gTCXnU36x92fKMQzsQV9K4phcuNvMWkpqVB6xMA5aPzUeHcGytD93dG8D52P5BxsgaJJE6QqDrk3Y2vyLw9ZEbJhPRJxbuBKVCBtVx26Ldd46dq5eyyzmNEyQGLrjQ4qd978VtG8TNT5rkn4ETJQEju5HfCBbjm3urGLFVqxhGVawecT4YM9Rry4EqXWkRJGTFQWQRnweUFbKNbVTC9NxcXEp6K5rSPEy9trb5UYLYhhMJ9fWSBMuenGRjNSJxeurMRCaxPpNppBLFnp8qW5ezfHgCBpEjkSNNzP4uXMZFAXmdUfJ8XQdPTWuYfdHYc5TZWnzrdq9wcfFQRDpDB2zX5Myu96krDt9vA7wNKfYwkSczA6qUQV66jA8nV4Cs38cDAKVBXnxz22ddAVrPv8ajpu7hgBtULMURjvLt94Nc5FDKw79CTTQxffWEj9BJCDCpQnTufmT8xenywwVJvtj49yv2MP2mGECrVDRmcGUAYBKR8G6ZnFAYDVC9UhY46FGWDcyVX3HKwgtHeb45Ww7dsW8JdMnZYctaEU585GZmqTJp2LcAWRcQPH25JewnPX8pjzVpJNcy7avfA2bcU86bfASvQBDUCrhjgRmK2ECR6vzPwTsYKRgFrDqb62FeMdrKgJ9vKs435T5ACN7MNtdRXHQ4fj5pNpUMDW26Wd7tt9bkBTqEGf" | ||
|
|
||
|
Comment on lines
+15
to
+20
Contributor
There was a problem hiding this comment. Do not commit hard-coded signing secrets
🧰 Tools🪛 Gitleaks (8.28.0)[high] 19-19: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 🤖 Prompt for AI Agents |
||
| oidc_keycloak: | ||
| buttonName: "Keycloak OIDC" | ||
| type: "oidc" | ||
| protocol: "https" | ||
| issuer: 'http://kc.localhost:8080/realms/ror' | ||
| authorizationURL: 'http://kc.localhost:8080/realms/ror/protocol/openid-connect/auth' | ||
| tokenURL: 'http://kc.localhost:8080/realms/ror/protocol/openid-connect/token' | ||
| userInfoURL: 'http://kc.localhost:8080/realms/ror/protocol/openid-connect/userinfo' | ||
| jwksURL: 'http://kc.localhost:8080/realms/ror/protocol/openid-connect/certs' | ||
| clientID: 'kibana-ror' | ||
| clientSecret: 'kibanasecret123' | ||
| scope: 'openid profile email' | ||
| usernameParameter: 'preferred_username' | ||
| groupsParameter: 'groups' | ||
| kibanaExternalHost: 'localhost:15601' | ||
| logoutUrl: 'http://kc.localhost:8080/realms/ror/protocol/openid-connect/logout' | ||
| oidc_lemon_ldap: | ||
| buttonName: "LemonLDAP OpenID" | ||
| type: "oidc" | ||
| protocol: "https" | ||
| issuer: 'https://oidctest.wsweet.org/' | ||
| authorizationURL: 'https://oidctest.wsweet.org/oauth2/authorize' | ||
| tokenURL: 'https://oidctest.wsweet.org/oauth2/token' | ||
| userInfoURL: 'https://oidctest.wsweet.org/oauth2/userinfo' | ||
| clientID: 'private' | ||
| clientSecret: 'tardis' | ||
| scope: 'openid users roles' | ||
| usernameParameter: 'sub' | ||
| groupsParameter: 'roles' | ||
| kibanaExternalHost: 'localhost:15601' | ||
| logoutUrl: 'https://oidctest.wsweet.org/oauth2/logout' | ||
| jwksURL: 'https://oidctest.wsweet.org/oauth2/jwks' | ||
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,16 @@ | ||||||||||||||
| server.name: kibana-ror | ||||||||||||||
| server.host: 0.0.0.0 | ||||||||||||||
|
|
||||||||||||||
| elasticsearch.username: kibana | ||||||||||||||
| elasticsearch.password: kibana | ||||||||||||||
| elasticsearch.ssl.verificationMode: none | ||||||||||||||
|
Contributor
There was a problem hiding this comment. SSL verification is disabled. Setting For a demo/sandbox, this may be acceptable to simplify local setup. However, ensure this configuration is never used in production. Consider adding a comment to make the risk explicit: elasticsearch.username: kibana
elasticsearch.password: kibana
+# DEMO ONLY - disable SSL verification for local development
+# In production, use verificationMode: full and provide a valid CA certificate
elasticsearch.ssl.verificationMode: none📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||
|
|
||||||||||||||
| # generated with: | ||||||||||||||
| # $ openssl req -x509 -batch -nodes -days 3650 -newkey rsa:2048 -keyout kibana.key -out kibana.crt | ||||||||||||||
| server.ssl.enabled: true | ||||||||||||||
| server.ssl.certificate: /usr/share/kibana/config/kibana.crt | ||||||||||||||
| server.ssl.key: /usr/share/kibana/config/kibana.key | ||||||||||||||
| server.ssl.redirectHttpFromPort: 80 | ||||||||||||||
|
|
||||||||||||||
| readonlyrest_kbn.logLevel: info | ||||||||||||||
| readonlyrest_kbn.cookiePass: '12312313123213123213123abcdefghijklm' | ||||||||||||||
|
Comment on lines
+15
to
+16
Contributor
There was a problem hiding this comment. Hardcoded session cookie secret. The For production deployments:
For a demo configuration, consider adding a warning comment: readonlyrest_kbn.logLevel: info
+# DEMO ONLY - use a randomly generated secret in production
readonlyrest_kbn.cookiePass: '12312313123213123213123abcdefghijklm' |
||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| { | ||
| "realm": "ror", | ||
| "enabled": true, | ||
| "clients": [ | ||
| { | ||
| "clientId": "kibana-ror", | ||
| "enabled": true, | ||
| "protocol": "openid-connect", | ||
| "publicClient": false, | ||
| "secret": "kibanasecret123", | ||
|
Contributor
There was a problem hiding this comment. Hardcoded client secret is flagged by static analysis. Gitleaks correctly identifies For production:
For this demo configuration, consider adding a comment in the JSON (if the realm import supports it) or in adjacent documentation warning that this is a demo-only secret. 🧰 Tools🪛 Gitleaks (8.28.0)[high] 10-10: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 🤖 Prompt for AI Agents |
||
| "redirectUris": ["*"], | ||
| "webOrigins": ["*"], | ||
|
Comment on lines
+11
to
+12
Contributor
There was a problem hiding this comment. Wildcard redirect URIs and web origins are insecure. Setting
For production, replace wildcards with explicit allowed values: "redirectUris": ["https://localhost:15601/*", "https://yourdomain.com/*"],
"webOrigins": ["https://localhost:15601", "https://yourdomain.com"]For a demo/sandbox environment, if this is intentional for local testing flexibility, consider adding documentation that explains this configuration should never reach production. 🤖 Prompt for AI Agents |
||
| "attributes": { | ||
| "post.logout.redirect.uris": "https://localhost:15601/*" | ||
| }, | ||
| "protocolMappers": [ | ||
| { | ||
| "name": "groups", | ||
| "protocol": "openid-connect", | ||
| "protocolMapper": "oidc-group-membership-mapper", | ||
| "consentRequired": false, | ||
| "config": { | ||
| "full.path": "false", | ||
| "access.token.claim": "true", | ||
| "id.token.claim": "true", | ||
| "userinfo.token.claim": "true", | ||
| "claim.name": "groups", | ||
| "jsonType.label": "String" | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "groups": [ | ||
| {"name": "extEndUsers"} | ||
| ], | ||
| "users": [ | ||
| { | ||
| "username": "extUser1", | ||
| "enabled": true, | ||
| "emailVerified": true, | ||
| "credentials": [ { "type": "password", "value": "extUser1", "temporary": false } ], | ||
|
Contributor
There was a problem hiding this comment. Plaintext passwords in realm configuration. The credentials are stored in plaintext in the realm export (e.g.,
Best practices:
For a demo/sandbox, this is acceptable, but ensure the PR description or README clearly states these are testing credentials only. Also applies to: 50-50 🤖 Prompt for AI Agents |
||
| "groups": ["extEndUsers"], | ||
| "realmRoles": ["offline_access", "uma_authorization"] | ||
| }, | ||
| { | ||
| "username": "extUser2", | ||
| "enabled": true, | ||
| "emailVerified": true, | ||
| "credentials": [ { "type": "password", "value": "extUser2", "temporary": false } ], | ||
| "groups": ["extEndUsers"], | ||
| "realmRoles": ["offline_access", "uma_authorization"] | ||
| } | ||
| ], | ||
| "defaultDefaultClientScopes": ["web-origins", "role_list", "profile", "roles", "email"], | ||
| "defaultOptionalClientScopes": ["address", "phone", "offline_access"] | ||
| } | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
Wildcard user mapping is extremely permissive.
The username
"*"matches any user authenticated via KBN, granting all of them EndUsers group access. In a production environment, this eliminates access control granularity and could allow unintended users to access sensitive data.For a demo/sandbox, this may be acceptable for ease of testing, but document this permissive behavior clearly and ensure it's never used in production deployments.
Consider whether this wildcard mapping aligns with the intended security model for this PR. If the goal is to test Keycloak/OIDC flows with minimal friction, this is understandable. Otherwise, consider replacing the wildcard with explicit user entries or group-based matching.
🏁 Script executed:
Length of output: 419
🏁 Script executed:
Length of output: 6573
Restrict wildcard user mapping in ror-demo-cluster/conf/es/readonlyrest.yml (lines 60–65). The username
"*"matches all KBN-authenticated users, granting them EndUsers access; replace with explicit usernames or group patterns and ensure this demo-only setting is documented or removed in production deployments.🤖 Prompt for AI Agents