http proxy support in JWT realm #127337

richard-dennehy · 2025-04-24T15:08:29Z

Resolves #114956

Adds http.proxy.* settings to JWT realm configuration, to enable JWKS lookup to use a HTTP proxy.

It's worth stressing that this proxy must use HTTP rather than HTTPS, due to #100264

elasticsearchmachine · 2025-04-24T15:09:16Z

Hi @richard-dennehy, I've created a changelog YAML for you.

...gin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/jwt/JwtRealmSettings.java

...ests/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/jwt/JwtWithOidcAuthIT.java

x-pack/test/idp-fixture/build.gradle

richard-dennehy · 2025-04-24T15:23:34Z

...st/idp-fixture/src/main/java/org/elasticsearch/test/fixtures/idp/HttpProxyTestContainer.java

    private static final Integer PORT = 8888;
+    private static final Integer TLS_PORT = 8889;


Names are hard 😞

This isn't an SSL port, but it proxies to the C2ID SSL port 🤔

I'm blanking on a better name as well. Will have to think about it.

...idp-fixture/src/main/java/org/elasticsearch/test/fixtures/idp/OidcProviderTestContainer.java

richard-dennehy · 2025-04-24T15:25:43Z

x-pack/test/idp-fixture/src/main/resources/oidc/Dockerfile

+FROM c2id/c2id-server-demo:16.1.1 AS c2id
+FROM openjdk:21-jdk-buster


JDK 11 doesn't run properly on my kernel; C2ID 12 doesn't run properly on JDK 21

elasticsearchmachine · 2025-04-24T15:34:44Z

Pinging @elastic/es-security (Team:Security)

...gin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/jwt/JwtRealmSettings.java

slobodanadamovic · 2025-04-28T19:27:02Z

...gin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/jwt/JwtRealmSettings.java

+        key -> Setting.simpleString(key, "http", value -> {
+            if (value.equals("http") == false && value.equals("https") == false) {
+                throw new IllegalArgumentException("Invalid value [" + value + "] for [" + key + "]. Only `http` or `https` are allowed.");
+            }
+        }, Setting.Property.NodeScope)
+    );


optional: This can be simplified by calling SecuritySettingsUtil#verifyNonNullNotEmpty, for example:

Suggested change

key -> Setting.simpleString(key, "http", value -> {

if (value.equals("http") == false && value.equals("https") == false) {

throw new IllegalArgumentException("Invalid value [" + value + "] for [" + key + "]. Only `http` or `https` are allowed.");

}

}, Setting.Property.NodeScope)

);

key -> Setting.simpleString(

key,

"http",

value -> verifyNonNullNotEmpty(key, value, List.of("http", "https")),

Setting.Property.NodeScope

)

);

slobodanadamovic · 2025-04-28T20:06:47Z

...gin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/jwt/JwtRealmSettings.java

+                HTTP_MAX_ENDPOINT_CONNECTIONS,
+                HTTP_PROXY_SCHEME,
+                HTTP_PROXY_HOST,
+                HTTP_PROXY_PORT


We also have to document these new settings. I'm fine if you prefer to do documentation update in a followup PR.

Do we want to backport this? 9.0 docs are in a different repo, so I need to raise a different PR regardless

Yes, we should backport this to 8.18 at least. Makes total sense to handle the docs in a followup. The docs for 9.x are in different repo, but docs for 8.x are still in elastricsearch repo.

x-pack/test/idp-fixture/build.gradle

...idp-fixture/src/main/java/org/elasticsearch/test/fixtures/idp/OidcProviderTestContainer.java

x-pack/test/idp-fixture/src/main/resources/nginx/Dockerfile

slobodanadamovic · 2025-04-28T21:27:00Z

...st/idp-fixture/src/main/java/org/elasticsearch/test/fixtures/idp/HttpProxyTestContainer.java

    private static final Integer PORT = 8888;
+    private static final Integer TLS_PORT = 8889;


I'm blanking on a better name as well. Will have to think about it.

slobodanadamovic · 2025-04-30T13:57:39Z

.idea/inspectionProfiles/Project_Default.xml

@@ -6,10 +6,18 @@
      <scope name="Production" level="ERROR" enabled="false" />
      <scope name="Production minus fixtures" level="ERROR" enabled="true" />
    </inspection_tool>
+    <inspection_tool class="MalformedFormatString" enabled="true" level="WARNING" enabled_by_default="true">


Was this change intentional?

I was messing with Intellij settings; I'm used to these project files being in the .gitignore - I'll remove it

slobodanadamovic

LGTM 👍

Thanks for the persistence on this one. Nice job!

elasticsearchmachine · 2025-05-01T07:58:42Z

💚 Backport successful

Status	Branch	Result
✅	8.18
✅	9.0

http proxy support in JWT realm

richard-dennehy added >enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team labels Apr 24, 2025

elasticsearchmachine added the v9.1.0 label Apr 24, 2025

richard-dennehy commented Apr 24, 2025

View reviewed changes

richard-dennehy force-pushed the jwt-proxy-support branch from 7347efa to 9c2bafc Compare April 24, 2025 15:30

richard-dennehy requested a review from slobodanadamovic April 24, 2025 15:34

richard-dennehy marked this pull request as ready for review April 24, 2025 15:34

slobodanadamovic reviewed Apr 28, 2025

View reviewed changes

richard-dennehy requested a review from a team as a code owner April 29, 2025 10:02

richard-dennehy force-pushed the jwt-proxy-support branch from 020564a to d06d2cd Compare April 29, 2025 10:22

richard-dennehy added auto-backport Automatically create backport pull requests when merged v8.18.2 labels Apr 30, 2025

slobodanadamovic added the v9.0.2 label Apr 30, 2025

slobodanadamovic reviewed Apr 30, 2025

View reviewed changes

richard-dennehy and others added 7 commits April 30, 2025 15:13

http proxy support in JWT realm

72e7d77

Update docs/changelog/127337.yaml

5fdc175

[CI] Auto commit changes from spotless

1eedb87

address review comments

963b0bb

[CI] Auto commit changes from spotless

2e05ffd

fix tests

078bdf5

revert project settings change

a8b028d

richard-dennehy force-pushed the jwt-proxy-support branch from 9c3b8b9 to a8b028d Compare April 30, 2025 14:14

slobodanadamovic approved these changes Apr 30, 2025

View reviewed changes

richard-dennehy merged commit e75e45b into elastic:main May 1, 2025
22 checks passed

richard-dennehy deleted the jwt-proxy-support branch May 1, 2025 07:57

This was referenced May 1, 2025

[8.18] http proxy support in JWT realm (#127337) #127598

Merged

[9.0] http proxy support in JWT realm (#127337) #127599

Merged

richard-dennehy added a commit to richard-dennehy/elasticsearch that referenced this pull request May 1, 2025

http proxy support in JWT realm (elastic#127337)

3366dad

http proxy support in JWT realm

richard-dennehy added a commit to richard-dennehy/elasticsearch that referenced this pull request May 1, 2025

http proxy support in JWT realm (elastic#127337)

e7a0377

http proxy support in JWT realm

elasticsearchmachine pushed a commit that referenced this pull request May 1, 2025

http proxy support in JWT realm (#127337) (#127599)

1965d6c

http proxy support in JWT realm

elasticsearchmachine pushed a commit that referenced this pull request May 1, 2025

http proxy support in JWT realm (#127337) (#127598)

24fdac6

http proxy support in JWT realm

This was referenced May 1, 2025

add documentation for JWT realm proxy settings #127604

Merged

add documentation for JWT realm proxy settings #127605

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http proxy support in JWT realm #127337

http proxy support in JWT realm #127337

richard-dennehy commented Apr 24, 2025

elasticsearchmachine commented Apr 24, 2025

richard-dennehy Apr 24, 2025

slobodanadamovic Apr 28, 2025

richard-dennehy Apr 24, 2025

elasticsearchmachine commented Apr 24, 2025

slobodanadamovic Apr 28, 2025

slobodanadamovic Apr 28, 2025

richard-dennehy Apr 29, 2025

slobodanadamovic Apr 30, 2025

slobodanadamovic Apr 28, 2025

slobodanadamovic Apr 30, 2025

richard-dennehy Apr 30, 2025

slobodanadamovic left a comment

elasticsearchmachine commented May 1, 2025

		private static final Integer PORT = 8888;
		private static final Integer TLS_PORT = 8889;

		FROM c2id/c2id-server-demo:16.1.1 AS c2id
		FROM openjdk:21-jdk-buster

http proxy support in JWT realm #127337

http proxy support in JWT realm #127337

Conversation

richard-dennehy commented Apr 24, 2025

elasticsearchmachine commented Apr 24, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticsearchmachine commented Apr 24, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

slobodanadamovic left a comment

Choose a reason for hiding this comment

elasticsearchmachine commented May 1, 2025

💚 Backport successful