Add "extension" attribute validation to IdP SPs #128805

tvernum · 2025-06-03T08:06:06Z

This extends the change from #128176 to validate the "custom attributes" on a per Service Provider basis.

Each Service Provider (whether registered or wildcard based) has a field "attributes.extensions" which is a list of attribute names that may be provided by the caller of "/_idp/saml/init".

Service Providers that have not be configured with extension attributes will reject any custom attributes in SAML init.

This necessitates a new field in the service provider index. The template has been updated, but there is no data migration because the saml-service-provider index does not exist in any of the environments into which we wish to deploy this change.

This extends the change from elastic#128176 to validate the "custom attributes" on a per Service Provider basis. Each Service Provider (whether registered or wildcard based) has a field "attributes.extensions" which is a list of attribute names that may be provided by the caller of "/_idp/saml/init". Service Providers that have not be configured with extension attributes will reject any custom attributes in SAML init. This necessitates a new field in the service provider index. The template has been updated, but there is no data migration because the `saml-service-provider` index does not exist in any of the environments into which we wish to deploy this change.

elasticsearchmachine · 2025-06-03T08:06:33Z

Hi @tvernum, I've created a changelog YAML for you.

elasticsearchmachine · 2025-06-03T08:06:35Z

Pinging @elastic/es-security (Team:Security)

.../src/test/java/org/elasticsearch/xpack/idp/saml/sp/WildcardServiceProviderResolverTests.java

jakelandis

LGTM (pending the strict mapping question)

jakelandis · 2025-06-03T14:41:59Z

...ck/plugin/core/template-resources/src/main/resources/idp/saml-service-provider-template.json

@@ -75,6 +75,9 @@
            },
            "roles": {
              "type": "keyword"
+            },
+            "extensions": {
+              "type": "keyword"


Above this is declared as "dynamic": "strict", , and since this is an index template the change won't take effect until the index is re-created. Resulting in a error trying to index this new field on an existing index ?

Am I correct that this will require an manual update to the mapping for existing usages ? (which is technically a breaking change)

Am I correct that this will require an manual update to the mapping for existing usages ?

Yes, except we don't have any existing indices in prod or QA.

I've changed the SamlServiceProviderDocument implementation so that the extensions field is only included in the JSON output if it is populated.

That means that the new code will work correctly on top of an old index mapping as long as you never try to configure an extension for a service provider.
If you want to add extension support to the index, then you need to follow these steps to migrate your data:

1. Install the new version of ES. This will update the template.

2. Reindex

POST /_reindex { "source": { "index": "saml-service-provider-v1", }, "dest" : { "index": "saml-service-provider-v2" } }

This will create the saml-service-provider-v2 index using the new template including the new extensions field, and populate it with any existing data. The template will also add the saml-service-provider alias to the new saml-service-provider-v2 index.

3. Remove the saml-service-provider alias from the old index

POST /_aliases { "actions": [ { "remove": { "index": "saml-service-provider-v1", "alias": "saml-service-provider" } } ] }

tvernum · 2025-06-04T11:41:11Z

The test failure in IdentityProviderAuthenticationIT will be fixed by

Improve cache invalidation in IdP SP cache #128890

lloydmeta

LGTM.

slobodanadamovic

LGTM

This adds a new patch level TransportVersion in preparation for backporting elastic#128805

commit e6b8a64 Author: Lorenzo Dematte <[email protected]> Date: Tue Jun 10 12:02:16 2025 +0200 PR comments commit ad0902e Author: Moritz Mack <[email protected]> Date: Fri Jun 6 13:33:37 2025 +0200 Update ReproduceInfoPrinter to correctly print a reproduction for lucene / BC upgrade tests. Relates to ES-12005 commit 78b4168 Author: Alexander Spies <[email protected]> Date: Fri Jun 6 11:37:53 2025 +0200 ESQL: Throw ISE instead of IAE for illegal block in page (elastic#128960) IAE gets reported as a 400 status code, but that's inappropriate when inconsistent pages are always bugs, and should be reported with a 500. Throw ISE instead. commit 29e68bd Author: Aurélien FOUCRET <[email protected]> Date: Fri Jun 6 11:24:23 2025 +0200 [ES|QL] Fix test releases for telemetry. (elastic#128971) commit 1a76bc2 Author: Bogdan Pintea <[email protected]> Date: Fri Jun 6 11:01:49 2025 +0200 ESQL: Workaround for RLike handling of empty lang pattern (elastic#128895) Lucene's `org.apache.lucene.util.automaton.Operations#getSingleton` fails with an Automaton for a `REGEXP_EMPTY` `RegExp`. This adds a workaround for that, to check the type of automaton before calling into that failing method. Closes elastic#128813 commit e24fd32 Author: Aurélien FOUCRET <[email protected]> Date: Fri Jun 6 10:25:28 2025 +0200 [ES|QL] Enable the completion command as a tech preview feature (elastic#128948) commit 3f03775 Author: Niels Bauman <[email protected]> Date: Fri Jun 6 09:00:24 2025 +0200 Remove non-test usages of `Metadata.Builder#putCustom` (elastic#128801) This removes all non-test usages of ``` Metadata.Builder.putCustom(String type, ProjectCustom custom) ``` And replaces it with appropriate calls to the equivalent method on `ProjectMetadata.Builder`. In most cases this _does not_ make the code project aware, but does reduce the number of deprecated methods in use. commit 330d127 Author: Niels Bauman <[email protected]> Date: Fri Jun 6 08:07:59 2025 +0200 Make utility methods in `IndexLifecycleTransition` project-aware (elastic#128930) Modifies the methods to work with a project scope rather than a cluster scope. This is part of an iterative process to make ILM project-aware. commit 1b5720d Author: Aurélien FOUCRET <[email protected]> Date: Fri Jun 6 07:50:52 2025 +0200 [ES|QL] Fix test releases for LookupJoinTypesIT. (elastic#128985) commit 40cf2d3 Author: Tim Vernum <[email protected]> Date: Fri Jun 6 13:09:31 2025 +1000 Add "extension" attribute validation to IdP SPs (elastic#128805) This extends the change from elastic#128176 to validate the "custom attributes" on a per Service Provider basis. Each Service Provider (whether registered or wildcard based) has a field "attributes.extensions" which is a list of attribute names that may be provided by the caller of "/_idp/saml/init". Service Providers that have not be configured with extension attributes will reject any custom attributes in SAML init. This necessitates a new field in the service provider index (but only if the new `extensions` attribute is set). The template has been updated, but there is no data migration because the `saml-service-provider` index does not exist in any of the environments into which we wish to deploy this change. commit 496fb2d Author: Jordan Powers <[email protected]> Date: Thu Jun 5 19:50:09 2025 -0700 Skip UTF8 to UTF16 conversion during document indexing (elastic#126492) When parsing documents, we receive the document as UTF-8 encoded data which we then parse and convert the fields to java-native UTF-16 encoded Strings. We then convert these strings back to UTF-8 for storage in lucene. This patch skips the redundant conversion, instead passing lucene a direct reference to the received UTF-8 bytes when possible. commit c34f8b6 Author: Tim Vernum <[email protected]> Date: Fri Jun 6 12:03:25 2025 +1000 Improve cache invalidation in IdP SP cache (elastic#128890) The Identity Provider's Service Provider cache had two issues: 1. It checked for identity based on sequence numbers, but didn't include the `seq_no_primary_term` parameter on searches, which means the sequence would always by `-2` 2. It didn't track whether the index was deleted, which means it could be caching values from an old version of the index This commit fixes both of these issues. In practice neither issue was a problem because there are no deployments that use index-based service providers, however the 2nd issue did cause some challenges for testing. commit 923f029 Author: Nhat Nguyen <[email protected]> Date: Thu Jun 5 18:09:58 2025 -0700 Fix block loader with missing ignored source (elastic#129006) We miss appending null when ignored_source is not available. Our randomized tests already cover this case, but we do not check it when loading fields. I labelled this non-issue for an unreleased bug. Closes elastic#128959 Relates elastic#119546 commit 0f8178a Author: Bogdan Pintea <[email protected]> Date: Fri Jun 6 02:02:24 2025 +0200 ESQL: Forward port 8.19 RegexMatch serialization change version (elastic#128979) Fwd port ESQL_REGEX_MATCH_WITH_CASE_INSENSITIVITY_8_19. Related: elastic#128919. commit ee716f1 Author: Simon Chase <[email protected]> Date: Thu Jun 5 15:20:08 2025 -0700 transport: edit TransportConnectionListener for close exceptions (elastic#129015) The TransportConnectionListener interface has previously included the Transport.Connection being closed and unregistered in its onNodeDisconnected callback. This is not in use, and can be removed as it is also available in the onConnectionClosed callback. It is being replaced with a Nullable exception that caused the close. This is being used in pending work (ES-11448) to differentiate network issues from node restarts. Closes ES-12007 commit aceaf23 Merge: f18f4ee 159c57f Author: elasticsearchmachine <[email protected]> Date: Thu Jun 5 19:27:54 2025 +0000 Merge patch/serverless-fix into main commit 159c57f Author: Rene Groeschke <[email protected]> Date: Tue Jun 3 11:56:27 2025 +0200 Prepare serverless patch including elastic#128784 elastic#128740 (elastic#128807) * Change default for vector.rescoring.directio to false (elastic#128784) On serverless (and potentially elsewhere), direct IO is not available, which can cause BBQ shards to fail to read with org.apache.lucene.CorruptIndexException when this setting is true. * Optimize sparse vector stats collection (elastic#128740) This change improves the performance of sparse vector statistics gathering by using the document count of terms directly, rather than relying on the field name field to compute stats. By avoiding per-term disk/network reads and instead leveraging statistics already loaded into leaf readers at index opening, we expect to significantly reduce overhead. Relates to elastic#128583 --------- Co-authored-by: Dave Pifke <[email protected]> Co-authored-by: Jim Ferenczi <[email protected]>

This adds a new patch level TransportVersion in preparation for backporting elastic#128805

This extends the change from elastic#128176 to validate the "custom attributes" on a per Service Provider basis. Each Service Provider (whether registered or wildcard based) has a field "attributes.extensions" which is a list of attribute names that may be provided by the caller of "/_idp/saml/init". Service Providers that have not be configured with extension attributes will reject any custom attributes in SAML init. This necessitates a new field in the service provider index (but only if the new `extensions` attribute is set). The template has been updated, but there is no data migration because the `saml-service-provider` index does not exist in any of the environments into which we wish to deploy this change.

This adds a new patch level TransportVersion in preparation for backporting #128805

This extends the change from #128176 to validate the "custom attributes" on a per Service Provider basis. Each Service Provider (whether registered or wildcard based) has a field "attributes.extensions" which is a list of attribute names that may be provided by the caller of "/_idp/saml/init". Service Providers that have not be configured with extension attributes will reject any custom attributes in SAML init. This necessitates a new field in the service provider index (but only if the new `extensions` attribute is set). The template has been updated, but there is no data migration because the `saml-service-provider` index does not exist in any of the environments into which we wish to deploy this change. Backport of: #128805, #129233

tvernum requested review from lloydmeta, jakelandis and a team June 3, 2025 08:06

tvernum added >enhancement :Security/IdentityProvider Identity Provider (SSO) project in X-Pack v8.19.0 v9.1.0 labels Jun 3, 2025

Update docs/changelog/128805.yaml

412744b

elasticsearchmachine added the Team:Security Meta label for security team label Jun 3, 2025

tvernum commented Jun 3, 2025

View reviewed changes

.../src/test/java/org/elasticsearch/xpack/idp/saml/sp/WildcardServiceProviderResolverTests.java Show resolved Hide resolved

jakelandis approved these changes Jun 3, 2025

View reviewed changes

Merge branch 'main' into sp_extension_attributes

975d8b9

lloydmeta approved these changes Jun 5, 2025

View reviewed changes

slobodanadamovic approved these changes Jun 5, 2025

View reviewed changes

tvernum added 3 commits June 5, 2025 18:40

Only include extensions in JSON if populated

d3e0ff4

Merge branch 'main' into sp_extension_attributes

3ee9196

Merge branch 'main' into sp_extension_attributes

78b80b5

tvernum enabled auto-merge (squash) June 6, 2025 02:07

tvernum merged commit 40cf2d3 into elastic:main Jun 6, 2025
22 of 23 checks passed

tvernum added a commit to tvernum/elasticsearch that referenced this pull request Jun 10, 2025

Add 8.19 transport version for IdP Extension Attr

ba3a508

This adds a new patch level TransportVersion in preparation for backporting elastic#128805

tvernum added a commit to tvernum/elasticsearch that referenced this pull request Jun 11, 2025

Add 8.19 transport version for IdP Extension Attr

1fa84bd

This adds a new patch level TransportVersion in preparation for backporting elastic#128805

tvernum mentioned this pull request Jun 11, 2025

Add 8.19 transport version for IdP Extension Attr #129233

Merged

tvernum added a commit that referenced this pull request Jun 13, 2025

Add 8.19 transport version for IdP Extension Attr (#129233)

efca20e

This adds a new patch level TransportVersion in preparation for backporting #128805

tvernum mentioned this pull request Jun 13, 2025

Add "extension" attribute validation to IdP SPs #129396

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add "extension" attribute validation to IdP SPs #128805

Add "extension" attribute validation to IdP SPs #128805

Uh oh!

tvernum commented Jun 3, 2025

Uh oh!

elasticsearchmachine commented Jun 3, 2025

Uh oh!

elasticsearchmachine commented Jun 3, 2025

Uh oh!

Uh oh!

jakelandis left a comment

Uh oh!

jakelandis Jun 3, 2025

Uh oh!

tvernum Jun 4, 2025

Uh oh!

tvernum Jun 5, 2025

Uh oh!

tvernum commented Jun 4, 2025 •

edited

Loading

Uh oh!

lloydmeta left a comment

Uh oh!

slobodanadamovic left a comment

Uh oh!

Uh oh!

Uh oh!

Add "extension" attribute validation to IdP SPs #128805

Add "extension" attribute validation to IdP SPs #128805

Uh oh!

Conversation

tvernum commented Jun 3, 2025

Uh oh!

elasticsearchmachine commented Jun 3, 2025

Uh oh!

elasticsearchmachine commented Jun 3, 2025

Uh oh!

Uh oh!

jakelandis left a comment

Choose a reason for hiding this comment

Uh oh!

jakelandis Jun 3, 2025

Choose a reason for hiding this comment

Uh oh!

tvernum Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

tvernum Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

tvernum commented Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lloydmeta left a comment

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tvernum commented Jun 4, 2025 •

edited

Loading