Build SAML login (enterprise/internal/loginhandler), mirroring OIDC
Adds GET /auth/saml/login + POST /auth/saml/acs alongside the existing OIDC pair, both converging on the same upsert-user/resolve-tenant/ issue-session path. loginhandler.New now takes an optional *saml.ServiceProvider, RegisterRoutes registers each protocol's routes independently so either, both, or neither can be configured. SAML's replay/unsolicited-response defense (InResponseTo, standing in for OIDC's state) is carried via a SameSite=None sentry_saml_request cookie -- None because the ACS endpoint receives a cross-site POST from the IdP's origin, which SameSite=Lax cookies are never sent on. enterprise-auth's main.go now fetches+parses SAML_IDP_METADATA_URL at startup (samlsp.FetchMetadata) and wires the result through. Verified to the same bar as OIDC: a real fake IdP (crewjam/saml/samlidp, genuine XML signing/verification) drives the full login->ACS->session-cookie round trip and negative paths (bad InResponseTo, missing request cookie, missing email/NameID, no/multiple tenant memberships), all in loginhandler/saml_test.go, no Docker needed. The login-form HTML is bypassed by pre-seeding a saml.Session directly into samlidp's session store and presenting the matching `session` cookie -- an IdP-supported shortcut (confirmed by reading GetSession), the same "skip the UI, keep the crypto real" approach oidctest gave the OIDC tests. Writing that test caught two real bugs in internal/saml.ParseResponse, both fixed here: it never called r.ParseForm() before reading the POSTed SAMLResponse field, so every real ACS POST would have silently decoded an empty response; and its email-attribute matching missed urn:oid:0.9.2342.19200300.100.1.3 (the standard LDAP "mail" OID), which is what an IdP sends by default absent an explicit AttributeConsumingService request for "email" -- exactly what samlidp's own DefaultAssertionMaker does, and plausibly what real IdPs' default SAML app templates do too. Docs (CLAUDE.md, threat-model.md, architecture.md, enterprise/README.md, phase-4-runbook.md, docker-compose.yml's enterprise-auth comment) updated in lockstep: SAML login moves from "protocol mechanics only" to "built, verified with a real fake IdP, not yet tried against a real external IdP or a running enterprise-auth container" -- the same disclosed gap OIDC already carried.
This commit is contained in:
@@ -79,7 +79,7 @@ This split is not to be changed without discussion — see CLAUDE.md.
|
||||
| `search` (Rust, Phase 1) | Consumes the same Redpanda topic `ingest` does (own offset tracking), builds a Tantivy full-text index over `message`, serves matches over gRPC. Writes always go to one shared (default) index (`ingest` isn't tenant-aware); reads can be scoped per-tenant via `SearchRequest.tenant_id` and `src/registry.rs`'s `IndexRegistry` (Phase 4) — see "Tenant isolation" below. |
|
||||
| `api` (Go) | gRPC + REST gateway. `POST /query` compiles pipe-syntax or raw SQL to one IR, executed across ClickHouse/Tantivy (`/docs/query-language-design.md`). `internal/dashboards` is CRUD only — panel query execution happens client-side, reusing `/query`. `internal/authz` (Phase 4) enforces RBAC via a network call to `enterprise-auth`, never an import. |
|
||||
| `alerting` (Go, Phase 3) | Evaluates alert rules on an interval, calls `api`'s `POST /query` (via a `RoleService` credential once Phase 4 auth is configured — see `/docs/phase-4-isolation-design.md`'s alerting↔api gap), delivers firing/resolved notifications (webhook/Slack/PagerDuty). |
|
||||
| `enterprise` (Go, commercial license, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`, real IdP round trip, verified with a fake IdP but not a real external one), RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). Does **not** yet include SAML's login ACS handler (protocol mechanics only) — see `/docs/security/threat-model.md`. |
|
||||
| `enterprise` (Go, commercial license, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`) and SAML login (`/auth/saml/login`+`/auth/saml/acs`, via `internal/saml`'s `crewjam/saml` wiring) — both a real IdP round trip, each verified with a real fake IdP (`coreos/go-oidc`'s `oidctest`, `crewjam/saml`'s `samlidp`) but not a real external one, RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). |
|
||||
| `web` (SvelteKit, static build) | Query bar, dashboards, alerts, and (Phase 4) a settings page that renders SSO status via a runtime capability check (`GET /auth/features`) rather than bundling enterprise-licensed components. |
|
||||
| `cli` (`sentryctl`) | `ping`, `query`, `dashboards` (list/get/apply), `alerts` (list/get/apply). `$SENTRYCTL_TOKEN`, if set, is forwarded as a Bearer credential (Phase 4). |
|
||||
| `deploy` | A Helm chart covering every `docker-compose.yml` service, plus (Phase 4) a small Go Operator managing one CRD (`Tenant`) that provisions a per-tenant ClickHouse credential Secret. Never applied to a live cluster in the environment this was built in — see `/deploy/README.md`'s verification section before trusting it. |
|
||||
|
||||
+62
-10
@@ -24,6 +24,20 @@ of what was already run and passed. Two genuine exceptions:
|
||||
all, so this one was actually run in this runbook's own session, not
|
||||
just an earlier one. What's still unverified is wiring it into a real
|
||||
running `enterprise-auth` container against a real external IdP.
|
||||
- `enterprise/internal/loginhandler`'s full SAML login flow (§3b) --
|
||||
same bar as OIDC above, verified against a real fake SAML IdP
|
||||
(`crewjam/saml/samlidp`: genuine XML signing and signature
|
||||
verification, a real `AuthnRequest`/`Response` round trip), no Docker
|
||||
needed. Writing this test caught two real bugs in
|
||||
`enterprise/internal/saml`, now fixed: `ParseResponse` never called
|
||||
`r.ParseForm()` before reading the POSTed `SAMLResponse` field (every
|
||||
real ACS POST would have silently decoded to nothing), and the email-
|
||||
attribute matching didn't recognize `urn:oid:0.9.2342.19200300.100.1.3`
|
||||
(the standard LDAP "mail" OID), which is what an IdP sends by default
|
||||
when the SP doesn't explicitly request an attribute literally named
|
||||
"email" -- crewjam's own fake IdP hit this path. Same remaining gap as
|
||||
OIDC: not yet tried against a real external IdP or a running
|
||||
`enterprise-auth` container.
|
||||
|
||||
Everything else — `internal/rbacstore`'s CRUD, the auth-enforcement
|
||||
walkthrough, the dashboards tenant-scoping fix, the Helm chart, the
|
||||
@@ -145,6 +159,44 @@ to create the first tenant membership) is exactly the kind of rough
|
||||
edge an admin UI would smooth over -- named as real future work, not
|
||||
hidden.
|
||||
|
||||
## 3b. `enterprise-auth`: human login via SAML (new -- same "verified
|
||||
live in this session, not against a real running container or a real
|
||||
external IdP" caveat as §3a)
|
||||
|
||||
`enterprise/internal/loginhandler`'s SAML tests already prove the
|
||||
mechanism works end to end against a real fake SAML IdP (`go test
|
||||
./internal/loginhandler/... -run SAML -v` from `enterprise/`, no Docker
|
||||
needed). What's still unverified is wiring it into this actual running
|
||||
stack. To try that for real, point `docker-compose.yml`'s
|
||||
`enterprise-auth` service at a real SAML IdP (many identity providers
|
||||
offer a free developer/trial tenant with SAML app support):
|
||||
|
||||
```sh
|
||||
# Add to enterprise-auth's environment in docker-compose.yml (or a
|
||||
# docker-compose.override.yml):
|
||||
# SAML_ENTITY_ID: "http://localhost:8082/saml/metadata"
|
||||
# SAML_ACS_URL: "http://localhost:8082/auth/saml/acs"
|
||||
# SAML_IDP_METADATA_URL: "https://your-idp.example.com/metadata"
|
||||
# Register SAML_ENTITY_ID/SAML_ACS_URL with the IdP's application config
|
||||
# -- the IdP needs Sentry's ACS URL to know where to POST the assertion.
|
||||
|
||||
docker compose up -d --build enterprise-auth
|
||||
curl -s http://localhost:8082/auth/features
|
||||
# expect: {"sso_configured":true,"oidc_enabled":false,"saml_enabled":true}
|
||||
```
|
||||
|
||||
Bootstrapping the first `tenant_memberships` row is the same manual-SQL
|
||||
dance as §3a (log in once, it fails with 403, insert the membership
|
||||
using the `users` row that got created, log in again). Then visit
|
||||
`http://localhost:8082/auth/saml/login` in a real browser, complete the
|
||||
IdP's login, and confirm a `sentry_session` cookie lands after redirect
|
||||
to `POST_LOGIN_REDIRECT_URL`. Note SAML's `sentry_saml_request` cookie
|
||||
is `SameSite=None`, which requires `Secure` -- i.e. this only works over
|
||||
HTTPS in a real deployment, unlike OIDC's redirect-based callback which
|
||||
tolerates plain HTTP for local dev (see
|
||||
`enterprise/internal/loginhandler/loginhandler.go`'s `handleSAMLLogin`
|
||||
doc comment for why).
|
||||
|
||||
## 4. Turn on RBAC enforcement and prove it actually blocks/allows
|
||||
|
||||
Without touching the main stack's `api` container (so step 2's baseline
|
||||
@@ -164,11 +216,11 @@ docker stop sentry-api-enforced
|
||||
```
|
||||
|
||||
`GET /dashboards` on the same enforced instance should return 401
|
||||
without a token — there's no way to mint a human (Viewer/Editor/etc.)
|
||||
session yet (no OIDC/SAML login handler exists — see
|
||||
`enterprise/cmd/enterprise-auth/main.go`'s doc comment), so this
|
||||
runbook can't walk through a real human RBAC scenario end to end. That
|
||||
gap is real, not an oversight in this runbook.
|
||||
without a token — this section only demonstrates the service-token path
|
||||
(§3/§3a/§3b cover minting a real human session via OIDC or SAML); walking
|
||||
that session cookie through this same enforced instance to get a 200 is
|
||||
left as the natural next verification step once real Docker/K8s access
|
||||
exists, not yet done in this runbook.
|
||||
|
||||
## 5. Dashboards tenant scoping
|
||||
|
||||
@@ -363,11 +415,11 @@ Full accounting: `/docs/security/threat-model.md`. Headline items:
|
||||
and the one shared Tantivy index no matter what. A newly-provisioned
|
||||
tenant's storage is real, isolated at query time, and permanently
|
||||
empty until this changes — undesigned, not just unbuilt.
|
||||
- **Human SSO login now works for OIDC** (§3a) -- verified with a real
|
||||
fake IdP, not yet a real external one or a running `enterprise-auth`
|
||||
container. **SAML login still doesn't exist** -- protocol wiring only,
|
||||
no ACS handler. No tenant-picker UI for a multi-membership identity
|
||||
either (refused outright).
|
||||
- **Human SSO login now works for both OIDC (§3a) and SAML (§3b)** --
|
||||
each verified with a real fake IdP (genuine cryptographic signing and
|
||||
verification), not yet a real external IdP or a running
|
||||
`enterprise-auth` container. No tenant-picker UI for a multi-membership
|
||||
identity either (refused outright) for either protocol.
|
||||
- No admin UI to create a `tenant_memberships` row -- §3a's manual SQL
|
||||
bootstrap is the only way to grant a logged-in identity access today.
|
||||
- **No per-resource dashboard grants** (`dashboard_permissions` has a
|
||||
|
||||
@@ -130,7 +130,7 @@ to `enterprise-auth` — see "Deployment/network assumptions" below.
|
||||
|
||||
## Authentication
|
||||
|
||||
**Implemented for OIDC, still missing for SAML.**
|
||||
**Implemented for both OIDC and SAML, to the same verification bar.**
|
||||
`enterprise/internal/loginhandler` serves `GET /auth/oidc/login`
|
||||
(redirects to the configured IdP, with a short-lived HttpOnly cookie
|
||||
carrying CSRF-protection state) and `GET /auth/oidc/callback`
|
||||
@@ -138,29 +138,46 @@ carrying CSRF-protection state) and `GET /auth/oidc/callback`
|
||||
`enterprise/internal/oidc`'s real `coreos/go-oidc` wiring, upserts a
|
||||
`users` row keyed by SSO subject, resolves tenant/role from
|
||||
`tenant_memberships`, and issues a `session.Manager`-signed session
|
||||
cookie). Verified end-to-end with real cryptography, not mocked: the
|
||||
tests spin up a real fake IdP (`coreos/go-oidc`'s own `oidctest`
|
||||
package) that signs genuine RS256 ID tokens, and
|
||||
`enterprise/internal/loginhandler`'s handler verifies them for real via
|
||||
the same code path production uses — every test in
|
||||
`loginhandler_test.go` passes, including the full login→callback→
|
||||
session-cookie round trip. **Not yet verified**: wiring this into a
|
||||
running `enterprise-auth` container against a *real* external IdP
|
||||
(Google/Okta/etc.) — that needs real IdP credentials and a reachable
|
||||
callback URL neither of which this environment has; see
|
||||
`/docs/phase-4-runbook.md`.
|
||||
cookie), plus the SAML equivalent, `GET /auth/saml/login` (redirects to
|
||||
the configured IdP via `enterprise/internal/saml`'s
|
||||
`ServiceProvider.LoginURL`, persisting the AuthnRequest ID in a
|
||||
short-lived cookie — SAML's replay/unsolicited-response defense,
|
||||
standing in for OIDC's `state`) and `POST /auth/saml/acs` (validates the
|
||||
assertion's signature and `InResponseTo` against that cookie via
|
||||
`ServiceProvider.ParseResponse`, then converges on the same
|
||||
upsert/resolve/issue-session path OIDC uses). Both are verified
|
||||
end-to-end with real cryptography, not mocked: OIDC's tests spin up a
|
||||
real fake IdP (`coreos/go-oidc`'s own `oidctest` package) that signs
|
||||
genuine RS256 ID tokens; SAML's tests spin up a real fake IdP
|
||||
(`crewjam/saml/samlidp`) that builds and signs genuine SAML assertions
|
||||
and XML-signs the response, exercising the same `ServiceProvider.
|
||||
ParseResponse` signature-verification path production uses. Every test
|
||||
in `loginhandler_test.go` and `saml_test.go` passes, including the full
|
||||
login→callback/ACS→session-cookie round trip for both protocols, and
|
||||
negative-path tests for each (state/`InResponseTo` mismatch, missing/
|
||||
expired credential, missing required claim, no/multiple tenant
|
||||
memberships). Writing the SAML test caught two real bugs in
|
||||
`enterprise/internal/saml`'s `ParseResponse`, both fixed before this
|
||||
verification was considered complete: it never called `r.ParseForm()`
|
||||
before reading the POSTed `SAMLResponse` field (every real ACS POST
|
||||
would have decoded an empty response), and its email-attribute matching
|
||||
missed `urn:oid:0.9.2342.19200300.100.1.3` (the standard LDAP "mail"
|
||||
OID) — what an IdP sends by default when the SP hasn't explicitly
|
||||
requested an attribute literally named "email", which is exactly what
|
||||
`samlidp`'s own default assertion builder does. **Not yet verified for
|
||||
either protocol**: wiring this into a running `enterprise-auth`
|
||||
container against a *real* external IdP (Google/Okta/etc.) — that needs
|
||||
real IdP credentials and a reachable callback/ACS URL neither of which
|
||||
this environment has; see `/docs/phase-4-runbook.md`.
|
||||
|
||||
A user with zero or more than one `tenant_memberships` row is refused
|
||||
outright (403 / 501 respectively) rather than guessed at — a
|
||||
tenant-selection UI for the multi-membership case is real, undesigned
|
||||
future work, not silently approximated. `enterprise/internal/saml` still
|
||||
only does the protocol mechanics (AuthnRequest generation, assertion
|
||||
validation) with no ACS HTTP handler calling it — SAML login remains
|
||||
unimplemented, following `loginhandler`'s OIDC pattern once it is built.
|
||||
future work, not silently approximated, for either protocol.
|
||||
`GET /auth/features` (`enterprise/internal/authhandler`) reports whether
|
||||
OIDC/SAML are *configured*, for `/web`'s settings page to conditionally
|
||||
render — independent of whether a login button actually exists yet in
|
||||
the UI (it doesn't; only the two HTTP endpoints do).
|
||||
the UI (it doesn't; only the HTTP endpoints do).
|
||||
|
||||
**Implemented for the one machine caller.** `/alerting`'s evaluator is
|
||||
the sole service-to-service caller (`POST /query`, to evaluate rule
|
||||
@@ -370,7 +387,7 @@ terms:
|
||||
| Deployment actually routing traffic to `enterprise-api` (Helm) | **Enforced** — `api`/`enterprise-api` are mutually exclusive, same flag as RBAC/audit/SSO |
|
||||
| Deployment actually routing traffic to `enterprise-api` (docker-compose) | **Not implemented** — `docker-compose.yml` runs plain `api` unconditionally |
|
||||
| Human SSO login — OIDC | **Built, verified with a real fake IdP** (not yet tried against a real external IdP) |
|
||||
| Human SSO login — SAML | **Not implemented** |
|
||||
| Human SSO login — SAML | **Built, verified with a real fake IdP** (not yet tried against a real external IdP) |
|
||||
| Multi-tenant-membership login (tenant picker) | **Not implemented** — refused with a clear error, not guessed |
|
||||
| Per-resource dashboard grants (`own/granted`) | **Not implemented** |
|
||||
| Query audit logging (routine queries) | **Enforced**, fail-open, and now wired to a real writer via `enterprise-api` (`audit.QueryAPILogger`) |
|
||||
|
||||
Reference in New Issue
Block a user