Graylog2 / Graylog2/graylog2-server

Configure the role of MongoDBAuthServiceBackend.

Open
#14,635 2 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?
The role of MongoDBAuthServiceBackend in the authorization process should be configurable.
Each client should be able to decide if it is only a default/fallback backend, which is used when no other backends (like LDAP) are configured, or is it the preferred backend, having higher priority than active, configured backend.

## Why?
HS-1408602927
One of the clients uses LDAP backend, but has some local users in MongoDB as well. Those users are not present in LDAP.
Whenever a local user tries to authenticate, LDAP request is made first and it fails. MongoDB request is used afterwards, as a fallback.
People responsible for LDAP in the client's organization complain about numerous, unnecessary calls to LDAP for non-existing users, coming from Graylog instance.

## Affected code

[AuthServiceAuthenticator.java](https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog/security/authservice/AuthServiceAuthenticator.java)

```public AuthServiceResult authenticate(AuthServiceCredentials authCredentials) {
final Optional activeBackend = authServiceConfig.getActiveBackend();

if (activeBackend.isPresent()) {
AuthenticationServiceUnavailableException caughtException = null;
try {
final AuthServiceResult result = authenticate(authCredentials, activeBackend.get());
if (result.isSuccess()) {
return result;
}
} catch (AuthenticationServiceUnavailableException e) {
caughtException = e;
}
// TODO: Do we want the fallback to the default backend here? Maybe it should be configurable?
if (LOG.isDebugEnabled()) {
final AuthServiceBackend defaultBackend = authServiceConfig.getDefaultBackend();
LOG.debug("Couldn't authenticate <{}> against active authentication service <{}/{}/{}>. Trying default backend <{}/{}/{}>.",
authCredentials.username(),
activeBackend.get().backendId(), activeBackend.get().backendType(), activeBackend.get().backendTitle(),
defaultBackend.backendId(), defaultBackend.backendType(), defaultBackend.backendTitle());
}
final AuthServiceResult result = authenticate(authCredentials, authServiceConfig.getDefaultBackend());
if (result.isSuccess()) {
return result;
}
if (caughtException != null) {
throw caughtException;
}
return result;
} else {
return authenticate(authCredentials, authServiceConfig.getDefaultBackend());
}
}```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.