Authenticate using Snowflake authentication mechanism #4315

iliyan-velichkov · 2024-09-26T12:13:26Z

When the Dirigible is deployed on Snowflake as container service, users should be able to authenticated in the application with Snowflake authentication mechanism only. Currently, double authentication is used.

The PR adds a new spring profile for Snowflake called snowflake.
The profile relies on the propagated logged in user for the authentication as described in this tutorial. Additional details here.

Example env variable: SPRING_PROFILES_ACTIVE=snowflake

An additional optional env variable was introduced called DIRIGIBLE_SNOWFLAKE_ADMIN_USERNAME.
Using this configuration, an user can be automatically initialized with all available Dirigible roles. Later on, you can use this user to assign roles to other users.

When a user loggin to the application for the first time, a new user registration is automatically created in the system DB if missing.

I didn't find a proper way to implement logout. I have created a Snowflake ticket for that.

I verified the Snowflake UDF scenario works with the current implementation.

Login flow:

Screen.Recording.2024-09-26.at.15.23.43.mov

Signed-off-by: Iliyan Velichkov <[email protected]>

...c/main/java/org/eclipse/dirigible/components/security/snowflake/SnowflakeSecurityConfig.java

Signed-off-by: Iliyan Velichkov <[email protected]>

ThuF

+1 Seems good to me

…ation # Conflicts: # components/data/data-source-snowpark/src/main/java/org/eclipse/dirigible/components/data/source/snowpark/SnowflakeDatabaseConfigurator.java

…rkaround for invalidating the cookie Signed-off-by: Iliyan Velichkov <[email protected]>

iliyan-velichkov · 2024-10-01T11:45:00Z

tested a proposed solution (to use SYSTEM$ABORT_SESSION) by Snowflake support - it doesn't work
I managed to invalidate the snowflake auth cookie to enforce logout

login-logout.mov

Signed-off-by: Iliyan Velichkov <[email protected]>

...nts/src/main/java/org/eclipse/dirigible/components/tenants/security/BasicSecurityConfig.java

@@ -44,7 +42,7 @@
    SecurityFilterChain filterChain(HttpSecurity http, TenantContextInitFilter tenantContextInitFilter) throws Exception {
        http.cors(Customizer.withDefaults())
            .httpBasic(Customizer.withDefaults())
-            .csrf(csrf -> csrf.disable())
+            .csrf(csrf -> csrf.disable())// if enabled, some functionalities will not work - like creating a project


To fix the problem, we need to enable CSRF protection and handle any specific functionalities that might break due to this change. One approach is to selectively disable CSRF protection for specific endpoints that require it, while keeping it enabled for the rest of the application.

Enable CSRF Protection: Remove the csrf.disable() line to enable CSRF protection globally.

Selective CSRF Disabling: If certain endpoints need CSRF protection to be disabled, configure the HttpSecurity object to selectively disable CSRF for those endpoints.

...c/main/java/org/eclipse/dirigible/components/security/snowflake/SnowflakeSecurityConfig.java

+    SecurityFilterChain filterChain(HttpSecurity http, TenantContextInitFilter tenantContextInitFilter) throws Exception {
+        LOGGER.info("Configure snowflake security configurations");
+        http.cors(Customizer.withDefaults())
+            .csrf(csrf -> csrf.disable()) // if enabled, some functionalities will not work - like creating a project


To fix the problem, we need to enable CSRF protection while ensuring that the application's functionalities are not broken. This can be achieved by configuring CSRF protection to ignore specific endpoints or using CSRF tokens appropriately.

Enable CSRF Protection: Remove the csrf.disable() call.

Configure CSRF Protection: If certain endpoints need to be excluded from CSRF protection, configure them explicitly.

Update Methods and Imports: Ensure that the necessary methods and imports are in place to support the new configuration.

with zero the ingress returns 500 Signed-off-by: Iliyan Velichkov <[email protected]>

iliyan-velichkov · 2024-10-02T12:14:58Z

Example flow for the scenario in which path /sfc-endpoint/logout is used after logout (currently, not implemented in the PR)

logout-using-path.mov

Signed-off-by: Iliyan Velichkov <[email protected]>

delchev

Awesome!

ThuF

+1 Seems good to me.

iliyan-velichkov added 15 commits September 24, 2024 15:03

WIP snowflake auth

3bc5c4b

Signed-off-by: Iliyan Velichkov <[email protected]>

remove basic

062402d

Signed-off-by: Iliyan Velichkov <[email protected]>

force session logout on missing header

be390bf

Signed-off-by: Iliyan Velichkov <[email protected]>

remove AuthenticationProvider

2c66f1c

Signed-off-by: Iliyan Velichkov <[email protected]>

extract CorsConfigurationSource logic

23ff818

Signed-off-by: Iliyan Velichkov <[email protected]>

invalidate session as well

e9bd659

Signed-off-by: Iliyan Velichkov <[email protected]>

reduce logback logging

d483b25

Signed-off-by: Iliyan Velichkov <[email protected]>

wip: snowflake logout

33e9401

Signed-off-by: Iliyan Velichkov <[email protected]>

try to explicitly invalidate cookies

77444cd

Signed-off-by: Iliyan Velichkov <[email protected]>

remove snowflake logout logic since it doesn't work

1f0fe93

Signed-off-by: Iliyan Velichkov <[email protected]>

add dedicated snowflake admin user initializer

e6c6491

Signed-off-by: Iliyan Velichkov <[email protected]>

auto create user in db if missing

a157d99

Signed-off-by: Iliyan Velichkov <[email protected]>

refactoring

8120cb6

Signed-off-by: Iliyan Velichkov <[email protected]>

rollback SnowflakeDatabaseConfigurator.java

7907d54

Signed-off-by: Iliyan Velichkov <[email protected]>

cleanup

c990bd2

Signed-off-by: Iliyan Velichkov <[email protected]>

iliyan-velichkov changed the title ~~Snowflake authentication profile~~ Authenticate using Snowflake authentication mechanism Sep 26, 2024

github-advanced-security bot found potential problems Sep 26, 2024

View reviewed changes

...c/main/java/org/eclipse/dirigible/components/security/snowflake/SnowflakeSecurityConfig.java Fixed Show fixed Hide fixed

use default config for CSRF

542f266

Signed-off-by: Iliyan Velichkov <[email protected]>

iliyan-velichkov requested a review from delchev September 26, 2024 12:59

ThuF approved these changes Sep 30, 2024

View reviewed changes

Merge remote-tracking branch 'origin/master' into snowflake-authentic…

eea4a18

…ation # Conflicts: # components/data/data-source-snowpark/src/main/java/org/eclipse/dirigible/components/data/source/snowpark/SnowflakeDatabaseConfigurator.java

iliyan-velichkov force-pushed the snowflake-authentication branch from 1b6bdd4 to eea4a18 Compare October 1, 2024 07:43

disable CSRF since Dirigible doesn't work + implement logout using wo…

b22ab97

…rkaround for invalidating the cookie Signed-off-by: Iliyan Velichkov <[email protected]>

remove logs

a7f9fed

Signed-off-by: Iliyan Velichkov <[email protected]>

github-advanced-security bot found potential problems Oct 1, 2024

View reviewed changes

use timestamp for expires to fix logout

785bf11

with zero the ingress returns 500 Signed-off-by: Iliyan Velichkov <[email protected]>

iliyan-velichkov requested a review from ThuF October 1, 2024 12:09

invalidate session on logout and add a hint for snow logout path

ea0af3d

Signed-off-by: Iliyan Velichkov <[email protected]>

delchev approved these changes Oct 4, 2024

View reviewed changes

ThuF approved these changes Oct 4, 2024

View reviewed changes

iliyan-velichkov merged commit e6c4481 into master Oct 4, 2024
8 of 9 checks passed

iliyan-velichkov deleted the snowflake-authentication branch October 4, 2024 08:16

@@ -44,3 +44,3 @@
                         .httpBasic(Customizer.withDefaults())
-                        .csrf(csrf -> csrf.disable())// if enabled, some functionalities will not work - like creating a project
+                        .csrf(Customizer.withDefaults()) // Enable CSRF protection
                         .addFilterBefore(tenantContextInitFilter, UsernamePasswordAuthenticationFilter.class)

@@ -46,3 +46,3 @@
                     http.cors(Customizer.withDefaults())
-                        .csrf(csrf -> csrf.disable()) // if enabled, some functionalities will not work - like creating a project
+                        .csrf(csrf -> csrf.ignoringAntMatchers("/specific-endpoint-to-ignore")) // Enable CSRF protection and ignore specific endpoints if necessary
                         .logout(logout -> logout.deleteCookies("JSESSIONID")

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authenticate using Snowflake authentication mechanism #4315

Authenticate using Snowflake authentication mechanism #4315

iliyan-velichkov commented Sep 26, 2024 •

edited

Loading

ThuF left a comment

iliyan-velichkov commented Oct 1, 2024 •

edited

Loading

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

iliyan-velichkov commented Oct 2, 2024

delchev left a comment

ThuF left a comment

Authenticate using Snowflake authentication mechanism #4315

Authenticate using Snowflake authentication mechanism #4315

Conversation

iliyan-velichkov commented Sep 26, 2024 • edited Loading

ThuF left a comment

Choose a reason for hiding this comment

iliyan-velichkov commented Oct 1, 2024 • edited Loading

iliyan-velichkov commented Oct 2, 2024

delchev left a comment

Choose a reason for hiding this comment

ThuF left a comment

Choose a reason for hiding this comment

iliyan-velichkov commented Sep 26, 2024 •

edited

Loading

iliyan-velichkov commented Oct 1, 2024 •

edited

Loading