[FEATURE] preserving original client identity in certificate based authentication where a load balancer does initial SSL handshake

[asifabashar]

Is your feature request related to a problem?
Where there a load balancer that itself does mTLS authentication, it forwards the request to opensearch where client is load balancer and actual client cert is no longer performing mtls , it is the load balancer that is doing cleint authentication with opensearch cluster.

What solution would you like?
To preserve identity of the original client, we can have first opensearch do client authentication validation with load balancer certificate through TLS handshake and then load balancer can store the original client certificate in header as URL encoded value in header field x-client-cert. The load balancer will connect to opensearch cluster and forward the request with original client cert in header so that opensearch cluster is assume correct identity of the original client. The load balancer has to be trusted by the opensearch so that i can trust its header so load balancer certificate will be validated at every request by opensearch using its standard certficate based authentication.
It will be controlled by flag settings where by default this feature will be disabled.

What alternatives have you considered?
A clear and concise description of any alternative solutions or features you've considered.

Do you have any additional context?
Many environments use load balancers in the infrastructure and kubernetes deployments also use load balancers also in general in most cases.

[asifabashar]

Please review , I have a change ready and will create pull request if you approve the requirements above as valid.

[github-actions]

Possible Duplicate

Found 1 possible duplicate issue(s):

• [Feature Request] Authenticate Opensearch Dashboard users with PKI #1470

If this is not a duplicate:

• Add a comment on this issue, or
• 👎 this comment to prevent auto-closure

Otherwise, this issue will be automatically closed in 7 days.

[asifabashar]

not a duplicate, its trying handle a different use case and applies for opensearch client auth, not only dashboard.

[cwperks]

@asifabashar what do your solution look like? I'd be happy to review a PR? I believe we already have support for X-Forwarded-For header in this plugin with client cert auth.

[asifabashar]

@asifabashar what do your solution look like? I'd be happy to review a PR? I believe we already have support for X-Forwarded-For header in this plugin with client cert auth.
X-Forwarded-For is for IP , but in this case , we would like to assign original client's cert's principle as user to OpenSearch by proxy server cert validation and principle comparison of proxy server's client cert.
Some of the general purpose load balancers are allowing the actual cert to be placed in header, but those load balancers are not setting x-forwarded-for field with the principle as its dedicated for IP. So allowing opensearch to extract its desired field from the certificate allows both opensearch and load balancer to work with their own requirements and configuration but still work together. In this scenerio,load balancer will validate original client and but it does not have the role mapping or correct principle extraction logic, so it will just pass the cert as is, Opensearch then will know the request is from proxy from proxy(external load balancer) by validating client cert authentication of the load balancer/proxy, so it will trust the request , but it should assume the actual client associated user that belongs to original client and not the load balancer , so it will then use certificate from header to switch to that principle .

create PR #6287 @cwperks