client certificate setting bypasses password requirements #4378 Signed-off-by: Asif Bashar <[email protected]>

Author: asifbashar

src/main/java/org/opensearch/security/auth/BackendRegistry.java

@@ -57,6 +57,7 @@
 import org.opensearch.identity.UserSubject;
 import org.opensearch.security.auditlog.AuditLog;
 import org.opensearch.security.auth.blocking.ClientBlockRegistry;
+import org.opensearch.security.auth.internal.InternalAuthenticationBackend;
 import org.opensearch.security.auth.internal.NoOpAuthenticationBackend;
 import org.opensearch.security.configuration.AdminDNs;
 import org.opensearch.security.filter.SecurityRequest;
@@ -103,6 +104,8 @@ public class BackendRegistry {
     private Cache<AuthCredentials, User> userCache; // rest standard
     private Cache<String, User> restImpersonationCache; // used for rest impersonation
     private Cache<User, Set<String>> restRoleCache; //
+    private static final String OPENSEARCH_PRODUCT_ORIGIN_HTTP_HEADER = "X-opensearch-product-origin";
+    private static final String OPENSEARCH_PRODUCT_DASHBOARD_ORIGIN = "opensearch-dashboards";
 
     private void createCaches() {
         userCache = CacheBuilder.newBuilder()
@@ -363,6 +366,16 @@ public boolean authenticate(final SecurityRequestChannel request) {
                         request
                     );
                 }
+                
+                if ( request.header(OPENSEARCH_PRODUCT_ORIGIN_HTTP_HEADER)!= null && request.header(OPENSEARCH_PRODUCT_ORIGIN_HTTP_HEADER).equals(OPENSEARCH_PRODUCT_DASHBOARD_ORIGIN) && authDomain.getBackend().getClass().getName().equals(InternalAuthenticationBackend.class.getName())   ) {
+                	log.error("Cannot authenticate rest user because  user authentication failed from browser.");
+                    auditLog.logFailedLogin(ac.getUsername(), true, null, request);
+                    request.queueForSending(
+                        new SecurityResponse(SC_FORBIDDEN, "Cannot authenticate user because authentication failed from browser login via HTTP")
+                    );
+                    return false;
+                	
+                }
                 continue;
             }