{"action":"created","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/166","repository_url":"https://api.github.com/repos/floragunncom/search-guard","labels_url":"https://api.github.com/repos/floragunncom/search-guard/issues/166/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard/issues/166/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard/issues/166/events","html_url":"https://github.com/floragunncom/search-guard/issues/166","id":164615009,"number":166,"title":"Searchguard doens't fail over with Multiple authc defined","user":{"login":"ewolinetz","id":1427473,"avatar_url":"https://avatars.githubusercontent.com/u/1427473?v=3","gravatar_id":"","url":"https://api.github.com/users/ewolinetz","html_url":"https://github.com/ewolinetz","followers_url":"https://api.github.com/users/ewolinetz/followers","following_url":"https://api.github.com/users/ewolinetz/following{/other_user}","gists_url":"https://api.github.com/users/ewolinetz/gists{/gist_id}","starred_url":"https://api.github.com/users/ewolinetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewolinetz/subscriptions","organizations_url":"https://api.github.com/users/ewolinetz/orgs","repos_url":"https://api.github.com/users/ewolinetz/repos","events_url":"https://api.github.com/users/ewolinetz/events{/privacy}","received_events_url":"https://api.github.com/users/ewolinetz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-08T20:57:15Z","updated_at":"2016-07-12T16:56:53Z","closed_at":null,"body":"openjdk version \"1.8.0_91\"\r\nOpenJDK Runtime Environment (build 1.8.0_91-b14)\r\nOpenJDK 64-Bit Server VM (build 25.91-b14, mixed mode)\r\n\r\nsh-4.2$ cat /etc/system-release\r\nCentOS Linux release 7.2.1511 (Core)\r\n\r\nES Version 2.3.3-1\r\nSG Versions:\r\ncom.floragunn/search-guard-ssl/2.3.3.13\r\ncom.floragunn/search-guard-2/2.3.3.2\r\n\r\nsg_config.yaml:\r\n```\r\nsearchguard:\r\n  dynamic:\r\n    http:\r\n      xff:\r\n        enabled: true\r\n        remoteIpHeader: \"x-forwarded-for\"\r\n        proxiesHeader: \"x-forwarded-by\"\r\n        trustedProxies: \".*\"\r\n        internalProxies: \".*\"\r\n    authc:\r\n      authentication_domain_proxy:\r\n        enabled: true\r\n        order: 0\r\n        authentication_backend:\r\n          type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend\r\n        authorization_backend:\r\n          type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend\r\n        http_authenticator:\r\n          type: com.floragunn.searchguard.http.HTTPProxyAuthenticator\r\n          challenge: false\r\n          config:\r\n            user_header: \"X-Proxy-Remote-User\"\r\n            roles_header: \"x-proxy-roles\"\r\n      authentication_domain_basic_internal:\r\n        enabled: true\r\n        order: 0\r\n        authentication_backend:\r\n          type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend\r\n        authorization_backend:\r\n          type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend\r\n        http_authenticator:\r\n          type: com.floragunn.searchguard.http.HTTPClientCertAuthenticator\r\n          challenge: false\r\n```\r\n\r\nWhen my Kibana tries to connect upon it starting up, it doesn't have a proxy header and _should_ connect via the HTTPClientCertAuthenticator however Searchguard never tries to pull the client cert.\r\nI have observed that when xff is `enabled: false` this works.\r\n\r\nI see this repeat in my Elasticsearch logs with TRACE for com.floragunn.searchguard.http:\r\n```\r\n[2016-07-08 20:41:46,601][TRACE][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [Baron Blood] channel opened: [id: 0x6d83a30b, /172.17.0.3:59744 => /172.17.0.4:9200]\r\n[2016-07-08 20:41:46,647][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /172.17.0.3:59744\r\n[2016-07-08 20:41:46,647][TRACE][com.floragunn.searchguard.http.RemoteIpDetector] originalRemoteAddr 172.17.0.3\r\n[2016-07-08 20:41:46,647][ERROR][com.floragunn.searchguard.http.RemoteIpDetector] no remote ip\r\n[2016-07-08 20:41:46,656][TRACE][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [Baron Blood] channel closed: [id: 0x6d83a30b, /172.17.0.3:59744 => /172.17.0.4:9200]\r\n```\r\n\r\nI have also noticed that `com.floragunn.searchguard.http.RemoteIpDetector` does not read in from configuration to populate `proxiesHeader` and `remoteIpHeader`."},"comment":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/comments/232108264","html_url":"https://github.com/floragunncom/search-guard/issues/166#issuecomment-232108264","issue_url":"https://api.github.com/repos/floragunncom/search-guard/issues/166","id":232108264,"user":{"login":"ewolinetz","id":1427473,"avatar_url":"https://avatars.githubusercontent.com/u/1427473?v=3","gravatar_id":"","url":"https://api.github.com/users/ewolinetz","html_url":"https://github.com/ewolinetz","followers_url":"https://api.github.com/users/ewolinetz/followers","following_url":"https://api.github.com/users/ewolinetz/following{/other_user}","gists_url":"https://api.github.com/users/ewolinetz/gists{/gist_id}","starred_url":"https://api.github.com/users/ewolinetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewolinetz/subscriptions","organizations_url":"https://api.github.com/users/ewolinetz/orgs","repos_url":"https://api.github.com/users/ewolinetz/repos","events_url":"https://api.github.com/users/ewolinetz/events{/privacy}","received_events_url":"https://api.github.com/users/ewolinetz/received_events","type":"User","site_admin":false},"created_at":"2016-07-12T16:54:54Z","updated_at":"2016-07-12T16:54:54Z","body":"Tried using the above config.  I see the following when Kibana tries to connect\r\n```\r\n[2016-07-12 16:52:10,106][TRACE][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [Hack] channel opened: [id: 0xaef27332, /172.17.0.3:33918 => /172.17.0.2:9200]\r\n[2016-07-12 16:52:10,154][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /172.17.0.3:33918\r\n[2016-07-12 16:52:10,154][TRACE][com.floragunn.searchguard.http.RemoteIpDetector] originalRemoteAddr 172.17.0.3\r\n[2016-07-12 16:52:10,155][ERROR][com.floragunn.searchguard.http.RemoteIpDetector] no remote ip\r\n[2016-07-12 16:52:10,165][TRACE][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [Hack] channel closed: [id: 0xaef27332, /172.17.0.3:33918 => /172.17.0.2:9200]\r\n```"}}
{"actor":{"display_login":"ewolinetz"}}