- Added proof on concept for tdp based kibana auth

tdrs-backend/docker-compose.yml

@@ -101,6 +101,7 @@ services:
       - CYPRESS_TOKEN
       - DJANGO_DEBUG
       - SENDGRID_API_KEY
+      - BYPASS_KIBANA_AUTH
     volumes:
       - .:/tdpapp
     image: tdp

tdrs-backend/tdpservice/settings/common.py

@@ -465,11 +465,13 @@ class Common(Configuration):
         }
     }
 
-    # Elastic
+    # Elastic/Kibana
     ELASTICSEARCH_DSL = {
         'default': {
             'hosts': os.getenv('ELASTIC_HOST', 'elastic:9200'),
         },
     }
+    KIBANA_BASE_URL = os.getenv('KIBANA_BASE_URL', 'http://localhost:5601')
+    BYPASS_KIBANA_AUTH = os.getenv("BYPASS_KIBANA_AUTH", 0)
 
     CYPRESS_TOKEN = os.getenv('CYPRESS_TOKEN', None)

tdrs-backend/tdpservice/urls.py

@@ -11,7 +11,7 @@
 from rest_framework.permissions import AllowAny
 
 
-from .users.api.authorization_check import AuthorizationCheck
+from .users.api.authorization_check import AuthorizationCheck, KibanaAuthorizationCheck
 from .users.api.login import TokenAuthorizationLoginDotGov, TokenAuthorizationAMS
 from .users.api.login import CypressLoginDotGovAuthenticationOverride
 from .users.api.login_redirect_oidc import LoginRedirectAMS, LoginRedirectLoginDotGov
@@ -52,6 +52,7 @@
 urlpatterns = [
     path("v1/", include(urlpatterns)),
     path("admin/", admin.site.urls, name="admin"),
+    path("kibana/", KibanaAuthorizationCheck.as_view(), name="kibana-authorization-check"),
 ] + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
 
 # TODO: Supply `terms_of_service` argument in OpenAPI Info once implemented

tdrs-backend/tdpservice/users/api/authorization_check.py

@@ -8,6 +8,8 @@
 from rest_framework.response import Response
 from rest_framework.views import APIView
 from ..serializers import UserProfileSerializer
+from django.http import HttpResponseRedirect
+from django.conf import settings
 
 logger = logging.getLogger(__name__)
 
@@ -47,3 +49,19 @@ def get(self, request, *args, **kwargs):
         else:
             logger.info("Auth check FAIL for user on %s", timezone.now())
             return Response({"authenticated": False})
+
+class KibanaAuthorizationCheck(APIView):
+    """Check if user is authorized to view Kibana."""
+
+    query_string = False
+    pattern_name = "kibana-authorization-check"
+    permission_classes = [AllowAny]
+
+    def get(self, request, *args, **kwargs):
+        """Handle get request and verify user is authorized."""
+        user = request.user
+
+        if (user.is_authenticated and user.hhs_id is not None) or settings.BYPASS_KIBANA_AUTH:
+            return HttpResponseRedirect(settings.KIBANA_BASE_URL)
+        else:
+            return HttpResponseRedirect(settings.FRONTEND_BASE_URL)

tdrs-frontend/nginx/local/locations.conf

@@ -4,7 +4,7 @@ location = /nginx_status {
     deny all;
 }
 
-location ~ ^/(v1|admin|static/admin|swagger|redocs) {
+location ~ ^/(v1|admin|static/admin|swagger|redocs|kibana) {
         limit_req zone=limitreqsbyaddr delay=5;
         proxy_pass              http://${BACK_END}:8080$request_uri;
         proxy_set_header   Host $host:3000;

tdrs-frontend/src/components/Header/Header.jsx

@@ -137,6 +137,13 @@ function Header() {
                       href={`${process.env.REACT_APP_BACKEND_HOST}/admin/`}
                     />
                   )}
+                  {userIsAdmin && (
+                    <NavItem
+                      pathname={pathname}
+                      tabTitle="Kibana"
+                      href={`${process.env.REACT_APP_BACKEND_HOST}/kibana/`}
+                    />
+                  )}
                 </>
               )}
             </ul>

tdrs-frontend/src/components/SiteMap/SiteMap.jsx

@@ -31,6 +31,13 @@ const SiteMap = ({ user }) => {
           link={`${process.env.REACT_APP_BACKEND_HOST}/admin/`}
         />
       )}
+
+      {userIsAdmin && (
+        <SiteMap.Link
+          text="Kibana"
+          link={`${process.env.REACT_APP_BACKEND_HOST}/kibana/`}
+        />
+      )}
     </div>
   )
 }