Proxy auth backend does not support cookie splitting

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch 2.19.1 & equivalent dashboard.

Describe the issue:

After implementing dashboard auth with OpenID we ended up going to oauth2-proxy with the proxy authentication backend because of the lack of group overage when using an entra ID app, which solved our too-many-groups users, but now the cookie setup by dashboards is too big (16KB and something).

We’ve discovered that other backends have cookie splitting, but not proxy backend.

Any know way to solve this?

Configuration:

Relevant Logs or Screenshots:

2

@sdbruder According to OpenSearch GitHub the cookie splitting was implemented for SAML and OpenID to handle too many roles issue.

I couldn’t find anything related to proxy.

Would you mind creating a feature reqeust in the OpenSearch Github?

3

Doing it. here: [FEATURE] Cookie splitting is also needed in the proxy auth backend · Issue #2276 · opensearch-project/security-dashboards-plugin · GitHub

1 Like