Thehive: [bug] Request to Cortex fails / Authentication Failure

[d3vzer0]

Request to Cortex fails / Authentication Failure

Request Type

Bug

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Docker (on OSX)
| OS version (client) | 10.4
| TheHive version / git hash | thehiveproject/thehive:3.4.0 / thehiveproject/cortex:3.0.0
| Package Type | Docker
| Browser type & version | Chrome

Problem Description

After initialising the Docker-compose (ie. Hive, Cortex + Elastic) I added a new organisation and user via the Cortex web UI. The API key generated from this user has been added to the application.conf @ /etc/thehive/application.conf as such:

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
  "CORTEX-SERVER-2" {
   url = "http://cortex:9001"
   key = "THE_NEW_USER_KEY_HERE"
   # HTTP client configuration (SSL and proxy)
   ws {}
  }
}

However, the Hive and Cortex containers (after restartin) both display an authentication failed message when trying to connect to the Cortex instance:

container thehive:

thehive_1        | connectors.cortex.services.CortexError: Cortex error on http://172.20.0.3:9001/api/responder/_search?range=all (401)
thehive_1        | {"type":"AuthenticationError","message":"Authentication failure"}
thehive_1        |  at connectors.cortex.services.CortexClient.$anonfun$req
...

container cortex:

ortex_1         | [error] o.e.c.Authenticated - Authentication failure:
cortex_1         |  session: AuthenticationError User session not found
cortex_1         |  pki: AuthenticationError Certificate authentication is not configured
cortex_1         |  key: AuthenticationError Authentication header not found
cortex_1         |  init: AuthenticationError Use of initial user is forbidden because users exist in database
cortex_1         | [info] o.t.c.s.ErrorHandler - GET /api/user/current returned 401
cortex_1         | org.elastic4play.AuthenticationError: Authentication failure
cortex_1         |  at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:272)

Steps to Reproduce

1. Download docker-compose.yml
2. Run all containers
3. Create first hive + cortex users
4. Create new org in cortex
5. Create new user for new org (cortex)
6. Generate API key for new user (cortex)
7. Change application.conf (hive) and add API key for cortex

Possible Solutions

Complementary information

When attempting to execute an API call with CURL to Cortex I don't get a authentication failure:

Request:
curl -H 'Authorization: Bearer TOKEN_HERE' http://localhost:9001/api/responder

Response:
[]

My local compose file:

version: "2"
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.2.0
    environment:
      - http.host=0.0.0.0
      - transport.host=0.0.0.0
      - xpack.security.enabled=false
      - cluster.name=hive
      - script.allowed_types=inline
      - thread_pool.index.queue_size=100000
      - thread_pool.search.queue_size=100000
      - thread_pool.bulk.queue_size=100000
    ulimits:
      nofile:
        soft: 65536
        hard: 65536

    volumes:
    - ./esdata:/usr/share/elasticsearch/data

  cortex:
    image: thehiveproject/cortex:3.0.0
    ports:
      - "127.0.0.1:9001:9001"

    volumes:
      - ./Cortex-Analyzers:/etc/Cortex-Analyzers
      - ./cortex/application.conf:/etc/cortex/application.conf

  thehive:
    image: thehiveproject/thehive:3.4.0
    depends_on:
      - elasticsearch
      - cortex
    ports:
      - "127.0.0.1:9000:9000"
    volumes:
      - ./thehive/application.conf:/etc/thehive/application.conf

[To-om]

According to logs from Cortex (key: AuthenticationError Authentication header not found), TheHive doesn't use the API key from the configuration file. This means that you configuration file is not correctly read. I haven't identified the reason but I should set the Cortex key using command parameters (cf. Docker entrypoint)

[...]
thehive:
    image: thehiveproject/thehive:3.4.0
    depends_on:
      - elasticsearch
      - cortex
    ports:
      - "127.0.0.1:9000:9000"
    command: --cortex-key THE_NEW_USER_KEY_HERE

[d3vzer0]

Aah perfect, thanks! It seems that adding the additional command in the compose file fixes the errors ^^

PS. The entire stack looks awesome. Thank you for all the hard work put into this :)