Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow custom realms to use additional supporting objects #48369

Closed
tvernum opened this issue Oct 23, 2019 · 2 comments · Fixed by #50534
Closed

Allow custom realms to use additional supporting objects #48369

tvernum opened this issue Oct 23, 2019 · 2 comments · Fixed by #50534
Assignees
@tvernum
Labels
>enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)

Comments

@tvernum
Copy link
Contributor

tvernum commented Oct 23, 2019

Currently a SecurityExtension that provides a custom realm must fit into the following limitations:

That means that the only supporting objects that a realm can easily depend on are:

  • ResourceWatcherService
  • RealmConfig

If it wants anything else, it needs to get acces via the Plugin API.
Things that custom-realm-authors have said that they would like to have access to include:

  • An Elasticsearch Client (which they can get from Plugin.createComponents, but then need to save somewhere so the realm can access it)
  • The NativeRoleMappingStore (as a UserRoleMapper, which can be retrieved from Guice, but that's something we're actively working to remove).
@tvernum tvernum added >enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) team-discuss labels Oct 23, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (:Security/Authentication)

@tvernum
Copy link
Contributor Author

tvernum commented Oct 31, 2019

We agreed that this is something we want to do. We will need to investigate a little further to determine exactly which objects should be made available.

@tvernum tvernum self-assigned this Dec 30, 2019
tvernum added a commit to tvernum/elasticsearch that referenced this issue Dec 31, 2019
@tvernum
Support Client and RoleMapping in custom Realms
fc1a1fb 
Previously custom realms were limited in what services and components
they had easy access to. It was possible to work around this because a
security extension is packaged within a Plugin, so there were ways to
store this components in static/SetOnce variables and access them from
the realm, but those techniques were fragile, undocumented and
difficult to discover.

This change includes key services as an argument to most of the methods
on SecurityExtension so that custom realm / role provider authors can
have easy access to them.

Resolves: elastic#48369
@tvernum tvernum mentioned this issue Dec 31, 2019
Merged
tvernum added a commit that referenced this issue Jan 14, 2020
@tvernum
Support Client and RoleMapping in custom Realms (#50534)
75b68fa 
Previously custom realms were limited in what services and components
they had easy access to. It was possible to work around this because a
security extension is packaged within a Plugin, so there were ways to
store this components in static/SetOnce variables and access them from
the realm, but those techniques were fragile, undocumented and
difficult to discover.

This change includes key services as an argument to most of the methods
on SecurityExtension so that custom realm / role provider authors can
have easy access to them.

Resolves: #48369
SivagurunathanV pushed a commit to SivagurunathanV/elasticsearch that referenced this issue Jan 23, 2020
@tvernum @SivagurunathanV
Support Client and RoleMapping in custom Realms (elastic#50534)
9760f2d 
Previously custom realms were limited in what services and components
they had easy access to. It was possible to work around this because a
security extension is packaged within a Plugin, so there were ways to
store this components in static/SetOnce variables and access them from
the realm, but those techniques were fragile, undocumented and
difficult to discover.

This change includes key services as an argument to most of the methods
on SecurityExtension so that custom realm / role provider authors can
have easy access to them.

Resolves: elastic#48369
This was referenced Feb 3, 2020
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tvernum tvernum

Labels
>enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Support Client and RoleMapping in custom Realms tvernum/elasticsearch
2 participants
@tvernum @elasticmachine