-
Notifications
You must be signed in to change notification settings - Fork 24.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Respect runas auth realm for all API key security operations #51975
Comments
Pinging @elastic/es-security (:Security/Authentication) |
I think this is a bug in how the |
I agree. I think, on analysis, that we should call this a bug, and fix it in 7.x (soon). As always, one person's bug fix is another person's breaking change, but I'm happy that |
Reading through the |
@ywangd Yes, I think that needs to change as well. |
When user A runs as user B and performs any API key related operations, user B's realm should always be used to associate with the API key. Currently user A's realm is used when getting or invalidating API keys and owner=true. The PR is to fix this bug. resolves: #51975
When user A runs as user B and performs any API key related operations, user B's realm should always be used to associate with the API key. Currently user A's realm is used when getting or invalidating API keys and owner=true. The PR is to fix this bug. resolves: elastic#51975
When user A runs as user B and performs any API key related operations, user B's realm should always be used to associate with the API key. Currently user A's realm is used when getting or invalidating API keys and owner=true. The PR is to fix this bug. resolves: #51975
When user A run as user B and creates an API key, the creator realm is recorded as user B's realm. However, when retrieving or invalidating the above API key, user A's realm will be used. This creates a problem for queries with
owner=true
and leads to empty result set, e.g.GET -H 'es-security-runas-user: B' /_security/api_key?id=keyId&owner=true
.This feels like a bug and it is better to have consistent behaviour for how runas realm is handled for all API key security operations. But it will be a breaking change if users are relying on the current behaviour.
The text was updated successfully, but these errors were encountered: