Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expose API key name to the ingest pipeline #51305

Merged
merged 17 commits into from
Feb 10, 2020
Merged

Expose API key name to the ingest pipeline #51305

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
88ff001
WIP expose ApiKey name to ingest processor
ywangd Jan 22, 2020
d1592f8
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Jan 29, 2020
620554a
WIP: expose more info about auth object
ywangd Jan 29, 2020
f2ac3f6
Use a more backwards compatible schema
ywangd Jan 29, 2020
d481a56
Fix broken tests
ywangd Jan 29, 2020
29f33ce
Tidy up for tests
ywangd Jan 29, 2020
b81c6e3
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Jan 29, 2020
deb7ca9
Merge branch 'master' into es-49106-apikey-name
ywangd Jan 31, 2020
4d508a3
Update docs
ywangd Jan 31, 2020
919edb1
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Feb 3, 2020
9f7ca68
Address feedback by Tim
ywangd Feb 3, 2020
ac2efff
Address feedbacks
ywangd Feb 5, 2020
d488471
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Feb 5, 2020
cc63be7
Revert the logic of getCreatorRealm for backwards compatibility
ywangd Feb 6, 2020
e7af393
Address feedback to set lookedup realm for non-api auth
ywangd Feb 6, 2020
1e1d801
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Feb 7, 2020
44a77d3
Merge remote-tracking branch 'origin/master' into es-49106-apikey-name
ywangd Feb 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/ApiKeyService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ public class ApiKeyService {
private static final Logger logger = LogManager.getLogger(ApiKeyService.class);
private static final DeprecationLogger deprecationLogger = new DeprecationLogger(logger);
public static final String API_KEY_ID_KEY = "_security_api_key_id";
public static final String API_KEY_NAME_KEY = "_security_api_key_name";
public static final String API_KEY_REALM_NAME = "_es_api_key";
public static final String API_KEY_REALM_TYPE = "_es_api_key";
public static final String API_KEY_CREATOR_REALM = "_security_api_key_creator_realm";
Expand Down Expand Up @@ -495,6 +496,7 @@ private void validateApiKeyExpiration(Map<String, Object> source, ApiKeyCredenti
authResultMetadata.put(API_KEY_ROLE_DESCRIPTORS_KEY, roleDescriptors);
authResultMetadata.put(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY, limitedByRoleDescriptors);
authResultMetadata.put(API_KEY_ID_KEY, credentials.getId());
authResultMetadata.put(API_KEY_NAME_KEY, source.get("name"));
listener.onResponse(AuthenticationResult.success(apiKeyUser, authResultMetadata));
} else {
listener.onResponse(AuthenticationResult.unsuccessful("api key is expired", null));
Expand Down
10 changes: 9 additions & 1 deletion ...urity/src/main/java/org/elasticsearch/xpack/security/ingest/SetSecurityUserProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import org.elasticsearch.ingest.Processor;
import org.elasticsearch.xpack.core.security.authc.Authentication;
import org.elasticsearch.xpack.core.security.user.User;
import org.elasticsearch.xpack.security.authc.ApiKeyService;

import java.util.Arrays;
import java.util.EnumSet;
Expand Down Expand Up @@ -81,6 +82,12 @@ public IngestDocument execute(IngestDocument ingestDocument) throws Exception {
userObject.put("metadata", user.metadata());
}
break;
case API_KEY_NAME:
Object apiKeyName = authentication.getMetadata().get(ApiKeyService.API_KEY_NAME_KEY);
if (apiKeyName != null) {
userObject.put("api_key_name", apiKeyName);
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See my other comment about wanting the id etc as well.
I think this should be a nested object inside the user object.

user: {
   username: "...",
   api_key: {
       name: "...", id: "...", "realm": "..."
   }
}

break;
default:
throw new UnsupportedOperationException("unsupported property [" + property + "]");
}
Expand Down Expand Up @@ -134,7 +141,8 @@ public enum Property {
FULL_NAME,
EMAIL,
ROLES,
METADATA;
METADATA,
API_KEY_NAME;
albertzaharovits marked this conversation as resolved.
Show resolved Hide resolved

static Property parse(String tag, String value) {
try {
Expand Down