Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return API key name in _authentication response #78946

Merged
merged 38 commits into from Oct 29, 2021

Conversation

justincr-elastic
Copy link
Contributor

@justincr-elastic justincr-elastic commented Oct 11, 2021

Responses to POST /_security/api_key includes id, name, metadata,
api_key (shared secret), and encoded (base64 of id:api_key).

Requests to GET /_security/_authenticate returns data about the user,
but not the API KEY.

When authenticating using an API KEY, return API KEY info map in the
response. The initial feature request asked for 'name'. However, the
request's Authentication header contains 'encoded', so the decoded
'id' will be returned for convenience too.

When authenticating using any other method, API KEY info map is
omitted.

Closes #70306

Example request:

curl -s -X GET -H "Authorization: ApiKey base64(id:api_key)" "localhost:9200/_security/_authenticate?pretty"

Example response:

{
  "username" : "my-username",
  "roles" : [ ],
  "full_name" : null,
  "email" : null,
  "metadata" : { },
  "enabled" : true,
  "authentication_realm" : {
    "name" : "_es_api_key",
    "type" : "_es_api_key"
  },
  "lookup_realm" : {
    "name" : "_es_api_key",
    "type" : "_es_api_key"
  },
  "authentication_type" : "api_key",
  "token" : {
  },
  "api_key" : {
    "id": "jdgWKXwBtdtKDGAHT5OX"
    "name": "my-api-key"
  }
}

Responses to POST /_security/api_key includes id, name, metadata,
api_key (shared secret), and encoded (base64 of id:api_key).

Requests to GET /_security/_authenticate returns data about the user,
but not the API KEY.

When authenticating using an API KEY, return API KEY info map in the
response. The initial feature request asked for 'name'. However, the
request's Authentication header contains 'encoded', so the decoded
'id' will be returned for convenience too.

When authenticating using any other method, API KEY info map is
omitted.

Closes elastic#70306
Responses to POST /_security/api_key includes id, name, metadata,
api_key (shared secret), and encoded (base64 of id:api_key).

Requests to GET /_security/_authenticate returns data about the user,
but not the API KEY.

When authenticating using an API KEY, return API KEY info map in the
response. The initial feature request asked for 'name'. However, the
request's Authentication header contains 'encoded', so the decoded
'id' will be returned for convenience too.

When authenticating using any other method, API KEY info map is
omitted.

Closes elastic#70306
@justincr-elastic justincr-elastic added :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) auto-backport Automatically create backport pull requests when merged Team:Security Meta label for security team v7.16.0 labels Oct 11, 2021
@justincr-elastic justincr-elastic changed the title Feature/70306 Feature/70306 Return API KEY name in _authentication response Oct 11, 2021
@justincr-elastic justincr-elastic changed the title Feature/70306 Return API KEY name in _authentication response Return API KEY name in _authentication response Oct 11, 2021
Copy link
Member

@ywangd ywangd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't really look into the client side code. But here are a few things on the server side.

@justincr-elastic
Copy link
Contributor Author

@elasticmachine update branch

@justincr-elastic justincr-elastic removed auto-backport Automatically create backport pull requests when merged v7.16.0 labels Oct 26, 2021
@justincr-elastic
Copy link
Contributor Author

@elasticmachine update branch

@elasticmachine
Copy link
Collaborator

merge conflict between base and head

@justincr-elastic
Copy link
Contributor Author

@elasticmachine update branch

@elasticmachine
Copy link
Collaborator

merge conflict between base and head

@justincr-elastic justincr-elastic force-pushed the feature/70306 branch 2 times, most recently from 4ba6dee to 15e140a Compare October 27, 2021 21:03
@justincr-elastic
Copy link
Contributor Author

@elasticmachine update branch

@justincr-elastic justincr-elastic force-pushed the feature/70306 branch 3 times, most recently from 991db2e to 8da4cb1 Compare October 28, 2021 18:17
@tvernum tvernum removed their request for review October 29, 2021 01:13
@justincr-elastic
Copy link
Contributor Author

@elasticmachine update branch

Copy link
Member

@ywangd ywangd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. (Not sure why my previous disappeared. But I approved already a couple days back.)

@justincr-elastic justincr-elastic merged commit 8aa8fd3 into elastic:master Oct 29, 2021
@pugnascotia pugnascotia changed the title Return API KEY name in _authentication response Return API key name in _authentication response Jan 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>enhancement :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team v8.1.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Return API key name as part of _authenticate response
5 participants