[Security in Core] Exposes `apiKeys` from `core.security.authc` #186910

SiddharthMantri · 2024-06-25T16:57:21Z

Summary

Expose apiKeys as a service under core.security.authc.apiKeys.

Details

PR introduces a new API Keys Service which is accessible under the authc namespace in core.security. The service exposes the public API that was already available on the server-side in the security plugin.

The service is initialized and registered with core using the delegate_api - allowing access to the service within the core plugin without the need for the security plugin.

Note: I had to move quite a few types/functions around to prevent cyclical dependencies.

Plugins and the APIs that use the current `apiKeys` function from the security plugin

Expand for table with details

Plugin	File	API used	Can be migrated
alerting	x-pack/plugins/alerting/plugin/server.ts	areApiKeysEnabled()	✅
	x-pack/plugins/alerting/server/rules_client_factory.ts	grantAsInternalUser()	❌
	x-pack/plugins/alerting/server/task.ts	invalidatedAsInternalUser()	❌
enterprise_search	x-pack/plugins/enterprise_search/server/routes/enterprise_search/api_keys	create()	✅
	x-pack/plugins/enterprise_search/server/lib/indices/create_api_key.ts	create()	✅
fleet	x-pack/plugins/fleet/server/routes/setup/handlers.ts	areApiKeysEnabled()	✅
	x-pack/plugins/fleet/server/services/api_keys/security	invalidateAsInternalUser()	❌
	x-pack/plugins/fleet/server/services/api_keys/transform_api_keys.ts	grantAsInternalUser()	❌
	x-pack/plugins/fleet/server/services/setup/fleet_server_policies_enrollment_keys.ts	areApiKeysEnabled()	✅
	x-pack/plugins/fleet/server/services/setup/fleet_server_policies_enrollment_keys.ts	areAPIKeysEnabled()	✅
	x-pack/plugins/observability_solution/apm/server/routes/agent_keys/get_agent_keys_privileges.ts	areAPIKeysEnabled()	✅
observability_solution	x-pack/plugins/observability_solution/entity_manager/server/lib/auth/api_key/api_key.ts	areAPIKeysEnabled	✅
		validate	✅
		grantAsInternalUser	❌
	x-pack/plugins/observability_solution/entity_manager/server/routes/enablement/disable.ts	invalidateAsInternalUser	❌
	x-pack/plugins/observability_solution/entity_manager/server/routes/enablement/enable.ts	invalidateAsInternalUser	❌
	x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts	create	✅
	x-pack/plugins/observability_solution/synthetics/server/routes/synthetics_service/enablement.ts	invalidateAsInternalUser	❌
	x-pack/plugins/observability_solution/synthetics/server/synthetics_service/get_api_key.ts	validate	✅
		areAPIKeysEnabled	✅
		grantAsInternalUser	❌
		create	✅
serverless_search	x-pack/plugins/serverless_search/server/routes/api_key_routes.ts	create	✅
	x-pack/plugins/transform/server/routes/api/reauthorize_transforms/route_handler_factory.ts	grantAsInternalUser	❌
	x-pack/plugins/upgrade_assistant/server/lib/reindexing/credential_store.ts	grantAsInternalUser	❌
		invalidateAsInternalUser	❌
		areAPIKeysEnabled()	✅

SiddharthMantri · 2024-06-25T19:32:56Z

/ci

…fix'

SiddharthMantri · 2024-06-25T19:58:41Z

/ci

SiddharthMantri · 2024-06-26T07:29:23Z

/ci

SiddharthMantri · 2024-06-26T09:02:25Z

/ci

…fix'

packages/core/security/core-security-common/src/roles/schema.ts

packages/core/security/core-security-common/index.ts

x-pack/plugins/security/server/build_delegate_apis.ts

…fix'

SiddharthMantri · 2024-06-26T12:33:19Z

/ci

…fix'

…-fix'

SiddharthMantri · 2024-06-29T11:33:13Z

@elasticmachine merge upstream

…fix'

elena-shostak

LGTM 🚀

elena-shostak · 2024-07-01T09:54:51Z

packages/core/security/core-security-server-internal/src/security_route_handler_context.ts

@@ -26,6 +26,26 @@ export class CoreSecurityRouteHandlerContext implements SecurityRequestHandlerCo
    if (this.#authc == null) {
      this.#authc = {
        getCurrentUser: () => this.securityStart.authc.getCurrentUser(this.request),
+        apiKeys: {
+          areAPIKeysEnabled: this.securityStart.authc.apiKeys.areAPIKeysEnabled.bind(


nit: we can use arrow function instead of bind, like getCurrentUser

Good idea! Addressed in 1faeaa4

kibana-ci · 2024-07-02T11:17:30Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 1faeaa4

Failed CI Steps

The CI Stats report is too large to be displayed here, check out the CI build annotation for this information.

History

💚 Build #218616 succeeded df6e945
💛 Build #218562 was flaky 7435d87
💚 Build #218536 succeeded caddc90
💔 Build #218500 failed 7b2c26f
💔 Build #218260 failed 50c100f
💔 Build #218239 failed 54952ea

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @elena-shostak

SiddharthMantri · 2024-07-09T12:04:23Z

@elasticmachine merge upstream

elasticmachine · 2024-07-09T13:43:55Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: b65a666

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/core-security-server`	16	63	+47
`@kbn/core-security-server-mocks`	13	15	+2
`@kbn/security-plugin-types-server`	121	154	+33
`security`	206	222	+16
total			+98

Any counts in public APIs

Total count of every any typed public API. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats any for more detailed information.

id	before	after	diff
`@kbn/core-security-server`	0	1	+1
`@kbn/security-plugin-types-server`	0	1	+1
total			+2

Unknown metric groups

API count

id	before	after	diff
`@kbn/core-security-server`	52	146	+94
`@kbn/core-security-server-mocks`	13	15	+2
`@kbn/security-plugin-types-server`	216	275	+59
`security`	415	438	+23
total			+178

History

💚 Build #219625 succeeded 6c85ea3

cc @elena-shostak

…tic#186910) ## Summary Expose `apiKeys` as a service under `core.security.authc.apiKeys`. Closes elastic#184764 ### Details PR introduces a new API Keys Service which is accessible under the `authc` namespace in core.security. The service exposes the public API that was already available on the server-side in the security plugin. The service is initialized and registered with core using the `delegate_api` - allowing access to the service within the core plugin without the need for the `security` plugin. Note: I had to move quite a few types/functions around to prevent cyclical dependencies. ### Plugins and the APIs that use the current `apiKeys` function from the security plugin <details> <summary> Expand for table with details </summary> | Plugin | File | API used | Can be migrated | |--------|--------|--------|--------| | alerting | x-pack/plugins/alerting/plugin/server.ts | areApiKeysEnabled() | ✅ | | | x-pack/plugins/alerting/server/rules_client_factory.ts | grantAsInternalUser() | ❌ | | | x-pack/plugins/alerting/server/task.ts | invalidatedAsInternalUser() | ❌ | | enterprise_search | x-pack/plugins/enterprise_search/server/routes/enterprise_search/api_keys | create() | ✅ | | | x-pack/plugins/enterprise_search/server/lib/indices/create_api_key.ts | create() | ✅ | | fleet | x-pack/plugins/fleet/server/routes/setup/handlers.ts | areApiKeysEnabled() | ✅ | | | x-pack/plugins/fleet/server/services/api_keys/security | invalidateAsInternalUser() | ❌ | | | x-pack/plugins/fleet/server/services/api_keys/transform_api_keys.ts | grantAsInternalUser() | ❌ | | | x-pack/plugins/fleet/server/services/setup/fleet_server_policies_enrollment_keys.ts | areApiKeysEnabled() | ✅ | | | x-pack/plugins/fleet/server/services/setup/fleet_server_policies_enrollment_keys.ts | areAPIKeysEnabled() | ✅ | | | x-pack/plugins/observability_solution/apm/server/routes/agent_keys/get_agent_keys_privileges.ts | areAPIKeysEnabled() | ✅ | | observability_solution | x-pack/plugins/observability_solution/entity_manager/server/lib/auth/api_key/api_key.ts | areAPIKeysEnabled | ✅ | | | | validate | ✅ | | | | grantAsInternalUser | ❌ | | | x-pack/plugins/observability_solution/entity_manager/server/routes/enablement/disable.ts | invalidateAsInternalUser | ❌ | | | x-pack/plugins/observability_solution/entity_manager/server/routes/enablement/enable.ts | invalidateAsInternalUser | ❌ | | | x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts | create | ✅ | | | x-pack/plugins/observability_solution/synthetics/server/routes/synthetics_service/enablement.ts | invalidateAsInternalUser | ❌ | | | x-pack/plugins/observability_solution/synthetics/server/synthetics_service/get_api_key.ts | validate | ✅ | | | | areAPIKeysEnabled | ✅ | | | | grantAsInternalUser | ❌ | | | | create | ✅ | | serverless_search | x-pack/plugins/serverless_search/server/routes/api_key_routes.ts | create | ✅ | | | x-pack/plugins/transform/server/routes/api/reauthorize_transforms/route_handler_factory.ts | grantAsInternalUser | ❌ | | | x-pack/plugins/upgrade_assistant/server/lib/reindexing/credential_store.ts | grantAsInternalUser | ❌ | | | | invalidateAsInternalUser | ❌ | | | | areAPIKeysEnabled() | ✅ | </details> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

SiddharthMantri added 2 commits June 25, 2024 18:32

[Security-in-Core]initial work for exposing api keys service in core

083b1b4

move public security types to core-security-common

25f0509

kibanamachine and others added 2 commits June 25, 2024 19:44

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

3c0f0c8

…fix'

remove unused types

eb130eb

update jest test for api keys

99ba029

SiddharthMantri added 2 commits June 26, 2024 10:46

remove cyclical ts deps, update tsdocs partial

73dc2f0

update security plugin unit test

0b13f8d

kibanamachine and others added 2 commits June 26, 2024 09:15

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

d021ddd

…fix'

fix cyclical dependency on kibana/core

1987f8c

SiddharthMantri commented Jun 26, 2024

View reviewed changes

packages/core/security/core-security-common/src/roles/schema.ts Outdated Show resolved Hide resolved

SiddharthMantri commented Jun 26, 2024

View reviewed changes

packages/core/security/core-security-common/index.ts Outdated Show resolved Hide resolved

SiddharthMantri added 2 commits June 26, 2024 11:46

fix formatting

1042962

update delegate api test

7892ff2

SiddharthMantri changed the title ~~[Security in Core] Exposes apiKeys from core~~ [Security in Core] Exposes apiKeys from core.security.authc Jun 26, 2024

SiddharthMantri commented Jun 26, 2024

View reviewed changes

x-pack/plugins/security/server/build_delegate_apis.ts Outdated Show resolved Hide resolved

SiddharthMantri and others added 3 commits June 26, 2024 13:14

simplify api key type exports

471f939

update comments for public ts docs

5ac332d

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

0dfc26e

…fix'

fix types

10a38b6

SiddharthMantri marked this pull request as ready for review June 26, 2024 13:29

SiddharthMantri requested review from a team as code owners June 26, 2024 13:29

SiddharthMantri added Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! Feature:Users/Roles/API Keys labels Jun 26, 2024

SiddharthMantri and others added 10 commits June 27, 2024 17:57

remove typeguards

50c100f

fix types, update context to expose only contract we need

6b1235e

add reject when api disabled

087db06

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

06d897d

…fix'

Update api_keys_context.ts

b079606

Update api_keys.ts

51b5177

revert changes to api keys class constructor

7b2c26f

update type guard to use correct key

caddc90

Merge branch 'main' into security-in-core-api-keys

2f1915e

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

7435d87

…-fix'

kibanamachine added 2 commits June 29, 2024 21:33

Merge branch 'main' into security-in-core-api-keys

8fb77d3

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

df6e945

…fix'

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner June 29, 2024 11:45

elena-shostak self-assigned this Jul 1, 2024

elena-shostak approved these changes Jul 1, 2024

View reviewed changes

SiddharthMantri requested a review from pgayvallet July 1, 2024 14:31

use arrow functions instead of bind

1faeaa4

Merge branch 'main' into security-in-core-api-keys

6c85ea3

pgayvallet approved these changes Jul 9, 2024

View reviewed changes

Merge branch 'main' into security-in-core-api-keys

b65a666

SiddharthMantri removed the request for review from a team July 9, 2024 12:05

SiddharthMantri enabled auto-merge (squash) July 9, 2024 12:05

SiddharthMantri merged commit ff9a48e into elastic:main Jul 9, 2024
20 checks passed

kibanamachine added the v8.16.0 label Jul 9, 2024

gbamparop mentioned this pull request Jul 11, 2024

[Observability Onboarding] Use the apiKeys service from core security services #188076

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security in Core] Exposes `apiKeys` from `core.security.authc` #186910

[Security in Core] Exposes `apiKeys` from `core.security.authc` #186910

SiddharthMantri commented Jun 25, 2024 •

edited

Loading

SiddharthMantri commented Jun 25, 2024

SiddharthMantri commented Jun 25, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 29, 2024

elena-shostak left a comment

elena-shostak Jul 1, 2024

SiddharthMantri Jul 2, 2024

kibana-ci commented Jul 2, 2024

SiddharthMantri commented Jul 9, 2024

elasticmachine commented Jul 9, 2024

API count

[Security in Core] Exposes apiKeys from core.security.authc #186910

[Security in Core] Exposes apiKeys from core.security.authc #186910

Conversation

SiddharthMantri commented Jun 25, 2024 • edited Loading

Summary

Details

Plugins and the APIs that use the current apiKeys function from the security plugin

SiddharthMantri commented Jun 25, 2024

SiddharthMantri commented Jun 25, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 26, 2024

SiddharthMantri commented Jun 29, 2024

elena-shostak left a comment

Choose a reason for hiding this comment

elena-shostak Jul 1, 2024

Choose a reason for hiding this comment

SiddharthMantri Jul 2, 2024

Choose a reason for hiding this comment

kibana-ci commented Jul 2, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

History

SiddharthMantri commented Jul 9, 2024

elasticmachine commented Jul 9, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Any counts in public APIs

API count

History

[Security in Core] Exposes `apiKeys` from `core.security.authc` #186910

[Security in Core] Exposes `apiKeys` from `core.security.authc` #186910

SiddharthMantri commented Jun 25, 2024 •

edited

Loading

Plugins and the APIs that use the current `apiKeys` function from the security plugin