-
Notifications
You must be signed in to change notification settings - Fork 25.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
In the current implementation of API keys, to create/get/invalidate API keys one needs to be super user which limits the usage of API keys. We would want to have fine grained privileges rather than system wide privileges for using API keys. This commit adds: - `manage_api_key` cluster privilege which allows users to create, retrieve and invalidate **_any_** API keys in the system. This allows for limited access than `manage_security` or `all`. - `owner_manage_api_key` cluster privilege which allows user to create, retrieve and invalidate API keys owned by this user only. - `create_api_key` is a sub privilege which allows for user to create but not invalidate API keys. - an API key with no api key manage privilege can retrieve its own information Also introduces following rest APIs to manage owned API keys for a user: GET /_security/api_key/my DELETE /_security/api_key/my
- Loading branch information
Yogesh Gaikwad
committed
Apr 26, 2019
1 parent
29fefcf
commit 7625930
Showing
38 changed files
with
1,822 additions
and
205 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
73 changes: 73 additions & 0 deletions
73
...t/rest-high-level/src/main/java/org/elasticsearch/client/security/GetMyApiKeyRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.client.security; | ||
|
|
||
| import org.elasticsearch.client.Validatable; | ||
| import org.elasticsearch.common.Nullable; | ||
| import org.elasticsearch.common.xcontent.ToXContentObject; | ||
| import org.elasticsearch.common.xcontent.XContentBuilder; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * Request for retrieving information for API key(s) owned by the authenticated user. | ||
| */ | ||
| public final class GetMyApiKeyRequest implements Validatable, ToXContentObject { | ||
|
|
||
| private final String id; | ||
| private final String name; | ||
|
|
||
| public GetMyApiKeyRequest(@Nullable String apiKeyId, @Nullable String apiKeyName) { | ||
| this.id = apiKeyId; | ||
| this.name = apiKeyName; | ||
| } | ||
|
|
||
| public String getId() { | ||
| return id; | ||
| } | ||
|
|
||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| /** | ||
| * Creates request for given api key id | ||
| * @param apiKeyId api key id | ||
| * @return {@link GetMyApiKeyRequest} | ||
| */ | ||
| public static GetMyApiKeyRequest usingApiKeyId(String apiKeyId) { | ||
| return new GetMyApiKeyRequest(apiKeyId, null); | ||
| } | ||
|
|
||
| /** | ||
| * Creates request for given api key name | ||
| * @param apiKeyName api key name | ||
| * @return {@link GetMyApiKeyRequest} | ||
| */ | ||
| public static GetMyApiKeyRequest usingApiKeyName(String apiKeyName) { | ||
| return new GetMyApiKeyRequest(null, apiKeyName); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| return builder; | ||
| } | ||
|
|
||
| } |
79 changes: 79 additions & 0 deletions
79
...high-level/src/main/java/org/elasticsearch/client/security/InvalidateMyApiKeyRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.client.security; | ||
|
|
||
| import org.elasticsearch.client.Validatable; | ||
| import org.elasticsearch.common.Nullable; | ||
| import org.elasticsearch.common.xcontent.ToXContentObject; | ||
| import org.elasticsearch.common.xcontent.XContentBuilder; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * Request for invalidating API key(s) for the authenticated user so that it can no longer be used. | ||
| */ | ||
| public final class InvalidateMyApiKeyRequest implements Validatable, ToXContentObject { | ||
|
|
||
| private final String id; | ||
| private final String name; | ||
|
|
||
| public InvalidateMyApiKeyRequest(@Nullable String apiKeyId, @Nullable String apiKeyName) { | ||
| this.id = apiKeyId; | ||
| this.name = apiKeyName; | ||
| } | ||
|
|
||
| public String getId() { | ||
| return id; | ||
| } | ||
|
|
||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| /** | ||
| * Creates invalidate API key request for given api key id | ||
| * @param apiKeyId api key id | ||
| * @return {@link InvalidateMyApiKeyRequest} | ||
| */ | ||
| public static InvalidateMyApiKeyRequest usingApiKeyId(String apiKeyId) { | ||
| return new InvalidateMyApiKeyRequest(apiKeyId, null); | ||
| } | ||
|
|
||
| /** | ||
| * Creates invalidate API key request for given api key name | ||
| * @param apiKeyName api key name | ||
| * @return {@link InvalidateMyApiKeyRequest} | ||
| */ | ||
| public static InvalidateMyApiKeyRequest usingApiKeyName(String apiKeyName) { | ||
| return new InvalidateMyApiKeyRequest(null, apiKeyName); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| builder.startObject(); | ||
| if (id != null) { | ||
| builder.field("id", id); | ||
| } | ||
| if (name != null) { | ||
| builder.field("name", name); | ||
| } | ||
| return builder.endObject(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.