Package org.elasticsearch.xpack.security.authc

Class ApiKeyService

java.lang.Object
org.elasticsearch.xpack.security.authc.ApiKeyService
public class ApiKeyService extends Object

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static final class 
    ApiKeyService.ApiKeyCredentials
     
    static final class 
    ApiKeyService.ApiKeyDoc
     
    static final class 
    ApiKeyService.CachedApiKeyDoc
    A cached version of the ApiKeyService.ApiKeyDoc.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final org.elasticsearch.common.settings.Setting<String>
    CACHE_HASH_ALGO_SETTING
     
    static final org.elasticsearch.common.settings.Setting<Integer>
    CACHE_MAX_KEYS_SETTING
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    CACHE_TTL_SETTING
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    DELETE_INTERVAL
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    DELETE_TIMEOUT
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    DOC_CACHE_TTL_SETTING
     
    static final org.elasticsearch.common.settings.Setting<String>
    PASSWORD_HASHING_ALGORITHM
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    ApiKeyService(org.elasticsearch.common.settings.Settings settings, Clock clock, org.elasticsearch.client.internal.Client client, SecurityIndexManager securityIndex, org.elasticsearch.cluster.service.ClusterService clusterService, CacheInvalidatorRegistry cacheInvalidatorRegistry, org.elasticsearch.threadpool.ThreadPool threadPool)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    createApiKey(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.action.apikey.CreateApiKeyRequest request, Set<org.elasticsearch.xpack.core.security.authz.RoleDescriptor> userRoles, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.CreateApiKeyResponse> listener)
    Asynchronously creates a new API key based off of the request and authentication
    org.elasticsearch.xpack.core.security.authc.Authentication
    createApiKeyAuthentication(org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User> authResult, String nodeName)
     
    void
    ensureEnabled()
     
    static Map<String,Object>
    getApiKeyMetadata(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
    If the authentication has type of api_key, returns the metadata associated to the API key.
    void
    getApiKeys(String realmName, String username, String apiKeyName, String apiKeyId, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.GetApiKeyResponse> listener)
    Get API key information for given realm, user, API key name and id combination
    static String
    getCreatorRealmName(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
    Returns realm name of the owner user of an API key if the effective user is an API Key.
    static String
    getCreatorRealmType(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
    Returns realm type of the owner user of an API key if the effective user is an API Key.
    void
    invalidateApiKeys(String realmName, String username, String apiKeyName, String[] apiKeyIds, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.InvalidateApiKeyResponse> invalidateListener)
    Invalidate API keys for given realm, user name, API key name and id.
    List<org.elasticsearch.xpack.core.security.authz.RoleDescriptor>
    parseRoleDescriptors(String apiKeyId, Map<String,Object> roleDescriptorsMap, org.elasticsearch.xpack.core.security.authz.store.RoleReference.ApiKeyRoleType roleType)
     
    List<org.elasticsearch.xpack.core.security.authz.RoleDescriptor>
    parseRoleDescriptorsBytes(String apiKeyId, org.elasticsearch.common.bytes.BytesReference bytesReference, org.elasticsearch.xpack.core.security.authz.store.RoleReference.ApiKeyRoleType roleType)
     
    void
    queryApiKeys(org.elasticsearch.action.search.SearchRequest searchRequest, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.QueryApiKeyResponse> listener)
     
    protected void
    verifyKeyAgainstHash(String apiKeyHash, ApiKeyService.ApiKeyCredentials credentials, org.elasticsearch.action.ActionListener<Boolean> listener)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • PASSWORD_HASHING_ALGORITHM

      public static final org.elasticsearch.common.settings.Setting<String> PASSWORD_HASHING_ALGORITHM

    • DELETE_TIMEOUT

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> DELETE_TIMEOUT

    • DELETE_INTERVAL

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> DELETE_INTERVAL

    • CACHE_HASH_ALGO_SETTING

      public static final org.elasticsearch.common.settings.Setting<String> CACHE_HASH_ALGO_SETTING

    • CACHE_TTL_SETTING

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> CACHE_TTL_SETTING

    • CACHE_MAX_KEYS_SETTING

      public static final org.elasticsearch.common.settings.Setting<Integer> CACHE_MAX_KEYS_SETTING

    • DOC_CACHE_TTL_SETTING

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> DOC_CACHE_TTL_SETTING

  • Constructor Details

    • ApiKeyService

      public ApiKeyService(org.elasticsearch.common.settings.Settings settings, Clock clock, org.elasticsearch.client.internal.Client client, SecurityIndexManager securityIndex, org.elasticsearch.cluster.service.ClusterService clusterService, CacheInvalidatorRegistry cacheInvalidatorRegistry, org.elasticsearch.threadpool.ThreadPool threadPool)

  • Method Details

    • createApiKey

      public void createApiKey(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.action.apikey.CreateApiKeyRequest request, Set<org.elasticsearch.xpack.core.security.authz.RoleDescriptor> userRoles, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.CreateApiKeyResponse> listener)
      Asynchronously creates a new API key based off of the request and authentication
      Parameters:
      authentication - the authentication that this api key should be based off of
      request - the request to create the api key included any permission restrictions
      userRoles - the user's actual roles that we always enforce
      listener - the listener that will be used to notify of completion

    • createApiKeyAuthentication

      public org.elasticsearch.xpack.core.security.authc.Authentication createApiKeyAuthentication(org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User> authResult, String nodeName)

    • parseRoleDescriptors

      public List<org.elasticsearch.xpack.core.security.authz.RoleDescriptor> parseRoleDescriptors(String apiKeyId, Map<String,Object> roleDescriptorsMap, org.elasticsearch.xpack.core.security.authz.store.RoleReference.ApiKeyRoleType roleType)

    • parseRoleDescriptorsBytes

      public List<org.elasticsearch.xpack.core.security.authz.RoleDescriptor> parseRoleDescriptorsBytes(String apiKeyId, org.elasticsearch.common.bytes.BytesReference bytesReference, org.elasticsearch.xpack.core.security.authz.store.RoleReference.ApiKeyRoleType roleType)

    • verifyKeyAgainstHash

      protected void verifyKeyAgainstHash(String apiKeyHash, ApiKeyService.ApiKeyCredentials credentials, org.elasticsearch.action.ActionListener<Boolean> listener)

    • ensureEnabled

      public void ensureEnabled()

    • invalidateApiKeys

      public void invalidateApiKeys(String realmName, String username, String apiKeyName, String[] apiKeyIds, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.InvalidateApiKeyResponse> invalidateListener)
      Invalidate API keys for given realm, user name, API key name and id.
      Parameters:
      realmName - realm name
      username - user name
      apiKeyName - API key name
      apiKeyIds - API key id
      invalidateListener - listener for InvalidateApiKeyResponse

    • getApiKeys

      public void getApiKeys(String realmName, String username, String apiKeyName, String apiKeyId, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.GetApiKeyResponse> listener)
      Get API key information for given realm, user, API key name and id combination
      Parameters:
      realmName - realm name
      username - user name
      apiKeyName - API key name
      apiKeyId - API key id
      listener - listener for GetApiKeyResponse

    • queryApiKeys

      public void queryApiKeys(org.elasticsearch.action.search.SearchRequest searchRequest, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.action.apikey.QueryApiKeyResponse> listener)

    • getCreatorRealmName

      public static String getCreatorRealmName(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
      Returns realm name of the owner user of an API key if the effective user is an API Key. If the effective user is not an API key, it just returns the source realm name.
      Parameters:
      authentication - Authentication
      Returns:
      realm name

    • getCreatorRealmType

      public static String getCreatorRealmType(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
      Returns realm type of the owner user of an API key if the effective user is an API Key. If the effective user is not an API key, it just returns the source realm type.
      Parameters:
      authentication - Authentication
      Returns:
      realm type

    • getApiKeyMetadata

      public static Map<String,Object> getApiKeyMetadata(org.elasticsearch.xpack.core.security.authc.Authentication authentication)
      If the authentication has type of api_key, returns the metadata associated to the API key.
      Parameters:
      authentication - Authentication
      Returns:
      A map for the metadata or an empty map if no metadata is found.