Package org.elasticsearch.xpack.security.authc

Class TokenService

java.lang.Object
org.elasticsearch.xpack.security.authc.TokenService
public final class TokenService extends Object
Service responsible for the creation, validation, and other management of UserToken objects for authentication

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static final class 
    TokenService.CreateTokenResult
     

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    DELETE_INTERVAL
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    DELETE_TIMEOUT
     
    static final int
    MINIMUM_BASE64_BYTES
     
    static final String
    THREAD_POOL_NAME
     
    static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue>
    TOKEN_EXPIRATION
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    TokenService(org.elasticsearch.common.settings.Settings settings, Clock clock, org.elasticsearch.client.internal.Client client, org.elasticsearch.license.XPackLicenseState licenseState, org.elasticsearch.xpack.core.security.SecurityContext securityContext, SecurityIndexManager securityMainIndex, SecurityIndexManager securityTokensIndex, org.elasticsearch.cluster.service.ClusterService clusterService)
    Creates a new token service

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    authenticateToken(org.elasticsearch.common.settings.SecureString tokenString, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.Authentication> listener)
    Decodes the provided token, and validates it (for format, expiry and invalidation).
    void
    createOAuth2Tokens(String accessToken, String refreshToken, org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.authc.Authentication originatingClientAuth, Map<String,Object> metadata, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
    Creates an access token and optionally a refresh token as well from predefined values, based on the provided authentication and metadata.
    void
    createOAuth2Tokens(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.authc.Authentication originatingClientAuth, Map<String,Object> metadata, boolean includeRefreshToken, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
    Creates an access token and optionally a refresh token as well, based on the provided authentication and metadata with auto-generated values.
    void
    findActiveTokensForRealm(String realmName, Predicate<Map<String,Object>> filter, org.elasticsearch.action.ActionListener<Collection<org.elasticsearch.core.Tuple<UserToken,String>>> listener)
    Find stored refresh and access tokens that have not been invalidated or expired, and were issued against the specified realm.
    void
    findActiveTokensForUser(String username, org.elasticsearch.action.ActionListener<Collection<org.elasticsearch.core.Tuple<UserToken,String>>> listener)
    Find stored refresh and access tokens that have not been invalidated or expired, and were issued for the specified user.
    void
    getAuthenticationAndMetadata(String token, org.elasticsearch.action.ActionListener<org.elasticsearch.core.Tuple<org.elasticsearch.xpack.core.security.authc.Authentication,Map<String,Object>>> listener)
    Reads the authentication and metadata from the given token.
    org.elasticsearch.core.TimeValue
    getExpirationDelay()
     
    org.elasticsearch.xpack.core.security.authc.TokenMetadata
    getTokenMetadata()
    Returns the current in-use metdata of this TokenService
    static String
    hashTokenString(String accessTokenString)
    Hashes an access or refresh token String so that it can safely be persisted in the index.
    void
    invalidateAccessToken(String accessToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
    This method performs the steps necessary to invalidate an access token so that it may no longer be used.
    void
    invalidateAccessToken(UserToken userToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
    This method performs the steps necessary to invalidate a token so that it may no longer be used.
    void
    invalidateActiveTokensForRealmAndUser(String realmName, String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
    Invalidates all access tokens and all refresh tokens of a given realmName and/or of a given username so that they may no longer be used
    void
    invalidateRefreshToken(String refreshToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
    This method invalidates a refresh token so that it may no longer be used.
    static Boolean
    isTokenServiceEnabled(org.elasticsearch.common.settings.Settings settings)
     
    static String
    prependVersionAndEncodeRefreshToken(org.elasticsearch.Version version, String payload)
     
    void
    refreshToken(String refreshToken, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
    Called by the transport action in order to start the process of refreshing a token.
    static org.elasticsearch.core.Tuple<org.elasticsearch.Version,String>
    unpackVersionAndPayload(String encodedPack)
    Unpacks a base64 encoded pair of a version tag and String payload.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • THREAD_POOL_NAME

      public static final String THREAD_POOL_NAME
      See Also:

    • TOKEN_EXPIRATION

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> TOKEN_EXPIRATION

    • DELETE_INTERVAL

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> DELETE_INTERVAL

    • DELETE_TIMEOUT

      public static final org.elasticsearch.common.settings.Setting<org.elasticsearch.core.TimeValue> DELETE_TIMEOUT

    • MINIMUM_BASE64_BYTES

      public static final int MINIMUM_BASE64_BYTES

  • Constructor Details

    • TokenService

      public TokenService(org.elasticsearch.common.settings.Settings settings, Clock clock, org.elasticsearch.client.internal.Client client, org.elasticsearch.license.XPackLicenseState licenseState, org.elasticsearch.xpack.core.security.SecurityContext securityContext, SecurityIndexManager securityMainIndex, SecurityIndexManager securityTokensIndex, org.elasticsearch.cluster.service.ClusterService clusterService) throws GeneralSecurityException
      Creates a new token service
      Throws:
      GeneralSecurityException

  • Method Details

    • createOAuth2Tokens

      public void createOAuth2Tokens(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.authc.Authentication originatingClientAuth, Map<String,Object> metadata, boolean includeRefreshToken, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
      Creates an access token and optionally a refresh token as well, based on the provided authentication and metadata with auto-generated values. The created tokens are stored in the security index for versions up to VERSION_TOKENS_INDEX_INTRODUCED and to a specific security tokens index for later versions.

    • createOAuth2Tokens

      public void createOAuth2Tokens(String accessToken, String refreshToken, org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.xpack.core.security.authc.Authentication originatingClientAuth, Map<String,Object> metadata, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
      Creates an access token and optionally a refresh token as well from predefined values, based on the provided authentication and metadata. The created tokens are stored in the security index for versions up to VERSION_TOKENS_INDEX_INTRODUCED and to a specific security tokens index for later versions.

    • hashTokenString

      public static String hashTokenString(String accessTokenString)
      Hashes an access or refresh token String so that it can safely be persisted in the index. We don't salt the values as these are v4 UUIDs that have enough entropy by themselves.

    • authenticateToken

      public void authenticateToken(org.elasticsearch.common.settings.SecureString tokenString, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.Authentication> listener)
      Decodes the provided token, and validates it (for format, expiry and invalidation). If valid, the token's Authentication (see UserToken.getAuthentication() is provided to the listener. If the token is invalid (expired etc), then ActionListener.onFailure(Exception) will be called. If tokens are not enabled, or the token does not exist, ActionListener.onResponse(Response) will be called with a null authentication object.

    • getAuthenticationAndMetadata

      public void getAuthenticationAndMetadata(String token, org.elasticsearch.action.ActionListener<org.elasticsearch.core.Tuple<org.elasticsearch.xpack.core.security.authc.Authentication,Map<String,Object>>> listener)
      Reads the authentication and metadata from the given token. This method does not validate whether the token is expired or not.

    • invalidateAccessToken

      public void invalidateAccessToken(String accessToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
      This method performs the steps necessary to invalidate an access token so that it may no longer be used. The process of invalidation involves performing an update to the token document and setting the access_token.invalidated field to true

    • invalidateAccessToken

      public void invalidateAccessToken(UserToken userToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
      This method performs the steps necessary to invalidate a token so that it may no longer be used.

    • invalidateRefreshToken

      public void invalidateRefreshToken(String refreshToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
      This method invalidates a refresh token so that it may no longer be used. Invalidation involves performing an update to the token document and setting the refresh_token.invalidated field to true
      Parameters:
      refreshToken - The string representation of the refresh token
      listener - the listener to notify upon completion

    • invalidateActiveTokensForRealmAndUser

      public void invalidateActiveTokensForRealmAndUser(@Nullable String realmName, @Nullable String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult> listener)
      Invalidates all access tokens and all refresh tokens of a given realmName and/or of a given username so that they may no longer be used
      Parameters:
      realmName - the realm of which the tokens should be invalidated
      username - the username for which the tokens should be invalidated
      listener - the listener to notify upon completion

    • refreshToken

      public void refreshToken(String refreshToken, org.elasticsearch.action.ActionListener<TokenService.CreateTokenResult> listener)
      Called by the transport action in order to start the process of refreshing a token.
      Parameters:
      refreshToken - The refresh token as provided by the client
      listener - The listener to call upon completion with a TokenService.CreateTokenResult containing the serialized access token, serialized refresh token and authentication for which the token is created as these will be returned to the client

    • isTokenServiceEnabled

      public static Boolean isTokenServiceEnabled(org.elasticsearch.common.settings.Settings settings)

    • findActiveTokensForRealm

      public void findActiveTokensForRealm(String realmName, @Nullable Predicate<Map<String,Object>> filter, org.elasticsearch.action.ActionListener<Collection<org.elasticsearch.core.Tuple<UserToken,String>>> listener)
      Find stored refresh and access tokens that have not been invalidated or expired, and were issued against the specified realm.
      Parameters:
      realmName - The name of the realm for which to get the tokens
      filter - an optional Predicate to test the source of the found documents against
      listener - The listener to notify upon completion

    • findActiveTokensForUser

      public void findActiveTokensForUser(String username, org.elasticsearch.action.ActionListener<Collection<org.elasticsearch.core.Tuple<UserToken,String>>> listener)
      Find stored refresh and access tokens that have not been invalidated or expired, and were issued for the specified user.
      Parameters:
      username - The user for which to get the tokens
      listener - The listener to notify upon completion

    • getExpirationDelay

      public org.elasticsearch.core.TimeValue getExpirationDelay()

    • prependVersionAndEncodeRefreshToken

      public static String prependVersionAndEncodeRefreshToken(org.elasticsearch.Version version, String payload)

    • unpackVersionAndPayload

      public static org.elasticsearch.core.Tuple<org.elasticsearch.Version,String> unpackVersionAndPayload(String encodedPack) throws IOException
      Unpacks a base64 encoded pair of a version tag and String payload.
      Throws:
      IOException

    • getTokenMetadata

      public org.elasticsearch.xpack.core.security.authc.TokenMetadata getTokenMetadata()
      Returns the current in-use metdata of this TokenService