Package org.elasticsearch.xpack.security.authc.kerberos

Class KerberosRealm

java.lang.Object
org.elasticsearch.xpack.core.security.authc.Realm
org.elasticsearch.xpack.security.authc.kerberos.KerberosRealm
All Implemented Interfaces:
Comparable<org.elasticsearch.xpack.core.security.authc.Realm>, org.elasticsearch.xpack.core.security.authc.support.CachingRealm
public final class KerberosRealm extends org.elasticsearch.xpack.core.security.authc.Realm implements org.elasticsearch.xpack.core.security.authc.support.CachingRealm
This class provides support for Kerberos authentication using spnego mechanism.

It provides support to extract kerberos ticket using KerberosAuthenticationToken.extractToken(String) to build KerberosAuthenticationToken and then authenticating user when KerberosTicketValidator validates the ticket.

On successful authentication, it will build User object populated with roles and will return AuthenticationResult with user object. On authentication failure, it will return AuthenticationResult with status to terminate authentication process.

  • Nested Class Summary

    Nested classes/interfaces inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    org.elasticsearch.xpack.core.security.authc.Realm.Factory

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    KRB_METADATA_REALM_NAME_KEY
     
    static final String
    KRB_METADATA_UPN_KEY
     

    Fields inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    config, logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    KerberosRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig config, NativeRoleMappingStore nativeRoleMappingStore, org.elasticsearch.threadpool.ThreadPool threadPool)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)
     
    void
    expire(String username)
     
    void
    expireAll()
     
    Map<String,List<String>>
    getAuthenticationFailureHeaders()
     
    void
    initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms, org.elasticsearch.license.XPackLicenseState licenseState)
     
    void
    lookupUser(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)
     
    boolean
    supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)
     
    org.elasticsearch.xpack.core.security.authc.AuthenticationToken
    token(org.elasticsearch.common.util.concurrent.ThreadContext context)
     

    Methods inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    compareTo, domain, name, order, toString, type, usageStats

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface org.elasticsearch.xpack.core.security.authc.support.CachingRealm

    name

  • Field Details

  • Constructor Details

    • KerberosRealm

      public KerberosRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig config, NativeRoleMappingStore nativeRoleMappingStore, org.elasticsearch.threadpool.ThreadPool threadPool)

  • Method Details

    • initialize

      public void initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms, org.elasticsearch.license.XPackLicenseState licenseState)
      Overrides:
      initialize in class org.elasticsearch.xpack.core.security.authc.Realm

    • getAuthenticationFailureHeaders

      public Map<String,List<String>> getAuthenticationFailureHeaders()
      Overrides:
      getAuthenticationFailureHeaders in class org.elasticsearch.xpack.core.security.authc.Realm

    • expire

      public void expire(String username)
      Specified by:
      expire in interface org.elasticsearch.xpack.core.security.authc.support.CachingRealm

    • expireAll

      public void expireAll()
      Specified by:
      expireAll in interface org.elasticsearch.xpack.core.security.authc.support.CachingRealm

    • supports

      public boolean supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)
      Specified by:
      supports in class org.elasticsearch.xpack.core.security.authc.Realm

    • token

      public org.elasticsearch.xpack.core.security.authc.AuthenticationToken token(org.elasticsearch.common.util.concurrent.ThreadContext context)
      Specified by:
      token in class org.elasticsearch.xpack.core.security.authc.Realm

    • authenticate

      public void authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)
      Specified by:
      authenticate in class org.elasticsearch.xpack.core.security.authc.Realm

    • lookupUser

      public void lookupUser(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)
      Specified by:
      lookupUser in class org.elasticsearch.xpack.core.security.authc.Realm