Package org.elasticsearch.xpack.security.authc.oidc

Class OpenIdConnectRealm

java.lang.Object
org.elasticsearch.xpack.core.security.authc.Realm
org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectRealm
All Implemented Interfaces:
Closeable, AutoCloseable, Comparable<org.elasticsearch.xpack.core.security.authc.Realm>, org.elasticsearch.core.Releasable
public class OpenIdConnectRealm extends org.elasticsearch.xpack.core.security.authc.Realm implements org.elasticsearch.core.Releasable

  • Nested Class Summary

    Nested classes/interfaces inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    org.elasticsearch.xpack.core.security.authc.Realm.Factory

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    CONTEXT_TOKEN_DATA
     

    Fields inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    config, logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    OpenIdConnectRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig config, org.elasticsearch.xpack.core.ssl.SSLService sslService, org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper roleMapper, org.elasticsearch.watcher.ResourceWatcherService watcherService)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)
     
    org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectPrepareAuthenticationResponse
    buildAuthenticationRequestUri(String existingState, String existingNonce, String loginHint)
    Creates the URI for an OIDC Authentication Request from the realm configuration using URI Query String Serialization and possibly generates a state parameter and a nonce.
    org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutResponse
    buildLogoutResponse(com.nimbusds.jwt.JWT idTokenHint)
     
    void
    close()
     
    void
    initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms, org.elasticsearch.license.XPackLicenseState licenseState)
     
    boolean
    isIssuerValid(String issuer)
     
    void
    lookupUser(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)
     
    boolean
    supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)
     
    org.elasticsearch.xpack.core.security.authc.AuthenticationToken
    token(org.elasticsearch.common.util.concurrent.ThreadContext context)
     

    Methods inherited from class org.elasticsearch.xpack.core.security.authc.Realm

    compareTo, domain, getAuthenticationFailureHeaders, name, order, toString, type, usageStats

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Field Details

  • Constructor Details

    • OpenIdConnectRealm

      public OpenIdConnectRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig config, org.elasticsearch.xpack.core.ssl.SSLService sslService, org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper roleMapper, org.elasticsearch.watcher.ResourceWatcherService watcherService)

  • Method Details

    • initialize

      public void initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms, org.elasticsearch.license.XPackLicenseState licenseState)
      Overrides:
      initialize in class org.elasticsearch.xpack.core.security.authc.Realm

    • supports

      public boolean supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)
      Specified by:
      supports in class org.elasticsearch.xpack.core.security.authc.Realm

    • token

      public org.elasticsearch.xpack.core.security.authc.AuthenticationToken token(org.elasticsearch.common.util.concurrent.ThreadContext context)
      Specified by:
      token in class org.elasticsearch.xpack.core.security.authc.Realm

    • authenticate

      public void authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)
      Specified by:
      authenticate in class org.elasticsearch.xpack.core.security.authc.Realm

    • lookupUser

      public void lookupUser(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)
      Specified by:
      lookupUser in class org.elasticsearch.xpack.core.security.authc.Realm

    • buildAuthenticationRequestUri

      public org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectPrepareAuthenticationResponse buildAuthenticationRequestUri(@Nullable String existingState, @Nullable String existingNonce, @Nullable String loginHint)
      Creates the URI for an OIDC Authentication Request from the realm configuration using URI Query String Serialization and possibly generates a state parameter and a nonce. It then returns the URI, state and nonce encapsulated in a OpenIdConnectPrepareAuthenticationResponse. A facilitator can provide a state and a nonce parameter in two cases:
      • In case of Kibana, it allows for a better UX by ensuring that all requests to an OpenID Connect Provider within the same browser context (even across tabs) will use the same state and nonce values.
      • In case of custom facilitators, the implementer might require/support generating the state parameter in order to tie this to an anti-XSRF token.
      Parameters:
      existingState - An existing state that can be reused or null if we need to generate one
      existingNonce - An existing nonce that can be reused or null if we need to generate one
      loginHint - A String with a login hint to add to the authentication request in case of a 3rd party initiated login
      Returns:
      an OpenIdConnectPrepareAuthenticationResponse

    • isIssuerValid

      public boolean isIssuerValid(String issuer)

    • buildLogoutResponse

      public org.elasticsearch.xpack.core.security.action.oidc.OpenIdConnectLogoutResponse buildLogoutResponse(com.nimbusds.jwt.JWT idTokenHint)

    • close

      public void close()
      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable
      Specified by:
      close in interface org.elasticsearch.core.Releasable