Package org.elasticsearch.xpack.security.authc.support

Class DelegatedAuthorizationSupport

java.lang.Object
org.elasticsearch.xpack.security.authc.support.DelegatedAuthorizationSupport
public class DelegatedAuthorizationSupport extends Object
Utility class for supporting "delegated authorization" (aka "authorization_realms", aka "lookup realms"). A Realm may support delegating authorization to another realm. It does this by registering a setting for DelegatedAuthorizationSettings.AUTHZ_REALMS, and constructing an instance of this class. Then, after the realm has performed any authentication steps, if hasDelegation() is true, it delegates the construction of the User object and AuthenticationResult to resolve(String, ActionListener).

  • Constructor Summary

    Constructors
    Modifier
    Constructor
    Description
    protected
    DelegatedAuthorizationSupport(Iterable<? extends org.elasticsearch.xpack.core.security.authc.Realm> allRealms, List<String> lookupRealms, org.elasticsearch.common.settings.Settings settings, org.elasticsearch.common.util.concurrent.ThreadContext threadContext, org.elasticsearch.license.XPackLicenseState licenseState)
    Constructs a new object that delegates to the named realms (lookupRealms), which must exist within allRealms.
     
    DelegatedAuthorizationSupport(Iterable<? extends org.elasticsearch.xpack.core.security.authc.Realm> allRealms, org.elasticsearch.xpack.core.security.authc.RealmConfig config, org.elasticsearch.license.XPackLicenseState licenseState)
    Resolves the DelegatedAuthorizationSettings.AUTHZ_REALMS setting from config and calls DelegatedAuthorizationSupport(Iterable, List, Settings, ThreadContext, XPackLicenseState)

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    hasDelegation()
    Are there any realms configured for delegated lookup
    void
    resolve(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> resultListener)
    Attempts to find the user specified by username in one of the delegated realms.
    String
    toString()
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Constructor Details

    • DelegatedAuthorizationSupport

      public DelegatedAuthorizationSupport(Iterable<? extends org.elasticsearch.xpack.core.security.authc.Realm> allRealms, org.elasticsearch.xpack.core.security.authc.RealmConfig config, org.elasticsearch.license.XPackLicenseState licenseState)
      Resolves the DelegatedAuthorizationSettings.AUTHZ_REALMS setting from config and calls DelegatedAuthorizationSupport(Iterable, List, Settings, ThreadContext, XPackLicenseState)

    • DelegatedAuthorizationSupport

      protected DelegatedAuthorizationSupport(Iterable<? extends org.elasticsearch.xpack.core.security.authc.Realm> allRealms, List<String> lookupRealms, org.elasticsearch.common.settings.Settings settings, org.elasticsearch.common.util.concurrent.ThreadContext threadContext, org.elasticsearch.license.XPackLicenseState licenseState)
      Constructs a new object that delegates to the named realms (lookupRealms), which must exist within allRealms.
      Throws:
      IllegalArgumentException - if one of the specified realms does not exist

  • Method Details

    • hasDelegation

      public boolean hasDelegation()
      Are there any realms configured for delegated lookup

    • resolve

      public void resolve(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> resultListener)
      Attempts to find the user specified by username in one of the delegated realms. The realms are searched in the order specified during construction. Returns a successful result if a User was found, otherwise returns an unsuccessful result with a meaningful diagnostic message.

    • toString

      public String toString()
      Overrides:
      toString in class Object