Package org.elasticsearch.xpack.security.operator

Class OperatorPrivileges.DefaultOperatorPrivilegesService

java.lang.Object
org.elasticsearch.xpack.security.operator.OperatorPrivileges.DefaultOperatorPrivilegesService
All Implemented Interfaces:
OperatorPrivileges.OperatorPrivilegesService
Enclosing class:
OperatorPrivileges
public static final class OperatorPrivileges.DefaultOperatorPrivilegesService extends Object implements OperatorPrivileges.OperatorPrivilegesService

  • Constructor Summary

    Constructors
    Constructor
    Description
    DefaultOperatorPrivilegesService(org.elasticsearch.license.XPackLicenseState licenseState, FileOperatorUsersStore fileOperatorUsersStore, OperatorOnlyRegistry operatorOnlyRegistry)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    org.elasticsearch.ElasticsearchSecurityException
    check(org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest request, org.elasticsearch.common.util.concurrent.ThreadContext threadContext)
    Check whether the user is an operator and whether the request is an operator-only.
    void
    maybeInterceptRequest(org.elasticsearch.common.util.concurrent.ThreadContext threadContext, org.elasticsearch.transport.TransportRequest request)
    When operator privileges are enabled, certain requests needs to be configured in a specific way so that they respect operator only settings.
    void
    maybeMarkOperatorUser(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.common.util.concurrent.ThreadContext threadContext)
    Set a ThreadContext Header AuthenticationField.PRIVILEGE_CATEGORY_KEY if authentication is an operator user.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • DefaultOperatorPrivilegesService

      public DefaultOperatorPrivilegesService(org.elasticsearch.license.XPackLicenseState licenseState, FileOperatorUsersStore fileOperatorUsersStore, OperatorOnlyRegistry operatorOnlyRegistry)

  • Method Details

    • maybeMarkOperatorUser

      public void maybeMarkOperatorUser(org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.common.util.concurrent.ThreadContext threadContext)
      Description copied from interface: OperatorPrivileges.OperatorPrivilegesService
      Set a ThreadContext Header AuthenticationField.PRIVILEGE_CATEGORY_KEY if authentication is an operator user.
      Specified by:
      maybeMarkOperatorUser in interface OperatorPrivileges.OperatorPrivilegesService

    • check

      public org.elasticsearch.ElasticsearchSecurityException check(org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest request, org.elasticsearch.common.util.concurrent.ThreadContext threadContext)
      Description copied from interface: OperatorPrivileges.OperatorPrivilegesService
      Check whether the user is an operator and whether the request is an operator-only.
      Specified by:
      check in interface OperatorPrivileges.OperatorPrivilegesService
      Returns:
      An exception if user is an non-operator and the request is operator-only. Otherwise returns null.

    • maybeInterceptRequest

      public void maybeInterceptRequest(org.elasticsearch.common.util.concurrent.ThreadContext threadContext, org.elasticsearch.transport.TransportRequest request)
      Description copied from interface: OperatorPrivileges.OperatorPrivilegesService
      When operator privileges are enabled, certain requests needs to be configured in a specific way so that they respect operator only settings. For an example, the restore snapshot request should not restore operator only states from the snapshot. This method is where that requests are configured when necessary.
      Specified by:
      maybeInterceptRequest in interface OperatorPrivileges.OperatorPrivilegesService