mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-08 14:05:27 +00:00
fe36861ada
X-Pack security supports built-in authentication service `token-service` that allows access tokens to be used to access Elasticsearch without using Basic authentication. The tokens are generated by `token-service` based on OAuth2 spec. The access token is a short-lived token (defaults to 20m) and refresh token with a lifetime of 24 hours, making them unsuitable for long-lived or recurring tasks where the system might go offline thereby failing refresh of tokens. This commit introduces a built-in authentication service `api-key-service` that adds support for long-lived tokens aka API keys to access Elasticsearch. The `api-key-service` is consulted after `token-service` in the authentication chain. By default, if TLS is enabled then `api-key-service` is also enabled. The service can be disabled using the configuration setting. The API keys:- - by default do not have an expiration but expiration can be configured where the API keys need to be expired after a certain amount of time. - when generated will keep authentication information of the user that generated them. - can be defined with a role describing the privileges for accessing Elasticsearch and will be limited by the role of the user that generated them - can be invalidated via invalidation API - information can be retrieved via a get API - that have been expired or invalidated will be retained for 1 week before being deleted. The expired API keys remover task handles this. Following are the API key management APIs:- 1. Create API Key - `PUT/POST /_security/api_key` 2. Get API key(s) - `GET /_security/api_key` 3. Invalidate API Key(s) `DELETE /_security/api_key` The API keys can be used to access Elasticsearch using `Authorization` header, where the auth scheme is `ApiKey` and the credentials, is the base64 encoding of API key Id and API key separated by a colon. Example:- ``` curl -H "Authorization: ApiKey YXBpLWtleS1pZDphcGkta2V5" http://localhost:9200/_cluster/health ``` Closes #34383
75 lines
2.6 KiB
Plaintext
75 lines
2.6 KiB
Plaintext
--
|
|
:api: invalidate-api-key
|
|
:request: InvalidateApiKeyRequest
|
|
:response: InvalidateApiKeyResponse
|
|
--
|
|
|
|
[id="{upid}-{api}"]
|
|
=== Invalidate API Key API
|
|
|
|
API Key(s) can be invalidated using this API.
|
|
|
|
[id="{upid}-{api}-request"]
|
|
==== Invalidate API Key Request
|
|
The +{request}+ supports invalidating
|
|
|
|
. A specific API key
|
|
|
|
. All API keys for a specific realm
|
|
|
|
. All API keys for a specific user
|
|
|
|
. All API keys for a specific user in a specific realm
|
|
|
|
===== Specific API key by API key id
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-api-key-id-request]
|
|
--------------------------------------------------
|
|
|
|
===== Specific API key by API key name
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-api-key-name-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API keys for realm
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-realm-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API keys for user
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-user-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API key for user in realm
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-user-realm-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
include::../execution.asciidoc[]
|
|
|
|
[id="{upid}-{api}-response"]
|
|
==== Invalidate API Key Response
|
|
|
|
The returned +{response}+ contains the information regarding the API keys that the request
|
|
invalidated.
|
|
|
|
`invalidatedApiKeys`:: Available using `getInvalidatedApiKeys` lists the API keys
|
|
that this request invalidated.
|
|
|
|
`previouslyInvalidatedApiKeys`:: Available using `getPreviouslyInvalidatedApiKeys` lists the API keys
|
|
that this request attempted to invalidate
|
|
but were already invalid.
|
|
|
|
`errors`:: Available using `getErrors` contains possible errors that were encountered while
|
|
attempting to invalidate API keys.
|
|
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[{api}-response]
|
|
-------------------------------------------------- |