mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-14 17:05:36 +00:00
7b6246ec67
The existing privilege model for API keys with privileges like `manage_api_key`, `manage_security` etc. are too permissive and we would want finer-grained control over the cluster privileges for API keys. Previously APIs created would also need these privileges to get its own information. This commit adds support for `manage_own_api_key` cluster privilege which only allows api key cluster actions on API keys owned by the currently authenticated user. Also adds support for retrieval of the API key self-information when authenticating via API key without the need for the additional API key privileges. To support this privilege, we are introducing additional authentication context along with the request context such that it can be used to authorize cluster actions based on the current user authentication. The API key get and invalidate APIs introduce an `owner` flag that can be set to true if the API key request (Get or Invalidate) is for the API keys owned by the currently authenticated user only. In that case, `realm` and `username` cannot be set as they are assumed to be the currently authenticated ones. The changes cover HLRC changes, documentation for the API changes. Closes #40031
83 lines
3.0 KiB
Plaintext
83 lines
3.0 KiB
Plaintext
--
|
|
:api: invalidate-api-key
|
|
:request: InvalidateApiKeyRequest
|
|
:response: InvalidateApiKeyResponse
|
|
--
|
|
|
|
[id="{upid}-{api}"]
|
|
=== Invalidate API Key API
|
|
|
|
API Key(s) can be invalidated using this API.
|
|
|
|
[id="{upid}-{api}-request"]
|
|
==== Invalidate API Key Request
|
|
The +{request}+ supports invalidating
|
|
|
|
. A specific API key
|
|
|
|
. All API keys for a specific realm
|
|
|
|
. All API keys for a specific user
|
|
|
|
. All API keys for a specific user in a specific realm
|
|
|
|
. A specific key or all API keys owned by the current authenticated user
|
|
|
|
===== Specific API key by API key id
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-api-key-id-request]
|
|
--------------------------------------------------
|
|
|
|
===== Specific API key by API key name
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-api-key-name-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API keys for realm
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-realm-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API keys for user
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-user-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
===== All API key for user in realm
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-user-realm-api-keys-request]
|
|
--------------------------------------------------
|
|
|
|
===== Retrieve all API keys for the current authenticated user
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[invalidate-api-keys-owned-by-authenticated-user-request]
|
|
--------------------------------------------------
|
|
|
|
include::../execution.asciidoc[]
|
|
|
|
[id="{upid}-{api}-response"]
|
|
==== Invalidate API Key Response
|
|
|
|
The returned +{response}+ contains the information regarding the API keys that the request
|
|
invalidated.
|
|
|
|
`invalidatedApiKeys`:: Available using `getInvalidatedApiKeys` lists the API keys
|
|
that this request invalidated.
|
|
|
|
`previouslyInvalidatedApiKeys`:: Available using `getPreviouslyInvalidatedApiKeys` lists the API keys
|
|
that this request attempted to invalidate
|
|
but were already invalid.
|
|
|
|
`errors`:: Available using `getErrors` contains possible errors that were encountered while
|
|
attempting to invalidate API keys.
|
|
|
|
["source","java",subs="attributes,callouts,macros"]
|
|
--------------------------------------------------
|
|
include-tagged::{doc-tests-file}[{api}-response]
|
|
-------------------------------------------------- |