Description
We are considering to extend Elasticsearch API keys in order to support internal requirements by other teams, and avoid building new features that would increase complexity and maintenance costs.
The current implementation is a good starting point, but hits its limits in complex scenarios where those keys are used in a more sophisticated authentication flow.
At the moment, the solution is to build an external logic around keys, or reimplement an independent similar feature.
Proposal
One thing that could be very useful is to allow custom arbitrary metadata to be attached to an API key during the creation action. This is totally transparent to Elasticsearch, that has no knowledge of the meaning (and format) of the metadata, and doesn't perform any action on it.
An example of metadata could be the scope of the key, a description, or a cryptographic signature.
This implies that metadata can be passed to the Create API key call, stored as an attribute of the newly generated key, and then returned by the Get API key.
Each user can define the metadata, and build some logic around it.
Related Kibana issue: elastic/kibana#93820
Description
We are considering to extend Elasticsearch API keys in order to support internal requirements by other teams, and avoid building new features that would increase complexity and maintenance costs.
The current implementation is a good starting point, but hits its limits in complex scenarios where those keys are used in a more sophisticated authentication flow.
At the moment, the solution is to build an external logic around keys, or reimplement an independent similar feature.
Proposal
One thing that could be very useful is to allow custom arbitrary metadata to be attached to an API key during the creation action. This is totally transparent to Elasticsearch, that has no knowledge of the meaning (and format) of the metadata, and doesn't perform any action on it.
An example of metadata could be the scope of the key, a description, or a cryptographic signature.
This implies that metadata can be passed to the Create API key call, stored as an attribute of the newly generated key, and then returned by the Get API key.
Each user can define the metadata, and build some logic around it.
Related Kibana issue: elastic/kibana#93820