Skip to content

Adding authc.areAPIKeysEnabled which uses _xpack/usage#55255

Closed
kobelb wants to merge 4 commits intoelastic:masterfrom
kobelb:are-api-keys-enabled
Closed

Adding authc.areAPIKeysEnabled which uses _xpack/usage#55255
kobelb wants to merge 4 commits intoelastic:masterfrom
kobelb:are-api-keys-enabled

Conversation

@kobelb
Copy link
Copy Markdown
Contributor

@kobelb kobelb commented Jan 17, 2020

Previously, this was being done within the /internal/security/api_key/privileges route by checking the error that was throw by trying to get all API keys. @nchaulet requested that we expose this functionality, and @legrego brought up using the _xpack/usage API to make this determination. The rest is history 📖

@kobelb kobelb requested a review from a team as a code owner January 17, 2020 23:50
@kobelb kobelb added release_note:skip Skip the PR/issue when compiling release notes v8.0.0 v7.7.0 labels Jan 17, 2020
@nchaulet
Copy link
Copy Markdown
Member

Thanks for the quick PR :)

Copy link
Copy Markdown
Member

@nchaulet nchaulet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Look goods to me 👍

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Jan 24, 2020

@elasticmachine merge upstream

@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@azasypkin
Copy link
Copy Markdown
Contributor

ACK: reviewing...

@azasypkin azasypkin self-requested a review January 27, 2020 10:33
Copy link
Copy Markdown
Contributor

@azasypkin azasypkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

if (hasPrivilegesImpl) {
mockScopedClusterClient.callAsCurrentUser.mockImplementationOnce(hasPrivilegesImpl);
}
if (areAPIKeysEnabledImpl) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

optional nit: new line between if's

return result;
}

async areEnabled(): Promise<boolean> {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I believe : Promise<boolean> isn't necessary and should be automatically inferred

path: '/_xpack/usage',
});

return result.security?.api_key_service?.enabled === true;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note: the only thing that worries me a bit here is that we don't have a proper ES documentation on the format of this response and it's not clear what BWC guarantees this API has. If format changes this line will "silently" start always returning false.

Ideally I'd have an API integration test (e.g. via plugin-fixture that depends on security plugin, luckily we can have NP plugin fixtures now), but it seems we don't have any integration tests for the API keys functionality so it's not a blocker for this PR, up to you.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a great point, let me add API integrations tests specifically for this.

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Jan 29, 2020

I spoke to @tvernum about this, and relying upon _xpack/usage isn't exactly what we want. This relies upon the master node, and what we really want is to determine whether or not the coordinating node we're speaking to has API Keys enabled or not.

@nchaulet the other options we're exploring rely on parsing the response correctly from calling one of the API Key APIs, can you make this work with your use-case?

@tvernum
Copy link
Copy Markdown
Contributor

tvernum commented Jan 29, 2020

Would a status code of 503 (SERVICE UNAVAILABLE) for the GET endpoint be of help?
I think we could do that easily enough.

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Jan 29, 2020

Would a status code of 503 (SERVICE UNAVAILABLE) for the GET endpoint be of help?
I think we could do that easily enough.

I definitely think that'd help. We'd likely still have to do some parsing on the response body itself to ensure we don't mistake a 503 being caused by something else, for example a mis-configured reverse-proxy between Kibana and Elasticsearch.

@tvernum
Copy link
Copy Markdown
Contributor

tvernum commented Jan 29, 2020

to ensure we don't mistake a 503 being caused by something else, for example a mis-configured reverse-proxy

The ES JSON response includes the status, so you could easily check that the body status code and the HTTP status code were aligned.

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Jan 29, 2020

The ES JSON response includes the status, so you could easily check that the body status code and the HTTP status code were aligned.

That'd work beautifully then :)

@nchaulet
Copy link
Copy Markdown
Member

nchaulet commented Feb 4, 2020

@kobelb for me as a consumer the part that interest me is authc.areAPIKeysEnabled the rest is implementation details,

Just relaying on the status code seems a bit unreliable but it it's coupled with another code in the response body, seems good. Also not sure 503 is the best status code for that a 4x seems more suitable, I already saw people using 403 for a feature not activated.

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Feb 4, 2020

@nchaulet Unfortunately, we don't have an Elasticsearch API which we can use to definitively answer this question. As long as Fleet is able to rely on deriving this information from an API call to create/get/update an API Key, the security plugin can expose a consistent way to determine whether or not the error indicates that API Keys are disable or not.

@nchaulet
Copy link
Copy Markdown
Member

nchaulet commented Feb 4, 2020

@kobelb We can do a call to /_security/api_key to list API keys and check the error against an API the security plugin provide, but I think it will be more futur proof if this call is done by the security plugin (in the areAPIKeysEnabled method) so if elastic provide a better API to know if API keys are enabled every plugins will be updated at once.

@kobelb
Copy link
Copy Markdown
Contributor Author

kobelb commented Mar 6, 2020

Closing in favor of a different approach outlined in #59576

@kobelb kobelb closed this Mar 6, 2020
@kobelb kobelb deleted the are-api-keys-enabled branch March 6, 2020 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release_note:skip Skip the PR/issue when compiling release notes v7.7.0 v8.0.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants