Skip to content

Commit 2350369

Browse files
ywangdywangd
authored
Service Accounts - HLRC (#72431)
This PR adds corresponding components in High Level Rest Client for the new APIs related to the service accounts feature.
1 parent 86500ae commit 2350369

File tree

35 files changed

+2250
-67
lines changed

35 files changed

+2250
-67
lines changed

‎client/rest-high-level/src/main/java/org/elasticsearch/client/SecurityClient.java

+166
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,11 @@
2020
import org.elasticsearch.client.security.ClearRolesCacheRequest;
2121
import org.elasticsearch.client.security.ClearRolesCacheResponse;
2222
import org.elasticsearch.client.security.ClearSecurityCacheResponse;
23+
import org.elasticsearch.client.security.ClearServiceAccountTokenCacheRequest;
2324
import org.elasticsearch.client.security.CreateApiKeyRequest;
2425
import org.elasticsearch.client.security.CreateApiKeyResponse;
26+
import org.elasticsearch.client.security.CreateServiceAccountTokenRequest;
27+
import org.elasticsearch.client.security.CreateServiceAccountTokenResponse;
2528
import org.elasticsearch.client.security.CreateTokenRequest;
2629
import org.elasticsearch.client.security.CreateTokenResponse;
2730
import org.elasticsearch.client.security.DelegatePkiAuthenticationRequest;
@@ -32,6 +35,8 @@
3235
import org.elasticsearch.client.security.DeleteRoleMappingResponse;
3336
import org.elasticsearch.client.security.DeleteRoleRequest;
3437
import org.elasticsearch.client.security.DeleteRoleResponse;
38+
import org.elasticsearch.client.security.DeleteServiceAccountTokenRequest;
39+
import org.elasticsearch.client.security.DeleteServiceAccountTokenResponse;
3540
import org.elasticsearch.client.security.DeleteUserRequest;
3641
import org.elasticsearch.client.security.DeleteUserResponse;
3742
import org.elasticsearch.client.security.DisableUserRequest;
@@ -46,6 +51,10 @@
4651
import org.elasticsearch.client.security.GetRoleMappingsResponse;
4752
import org.elasticsearch.client.security.GetRolesRequest;
4853
import org.elasticsearch.client.security.GetRolesResponse;
54+
import org.elasticsearch.client.security.GetServiceAccountCredentialsRequest;
55+
import org.elasticsearch.client.security.GetServiceAccountCredentialsResponse;
56+
import org.elasticsearch.client.security.GetServiceAccountsRequest;
57+
import org.elasticsearch.client.security.GetServiceAccountsResponse;
4958
import org.elasticsearch.client.security.GetSslCertificatesRequest;
5059
import org.elasticsearch.client.security.GetSslCertificatesResponse;
5160
import org.elasticsearch.client.security.GetUserPrivilegesRequest;
@@ -569,6 +578,38 @@ public Cancellable clearApiKeyCacheAsync(ClearApiKeyCacheRequest request, Reques
569578
ClearSecurityCacheResponse::fromXContent, listener, emptySet());
570579
}
571580

581+
/**
582+
* Clears the service account token cache for the specified namespace, service-name and list of token names.
583+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-service-token-cache.html">
584+
* the docs</a> for more.
585+
*
586+
* @param request the request with namespace, service-name and token names for the service account tokens
587+
* that should be cleared from the cache.
588+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
589+
* @return the response from the clear security cache call
590+
* @throws IOException in case there is a problem sending the request or parsing back the response
591+
*/public ClearSecurityCacheResponse clearServiceAccountTokenCache(ClearServiceAccountTokenCacheRequest request,
592+
RequestOptions options) throws IOException {
593+
return restHighLevelClient.performRequestAndParseEntity(request, SecurityRequestConverters::clearServiceAccountTokenCache,
594+
options, ClearSecurityCacheResponse::fromXContent, emptySet());
595+
}
596+
597+
/**
598+
* Clears the service account token cache for the specified namespace, service-name and list of token names asynchronously.
599+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-service-token-cache.html">
600+
* the docs</a> for more.
601+
*
602+
* @param request the request with namespace, service-name and token names for the service account tokens
603+
* that should be cleared from the cache.
604+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
605+
* @param listener the listener to be notified upon request completion
606+
* @return cancellable that may be used to cancel the request
607+
*/public Cancellable clearServiceAccountTokenCacheAsync(ClearServiceAccountTokenCacheRequest request, RequestOptions options,
608+
ActionListener<ClearSecurityCacheResponse> listener) {
609+
return restHighLevelClient.performRequestAsyncAndParseEntity(request, SecurityRequestConverters::clearServiceAccountTokenCache,
610+
options, ClearSecurityCacheResponse::fromXContent, listener, emptySet());
611+
}
612+
572613
/**
573614
* Synchronously retrieve the X.509 certificates that are used to encrypt communications in an Elasticsearch cluster.
574615
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-ssl.html">
@@ -1098,6 +1139,131 @@ public Cancellable grantApiKeyAsync(final GrantApiKeyRequest request, final Requ
10981139
CreateApiKeyResponse::fromXContent, listener, emptySet());
10991140
}
11001141

1142+
/**
1143+
* Get a service account, or list of service accounts synchronously.
1144+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-accounts.html">
1145+
* the docs</a> for more information.
1146+
* @param request the request with namespace and service-name
1147+
* @param options the request options (e.g., headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1148+
* @return the response from the get service accounts call
1149+
* @throws IOException in case there is a problem sending the request or parsing back the response
1150+
*/
1151+
public GetServiceAccountsResponse getServiceAccounts(GetServiceAccountsRequest request, RequestOptions options) throws IOException {
1152+
return restHighLevelClient.performRequestAndParseEntity(request, SecurityRequestConverters::getServiceAccounts, options,
1153+
GetServiceAccountsResponse::fromXContent, emptySet());
1154+
}
1155+
1156+
/**
1157+
* Get a service account, or list of service accounts asynchronously.
1158+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-accounts.html">
1159+
* the docs</a> for more information.
1160+
* @param request the request with namespace and service-name
1161+
* @param options the request options (e.g., headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1162+
* @param listener the listener to be notified upon request completion
1163+
* @return cancellable that may be used to cancel the request
1164+
*/
1165+
public Cancellable getServiceAccountsAsync(GetServiceAccountsRequest request, RequestOptions options,
1166+
ActionListener<GetServiceAccountsResponse> listener) {
1167+
return restHighLevelClient.performRequestAsyncAndParseEntity(request, SecurityRequestConverters::getServiceAccounts, options,
1168+
GetServiceAccountsResponse::fromXContent, listener, emptySet());
1169+
}
1170+
1171+
/**
1172+
* Create a service account token.<br>
1173+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html">
1174+
* the docs</a> for more.
1175+
*
1176+
* @param request the request to create a service account token
1177+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1178+
* @return the response from the create service account token call
1179+
* @throws IOException in case there is a problem sending the request or parsing back the response
1180+
*/
1181+
public CreateServiceAccountTokenResponse createServiceAccountToken(final CreateServiceAccountTokenRequest request,
1182+
final RequestOptions options) throws IOException {
1183+
return restHighLevelClient.performRequestAndParseEntity(request, SecurityRequestConverters::createServiceAccountToken, options,
1184+
CreateServiceAccountTokenResponse::fromXContent, emptySet());
1185+
}
1186+
1187+
/**
1188+
* Asynchronously creates a service account token.<br>
1189+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html">
1190+
* the docs</a> for more.
1191+
*
1192+
* @param request the request to create a service account token
1193+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1194+
* @param listener the listener to be notified upon request completion
1195+
* @return cancellable that may be used to cancel the request
1196+
*/
1197+
public Cancellable createServiceAccountTokenAsync(final CreateServiceAccountTokenRequest request,
1198+
final RequestOptions options,
1199+
final ActionListener<CreateServiceAccountTokenResponse> listener) {
1200+
return restHighLevelClient.performRequestAsyncAndParseEntity(request, SecurityRequestConverters::createServiceAccountToken, options,
1201+
CreateServiceAccountTokenResponse::fromXContent, listener, emptySet());
1202+
}
1203+
1204+
/**
1205+
* Delete a service account token.<br>
1206+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-delete-service-token.html">
1207+
* the docs</a> for more.
1208+
*
1209+
* @param request the request to delete a service account token
1210+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1211+
* @return the response from the create service account token call
1212+
* @throws IOException in case there is a problem sending the request or parsing back the response
1213+
*/
1214+
public DeleteServiceAccountTokenResponse deleteServiceAccountToken(final DeleteServiceAccountTokenRequest request,
1215+
final RequestOptions options) throws IOException {
1216+
return restHighLevelClient.performRequestAndParseEntity(request, SecurityRequestConverters::deleteServiceAccountToken, options,
1217+
DeleteServiceAccountTokenResponse::fromXContent, emptySet());
1218+
}
1219+
1220+
/**
1221+
* Asynchronously deletes a service account token.<br>
1222+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-delete-service-token.html">
1223+
* the docs</a> for more.
1224+
*
1225+
* @param request the request to delete a service account token
1226+
* @param options the request options (e.g. headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1227+
* @param listener the listener to be notified upon request completion
1228+
* @return cancellable that may be used to cancel the request
1229+
*/
1230+
public Cancellable deleteServiceAccountTokenAsync(final DeleteServiceAccountTokenRequest request,
1231+
final RequestOptions options,
1232+
final ActionListener<DeleteServiceAccountTokenResponse> listener) {
1233+
return restHighLevelClient.performRequestAsyncAndParseEntity(request, SecurityRequestConverters::deleteServiceAccountToken, options,
1234+
DeleteServiceAccountTokenResponse::fromXContent, listener, emptySet());
1235+
}
1236+
1237+
/**
1238+
* Get credentials for a service account synchronously.
1239+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-credentails.html">
1240+
* the docs</a> for more information.
1241+
* @param request the request with namespace and service-name
1242+
* @param options the request options (e.g., headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1243+
* @return the response from the get service accounts call
1244+
* @throws IOException in case there is a problem sending the request or parsing back the response
1245+
*/
1246+
public GetServiceAccountCredentialsResponse getServiceAccountCredentials(GetServiceAccountCredentialsRequest request,
1247+
RequestOptions options) throws IOException {
1248+
return restHighLevelClient.performRequestAndParseEntity(request, SecurityRequestConverters::getServiceAccountCredentials,
1249+
options, GetServiceAccountCredentialsResponse::fromXContent, emptySet());
1250+
}
1251+
1252+
/**
1253+
* Get credentials for a service account asynchronously.
1254+
* See <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-service-credentails.html">
1255+
* the docs</a> for more information.
1256+
* @param request the request with namespace and service-name
1257+
* @param options the request options (e.g., headers), use {@link RequestOptions#DEFAULT} if nothing needs to be customized
1258+
* @param listener the listener to be notified upon request completion
1259+
* @return cancellable that may be used to cancel the request
1260+
*/
1261+
public Cancellable getServiceAccountCredentialsAsync(GetServiceAccountCredentialsRequest request, RequestOptions options,
1262+
ActionListener<GetServiceAccountCredentialsResponse> listener) {
1263+
return restHighLevelClient.performRequestAsyncAndParseEntity(request, SecurityRequestConverters::getServiceAccountCredentials,
1264+
options, GetServiceAccountCredentialsResponse::fromXContent, listener, emptySet());
1265+
}
1266+
11011267
/**
11021268
* Get an Elasticsearch access token from an {@code X509Certificate} chain. The certificate chain is that of the client from a mutually
11031269
* authenticated TLS session, and it is validated by the PKI realms with {@code delegation.enabled} toggled to {@code true}.<br>

‎client/rest-high-level/src/main/java/org/elasticsearch/client/SecurityRequestConverters.java

+70
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,24 @@
1717
import org.elasticsearch.client.security.ClearPrivilegesCacheRequest;
1818
import org.elasticsearch.client.security.ClearRealmCacheRequest;
1919
import org.elasticsearch.client.security.ClearRolesCacheRequest;
20+
import org.elasticsearch.client.security.ClearServiceAccountTokenCacheRequest;
2021
import org.elasticsearch.client.security.CreateApiKeyRequest;
22+
import org.elasticsearch.client.security.CreateServiceAccountTokenRequest;
2123
import org.elasticsearch.client.security.CreateTokenRequest;
2224
import org.elasticsearch.client.security.DelegatePkiAuthenticationRequest;
2325
import org.elasticsearch.client.security.DeletePrivilegesRequest;
2426
import org.elasticsearch.client.security.DeleteRoleMappingRequest;
2527
import org.elasticsearch.client.security.DeleteRoleRequest;
28+
import org.elasticsearch.client.security.DeleteServiceAccountTokenRequest;
2629
import org.elasticsearch.client.security.DeleteUserRequest;
2730
import org.elasticsearch.client.security.DisableUserRequest;
2831
import org.elasticsearch.client.security.EnableUserRequest;
2932
import org.elasticsearch.client.security.GetApiKeyRequest;
3033
import org.elasticsearch.client.security.GetPrivilegesRequest;
3134
import org.elasticsearch.client.security.GetRoleMappingsRequest;
3235
import org.elasticsearch.client.security.GetRolesRequest;
36+
import org.elasticsearch.client.security.GetServiceAccountCredentialsRequest;
37+
import org.elasticsearch.client.security.GetServiceAccountsRequest;
3338
import org.elasticsearch.client.security.GetUsersRequest;
3439
import org.elasticsearch.client.security.GrantApiKeyRequest;
3540
import org.elasticsearch.client.security.HasPrivilegesRequest;
@@ -193,6 +198,17 @@ static Request clearApiKeyCache(ClearApiKeyCacheRequest clearApiKeyCacheRequest)
193198
return new Request(HttpPost.METHOD_NAME, endpoint);
194199
}
195200

201+
static Request clearServiceAccountTokenCache(ClearServiceAccountTokenCacheRequest clearServiceAccountTokenCacheRequest) {
202+
String endpoint = new RequestConverters.EndpointBuilder()
203+
.addPathPartAsIs("_security/service")
204+
.addPathPart(clearServiceAccountTokenCacheRequest.getNamespace(), clearServiceAccountTokenCacheRequest.getServiceName())
205+
.addPathPartAsIs("credential/token")
206+
.addCommaSeparatedPathParts(clearServiceAccountTokenCacheRequest.getTokenNames())
207+
.addPathPart("_clear_cache")
208+
.build();
209+
return new Request(HttpPost.METHOD_NAME, endpoint);
210+
}
211+
196212
static Request deleteRoleMapping(DeleteRoleMappingRequest deleteRoleMappingRequest) {
197213
final String endpoint = new RequestConverters.EndpointBuilder()
198214
.addPathPartAsIs("_security/role_mapping")
@@ -329,4 +345,58 @@ static Request invalidateApiKey(final InvalidateApiKeyRequest invalidateApiKeyRe
329345
request.setEntity(createEntity(invalidateApiKeyRequest, REQUEST_BODY_CONTENT_TYPE));
330346
return request;
331347
}
348+
349+
static Request getServiceAccounts(final GetServiceAccountsRequest getServiceAccountsRequest) {
350+
final RequestConverters.EndpointBuilder endpointBuilder = new RequestConverters.EndpointBuilder()
351+
.addPathPartAsIs("_security/service");
352+
if (getServiceAccountsRequest.getNamespace() != null) {
353+
endpointBuilder.addPathPart(getServiceAccountsRequest.getNamespace());
354+
if (getServiceAccountsRequest.getServiceName() != null) {
355+
endpointBuilder.addPathPart(getServiceAccountsRequest.getServiceName());
356+
}
357+
}
358+
return new Request(HttpGet.METHOD_NAME, endpointBuilder.build());
359+
}
360+
361+
static Request createServiceAccountToken(final CreateServiceAccountTokenRequest createServiceAccountTokenRequest) throws IOException {
362+
final RequestConverters.EndpointBuilder endpointBuilder = new RequestConverters.EndpointBuilder()
363+
.addPathPartAsIs("_security/service")
364+
.addPathPart(createServiceAccountTokenRequest.getNamespace(), createServiceAccountTokenRequest.getServiceName())
365+
.addPathPartAsIs("credential/token");
366+
if (createServiceAccountTokenRequest.getTokenName() != null) {
367+
endpointBuilder.addPathPart(createServiceAccountTokenRequest.getTokenName());
368+
}
369+
final Request request = new Request(HttpPost.METHOD_NAME, endpointBuilder.build());
370+
final RequestConverters.Params params = new RequestConverters.Params();
371+
if (createServiceAccountTokenRequest.getRefreshPolicy() != null) {
372+
params.withRefreshPolicy(createServiceAccountTokenRequest.getRefreshPolicy());
373+
}
374+
request.addParameters(params.asMap());
375+
return request;
376+
}
377+
378+
static Request deleteServiceAccountToken(final DeleteServiceAccountTokenRequest deleteServiceAccountTokenRequest) {
379+
final RequestConverters.EndpointBuilder endpointBuilder = new RequestConverters.EndpointBuilder()
380+
.addPathPartAsIs("_security/service")
381+
.addPathPart(deleteServiceAccountTokenRequest.getNamespace(), deleteServiceAccountTokenRequest.getServiceName())
382+
.addPathPartAsIs("credential/token")
383+
.addPathPart(deleteServiceAccountTokenRequest.getTokenName());
384+
385+
final Request request = new Request(HttpDelete.METHOD_NAME, endpointBuilder.build());
386+
final RequestConverters.Params params = new RequestConverters.Params();
387+
if (deleteServiceAccountTokenRequest.getRefreshPolicy() != null) {
388+
params.withRefreshPolicy(deleteServiceAccountTokenRequest.getRefreshPolicy());
389+
}
390+
request.addParameters(params.asMap());
391+
return request;
392+
}
393+
394+
static Request getServiceAccountCredentials(final GetServiceAccountCredentialsRequest getServiceAccountCredentialsRequest) {
395+
final RequestConverters.EndpointBuilder endpointBuilder = new RequestConverters.EndpointBuilder()
396+
.addPathPartAsIs("_security/service")
397+
.addPathPart(getServiceAccountCredentialsRequest.getNamespace(), getServiceAccountCredentialsRequest.getServiceName())
398+
.addPathPartAsIs("credential");
399+
400+
return new Request(HttpGet.METHOD_NAME, endpointBuilder.build());
401+
}
332402
}

0 commit comments

Comments
 (0)