@@ -254,7 +254,7 @@ public TokenService(Settings settings, Clock clock, Client client, XPackLicenseS
254254 * {@link #VERSION_TOKENS_INDEX_INTRODUCED} and to a specific security tokens index for later versions.
255255 */
256256 public void createOAuth2Tokens (Authentication authentication , Authentication originatingClientAuth , Map <String , Object > metadata ,
257- boolean includeRefreshToken , ActionListener <Tuple < String , String > > listener ) {
257+ boolean includeRefreshToken , ActionListener <CreateTokenResult > listener ) {
258258 // the created token is compatible with the oldest node version in the cluster
259259 final Version tokenVersion = getTokenVersionCompatibility ();
260260 // tokens moved to a separate index in newer versions
@@ -273,7 +273,7 @@ public void createOAuth2Tokens(Authentication authentication, Authentication ori
273273 //public for testing
274274 public void createOAuth2Tokens (String accessToken , String refreshToken , Authentication authentication ,
275275 Authentication originatingClientAuth ,
276- Map <String , Object > metadata , ActionListener <Tuple < String , String > > listener ) {
276+ Map <String , Object > metadata , ActionListener <CreateTokenResult > listener ) {
277277 // the created token is compatible with the oldest node version in the cluster
278278 final Version tokenVersion = getTokenVersionCompatibility ();
279279 // tokens moved to a separate index in newer versions
@@ -306,12 +306,13 @@ public void createOAuth2Tokens(String accessToken, String refreshToken, Authenti
306306 * @param authentication The authentication object representing the user for which the tokens are created
307307 * @param originatingClientAuth The authentication object representing the client that called the related API
308308 * @param metadata A map with metadata to be stored in the token document
309- * @param listener The listener to call upon completion with a {@link Tuple} containing the
310- * serialized access token and serialized refresh token as these will be returned to the client
309+ * @param listener The listener to call upon completion with a {@link CreateTokenResult} containing the
310+ * serialized access token, serialized refresh token and authentication for which the token is created
311+ * as these will be returned to the client
311312 */
312313 private void createOAuth2Tokens (String accessToken , String refreshToken , Version tokenVersion , SecurityIndexManager tokensIndex ,
313314 Authentication authentication , Authentication originatingClientAuth , Map <String , Object > metadata ,
314- ActionListener <Tuple < String , String > > listener ) {
315+ ActionListener <CreateTokenResult > listener ) {
315316 assert accessToken .length () == TOKEN_LENGTH : "We assume token ids have a fixed length for nodes of a certain version."
316317 + " When changing the token length, be careful that the inferences about its length still hold." ;
317318 ensureEnabled ();
@@ -351,12 +352,13 @@ private void createOAuth2Tokens(String accessToken, String refreshToken, Version
351352 final String versionedRefreshToken = refreshToken != null
352353 ? prependVersionAndEncodeRefreshToken (tokenVersion , refreshToken )
353354 : null ;
354- listener .onResponse (new Tuple <>(versionedAccessToken , versionedRefreshToken ));
355+ listener .onResponse (new CreateTokenResult (versionedAccessToken , versionedRefreshToken ,
356+ authentication ));
355357 } else {
356358 // prior versions of the refresh token are not version-prepended, as nodes on those
357359 // versions don't expect it.
358360 // Such nodes might exist in a mixed cluster during a rolling upgrade.
359- listener .onResponse (new Tuple <> (versionedAccessToken , refreshToken ));
361+ listener .onResponse (new CreateTokenResult (versionedAccessToken , refreshToken , authentication ));
360362 }
361363 } else {
362364 listener .onFailure (traceLog ("create token" ,
@@ -859,10 +861,11 @@ private void indexInvalidation(Collection<String> tokenIds, SecurityIndexManager
859861 * Called by the transport action in order to start the process of refreshing a token.
860862 *
861863 * @param refreshToken The refresh token as provided by the client
862- * @param listener The listener to call upon completion with a {@link Tuple} containing the
863- * serialized access token and serialized refresh token as these will be returned to the client
864+ * @param listener The listener to call upon completion with a {@link CreateTokenResult} containing the
865+ * serialized access token, serialized refresh token and authentication for which the token is created
866+ * as these will be returned to the client
864867 */
865- public void refreshToken (String refreshToken , ActionListener <Tuple < String , String > > listener ) {
868+ public void refreshToken (String refreshToken , ActionListener <CreateTokenResult > listener ) {
866869 ensureEnabled ();
867870 final Instant refreshRequested = clock .instant ();
868871 final Iterator <TimeValue > backoff = DEFAULT_BACKOFF .iterator ();
@@ -995,7 +998,7 @@ private void findTokenFromRefreshToken(String refreshToken, SecurityIndexManager
995998 */
996999 private void innerRefresh (String refreshToken , String tokenDocId , Map <String , Object > source , long seqNo , long primaryTerm ,
9971000 Authentication clientAuth , Iterator <TimeValue > backoff , Instant refreshRequested ,
998- ActionListener <Tuple < String , String > > listener ) {
1001+ ActionListener <CreateTokenResult > listener ) {
9991002 logger .debug ("Attempting to refresh token stored in token document [{}]" , tokenDocId );
10001003 final Consumer <Exception > onFailure = ex -> listener .onFailure (traceLog ("refresh token" , tokenDocId , ex ));
10011004 final Tuple <RefreshTokenStatus , Optional <ElasticsearchSecurityException >> checkRefreshResult ;
@@ -1014,7 +1017,9 @@ private void innerRefresh(String refreshToken, String tokenDocId, Map<String, Ob
10141017 if (refreshTokenStatus .isRefreshed ()) {
10151018 logger .debug ("Token document [{}] was recently refreshed, when a new token document was generated. Reusing that result." ,
10161019 tokenDocId );
1017- decryptAndReturnSupersedingTokens (refreshToken , refreshTokenStatus , refreshedTokenIndex , listener );
1020+ final Tuple <UserToken , String > parsedTokens = parseTokensFromDocument (source , null );
1021+ Authentication authentication = parsedTokens .v1 ().getAuthentication ();
1022+ decryptAndReturnSupersedingTokens (refreshToken , refreshTokenStatus , refreshedTokenIndex , authentication , listener );
10181023 } else {
10191024 final String newAccessTokenString = UUIDs .randomBase64UUID ();
10201025 final String newRefreshTokenString = UUIDs .randomBase64UUID ();
@@ -1126,11 +1131,13 @@ public void onFailure(Exception e) {
11261131 * @param refreshTokenStatus The {@link RefreshTokenStatus} containing information about the superseding tokens as retrieved from the
11271132 * index
11281133 * @param tokensIndex the manager for the index where the tokens are stored
1129- * @param listener The listener to call upon completion with a {@link Tuple} containing the
1130- * serialized access token and serialized refresh token as these will be returned to the client
1134+ * @param authentication The authentication object representing the user for which the tokens are created
1135+ * @param listener The listener to call upon completion with a {@link CreateTokenResult} containing the
1136+ * serialized access token, serialized refresh token and authentication for which the token is created
1137+ * as these will be returned to the client
11311138 */
11321139 void decryptAndReturnSupersedingTokens (String refreshToken , RefreshTokenStatus refreshTokenStatus , SecurityIndexManager tokensIndex ,
1133- ActionListener < Tuple < String , String > > listener ) {
1140+ Authentication authentication , ActionListener < CreateTokenResult > listener ) {
11341141
11351142 final byte [] iv = Base64 .getDecoder ().decode (refreshTokenStatus .getIv ());
11361143 final byte [] salt = Base64 .getDecoder ().decode (refreshTokenStatus .getSalt ());
@@ -1166,8 +1173,10 @@ public void onResponse(GetResponse response) {
11661173 if (response .isExists ()) {
11671174 try {
11681175 listener .onResponse (
1169- new Tuple <>(prependVersionAndEncodeAccessToken (refreshTokenStatus .getVersion (), decryptedTokens [0 ]),
1170- prependVersionAndEncodeRefreshToken (refreshTokenStatus .getVersion (), decryptedTokens [1 ])));
1176+ new CreateTokenResult (prependVersionAndEncodeAccessToken (refreshTokenStatus .getVersion (),
1177+ decryptedTokens [0 ]),
1178+ prependVersionAndEncodeRefreshToken (refreshTokenStatus .getVersion (), decryptedTokens [1 ]),
1179+ authentication ));
11711180 } catch (GeneralSecurityException | IOException e ) {
11721181 logger .warn ("Could not format stored superseding token values" , e );
11731182 onFailure .accept (invalidGrantException ("could not refresh the requested token" ));
@@ -1910,6 +1919,30 @@ boolean isExpirationInProgress() {
19101919 return expiredTokenRemover .isExpirationInProgress ();
19111920 }
19121921
1922+ public static final class CreateTokenResult {
1923+ private final String accessToken ;
1924+ private final String refreshToken ;
1925+ private final Authentication authentication ;
1926+
1927+ public CreateTokenResult (String accessToken , String refreshToken , Authentication authentication ) {
1928+ this .accessToken = accessToken ;
1929+ this .refreshToken = refreshToken ;
1930+ this .authentication = authentication ;
1931+ }
1932+
1933+ public String getAccessToken () {
1934+ return accessToken ;
1935+ }
1936+
1937+ public String getRefreshToken () {
1938+ return refreshToken ;
1939+ }
1940+
1941+ public Authentication getAuthentication () {
1942+ return authentication ;
1943+ }
1944+ }
1945+
19131946 private class KeyComputingRunnable extends AbstractRunnable {
19141947
19151948 private final BytesKey decodedSalt ;
0 commit comments