Set elastic password and generate enrollment token

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/ResetElasticPasswordTool.java

@@ -31,6 +31,8 @@
 import java.util.List;
 import java.util.function.Function;
 
+import static org.elasticsearch.xpack.security.tool.CommandLineHttpClient.createURL;
+
 public class ResetElasticPasswordTool extends BaseRunAsSuperuserCommand {
 
     private final Function<Environment, CommandLineHttpClient> clientFunction;
@@ -92,7 +94,7 @@ protected void executeCommand(Terminal terminal, OptionSet options, Environment
                 username,
                 password,
                 () -> requestBodySupplier(elasticPassword),
-                this::responseBuilder
+                CommandLineHttpClient::responseBuilder
             );
             final int responseStatus = httpResponse.getHttpStatus();
             if (httpResponse.getHttpStatus() != HttpURLConnection.HTTP_OK) {

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

@@ -418,7 +418,7 @@ void checkClusterHealth(Terminal terminal) throws Exception {
                 terminal.errorPrintln("Failed to determine the health of the cluster running at " + url);
                 terminal.errorPrintln("Unexpected response code [" + httpResponse.getHttpStatus() + "] from calling GET " +
                     route.toString());
-                final String cause = getErrorCause(httpResponse);
+                final String cause = CommandLineHttpClient.getErrorCause(httpResponse);
                 if (cause != null) {
                     terminal.errorPrintln("Cause: " + cause);
                 }
@@ -477,7 +477,7 @@ private void changeUserPassword(String user, SecureString password, Terminal ter
                     terminal.errorPrintln("");
                     terminal.errorPrintln(
                             "Unexpected response code [" + httpResponse.getHttpStatus() + "] from calling PUT " + route.toString());
-                    String cause = getErrorCause(httpResponse);
+                    String cause = CommandLineHttpClient.getErrorCause(httpResponse);
                     if (cause != null) {
                         terminal.errorPrintln("Cause: " + cause);
                         terminal.errorPrintln("");
@@ -564,32 +564,6 @@ private URL createURL(URL url, String path, String query) throws MalformedURLExc
         }
     }
 
-    private String getErrorCause(HttpResponse httpResponse) {
-        final Object error = httpResponse.getResponseBody().get("error");
-        if (error == null) {
-            return null;
-        }
-        if (error instanceof Map) {
-            Object reason = ((Map) error).get("reason");
-            if (reason != null) {
-                return reason.toString();
-            }
-            final Object root = ((Map) error).get("root_cause");
-            if (root != null && root instanceof Map) {
-                reason = ((Map) root).get("reason");
-                if (reason != null) {
-                    return reason.toString();
-                }
-                final Object type = ((Map) root).get("type");
-                if (type != null) {
-                    return (String) type;
-                }
-            }
-            return String.valueOf(((Map) error).get("type"));
-        }
-        return error.toString();
-    }
-
     private byte[] toByteArray(InputStream is) throws IOException {
         ByteArrayOutputStream baos = new ByteArrayOutputStream();
         byte[] internalBuffer = new byte[1024];

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/enrollment/EnrollmentToken.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+package org.elasticsearch.xpack.security.enrollment;
+
+import org.elasticsearch.common.Strings;
+import org.elasticsearch.common.xcontent.XContentBuilder;
+import org.elasticsearch.common.xcontent.json.JsonXContent;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.List;
+import java.util.Objects;
+
+public class EnrollmentToken {
+    private final String apiKey;
+    private final String fingerprint;
+    private final String version;
+    private final List<String > bound_address;
+
+    public String getApiKey() { return apiKey; }
+    public String getFingerprint() { return fingerprint; }
+    public String getVersion() { return version; }
+    public List<String> getBound_address() { return bound_address; }
+
+    public EnrollmentToken(String apiKey, String fingerprint, String version, List<String> bound_address) {
+        this.apiKey = Objects.requireNonNull(apiKey);
+        this.fingerprint = Objects.requireNonNull(fingerprint);
+        this.version = Objects.requireNonNull(version);
+        this.bound_address = Objects.requireNonNull(bound_address);
+    }
+
+    public String getRaw() throws Exception {
+        final XContentBuilder builder = JsonXContent.contentBuilder();
+        builder.startObject();
+        builder.field("ver", version);
+        builder.startArray("adr");
+        for (String bound_address : bound_address) {
+            builder.value(bound_address);
+        }
+        builder.endArray();
+        builder.field("fgr", fingerprint);
+        builder.field("key", apiKey);
+        builder.endObject();
+        return Strings.toString(builder);
+    }
+
+    public String encode() throws Exception {
+        final String jsonString = getRaw();
+        return Base64.getUrlEncoder().encodeToString(jsonString.getBytes(StandardCharsets.UTF_8));
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/enrollment/CreateEnrollmentToken.java → x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/enrollment/EnrollmentTokenGenerator.java

@@ -36,67 +36,52 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
-import java.nio.charset.StandardCharsets;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
-import java.util.Base64;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.stream.Collectors;
 
-public class CreateEnrollmentToken {
+public class EnrollmentTokenGenerator {
     protected static final String ENROLL_API_KEY_EXPIRATION = "30m";
 
-    private static final Logger logger = LogManager.getLogger(CreateEnrollmentToken.class);
+    private static final Logger logger = LogManager.getLogger(EnrollmentTokenGenerator.class);
     private final Environment environment;
     private final SSLService sslService;
     private final CommandLineHttpClient client;
     private final URL defaultUrl;
 
-    public CreateEnrollmentToken(Environment environment) throws MalformedURLException {
+    public EnrollmentTokenGenerator(Environment environment) throws MalformedURLException {
         this(environment, new CommandLineHttpClient(environment));
     }
 
     // protected for testing
-    protected CreateEnrollmentToken(Environment environment, CommandLineHttpClient client) throws MalformedURLException {
+    protected EnrollmentTokenGenerator(Environment environment, CommandLineHttpClient client) throws MalformedURLException {
         this.environment = environment;
         this.sslService = new SSLService(environment);
         this.client = client;
         this.defaultUrl = new URL(client.getDefaultURL());
     }
 
-    public String createNodeEnrollmentToken(String user, SecureString password) throws Exception {
+    public EnrollmentToken createNodeEnrollmentToken(String user, SecureString password) throws Exception {
         return this.create(user, password, NodeEnrollmentAction.NAME);
     }
 
-    public String createKibanaEnrollmentToken(String user, SecureString password) throws Exception {
+    public EnrollmentToken createKibanaEnrollmentToken(String user, SecureString password) throws Exception {
         return this.create(user, password, KibanaEnrollmentAction.NAME);
     }
 
-    protected String create(String user, SecureString password, String action) throws Exception {
+    protected EnrollmentToken create(String user, SecureString password, String action) throws Exception {
         if (XPackSettings.ENROLLMENT_ENABLED.get(environment.settings()) != true) {
             throw new IllegalStateException("[xpack.security.enrollment.enabled] must be set to `true` to create an enrollment token");
         }
         final String fingerprint = getCaFingerprint();
         final String apiKey = getApiKeyCredentials(user, password, action);
         final Tuple<List<String>, String> httpInfo = getNodeInfo(user, password);
-
         try {
-            final XContentBuilder builder = JsonXContent.contentBuilder();
-            builder.startObject();
-            builder.field("ver", httpInfo.v2());
-            builder.startArray("adr");
-            for (String bound_address : httpInfo.v1()) {
-                builder.value(bound_address);
-            }
-            builder.endArray();
-            builder.field("fgr", fingerprint);
-            builder.field("key", apiKey);
-            builder.endObject();
-            final String jsonString = Strings.toString(builder);
-            return Base64.getUrlEncoder().encodeToString(jsonString.getBytes(StandardCharsets.UTF_8));
+            return new EnrollmentToken(apiKey, fingerprint, httpInfo.v2(), httpInfo.v1());
         } catch (Exception e) {
             logger.error(("Error generating enrollment token"), e);
             throw new IllegalStateException("Error generating enrollment token: " + e.getMessage());

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/enrollment/tool/BootstrapPasswordAndEnrollmentTokenForInitialNode.java

@@ -0,0 +1,172 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+package org.elasticsearch.xpack.security.enrollment.tool;
+
+import joptsimple.OptionParser;
+import joptsimple.OptionSet;
+
+import joptsimple.OptionSpec;
+
+import org.elasticsearch.cli.ExitCodes;
+import org.elasticsearch.cli.KeyStoreAwareCommand;
+import org.elasticsearch.cli.Terminal;
+import org.elasticsearch.cli.UserException;
+import org.elasticsearch.common.Strings;
+import org.elasticsearch.common.settings.KeyStoreWrapper;
+import org.elasticsearch.common.settings.SecureString;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.common.xcontent.XContentBuilder;
+import org.elasticsearch.common.xcontent.json.JsonXContent;
+import org.elasticsearch.core.CheckedFunction;
+import org.elasticsearch.env.Environment;
+import org.elasticsearch.xpack.core.security.user.ElasticUser;
+import org.elasticsearch.xpack.security.authc.esnative.ReservedRealm;
+import org.elasticsearch.xpack.security.enrollment.EnrollmentToken;
+import org.elasticsearch.xpack.security.enrollment.EnrollmentTokenGenerator;
+import org.elasticsearch.xpack.security.tool.CommandLineHttpClient;
+import org.elasticsearch.xpack.security.tool.HttpResponse;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.security.SecureRandom;
+import java.util.function.Function;
+
+import static org.elasticsearch.xpack.security.tool.CommandLineHttpClient.createURL;
+
+public class BootstrapPasswordAndEnrollmentTokenForInitialNode extends KeyStoreAwareCommand {
+    private static final String ELASTIC_USER = ElasticUser.NAME;
+    private final CheckedFunction<Environment, EnrollmentTokenGenerator, Exception> createEnrollmentTokenFunction;
+    private final Function<Environment, CommandLineHttpClient> clientFunction;
+    private final CheckedFunction<Environment, KeyStoreWrapper, Exception> keyStoreFunction;
+    private final OptionSpec<Void> docker;
+    final SecureRandom secureRandom = new SecureRandom();
+
+    // Package-private for testing
+    CommandLineHttpClient getClient(Environment env) {
+        return clientFunction.apply(env);
+    }
+    EnrollmentTokenGenerator getEnrollmentTokenGenerator(Environment env) throws Exception{
+        return createEnrollmentTokenFunction.apply(env);
+    }
+    OptionParser getParser() { return parser; }
+
+    BootstrapPasswordAndEnrollmentTokenForInitialNode() {
+        this(
+            environment -> new CommandLineHttpClient(environment),
+            environment -> KeyStoreWrapper.load(environment.configFile()),
+            environment -> new EnrollmentTokenGenerator(environment)
+        );
+    }
+
+    BootstrapPasswordAndEnrollmentTokenForInitialNode(Function<Environment, CommandLineHttpClient> clientFunction,
+                                                      CheckedFunction<Environment, KeyStoreWrapper, Exception> keyStoreFunction,
+                                                      CheckedFunction<Environment, EnrollmentTokenGenerator, Exception>
+                                                     createEnrollmentTokenFunction){
+        super("Set elastic password and generate enrollment token for initial node");
+        this.clientFunction = clientFunction;
+        this.keyStoreFunction = keyStoreFunction;
+        this.createEnrollmentTokenFunction = createEnrollmentTokenFunction;
+        docker = parser.accepts("docker", "determine that we are running in docker");
+    }
+
+    public static void main(String[] args) throws Exception {
+        exit(new BootstrapPasswordAndEnrollmentTokenForInitialNode().main(args, Terminal.DEFAULT));
+    }
+
+    @Override
+    protected void execute(Terminal terminal, OptionSet options, Environment env) throws Exception {
+        final char[] keyStorePassword;
+        try {
+            keyStorePassword = terminal.readSecret("");
+        } catch (Exception e) {
+            throw new UserException(ExitCodes.USAGE, null);
+        }
+
+        final SecureString keystorePassword = new SecureString(keyStorePassword);
+        final CommandLineHttpClient client = getClient(env);
+        final EnrollmentTokenGenerator enrollmentTokenGenerator = getEnrollmentTokenGenerator(env);
+        final SecureString bootstrapPassword = readBootstrapPassword(env, keystorePassword);
+        try {
+            client.checkClusterHealthWithRetriesWaitingForCluster(ELASTIC_USER, bootstrapPassword, 5, false);
+        } catch (Exception e) {
+            throw new UserException(ExitCodes.UNAVAILABLE, null);
+        }
+        try {
+            final EnrollmentToken kibanaToken = enrollmentTokenGenerator.createKibanaEnrollmentToken(ELASTIC_USER, bootstrapPassword);
+            terminal.println("Kibana enrollment token: " + kibanaToken.encode());
+            terminal.println("CA fingerprint: " + kibanaToken.getFingerprint());
+        } catch (Exception e) {
+            throw new UserException(ExitCodes.UNAVAILABLE, null);
+        }
+        if (options.has(docker)) {
+            try {
+                final EnrollmentToken nodeToken = enrollmentTokenGenerator.createNodeEnrollmentToken(ELASTIC_USER, bootstrapPassword);
+                terminal.println("Node enrollment token: " + nodeToken.encode());
+            } catch (Exception e) {
+                throw new UserException(ExitCodes.UNAVAILABLE, null);
+            }
+        }
+        if (ReservedRealm.BOOTSTRAP_ELASTIC_PASSWORD.exists(env.settings()) == false) {
+            terminal.println("elastic user password: " + setElasticUserPassword(client, bootstrapPassword));
+        }
+    }
+
+    protected SecureString setElasticUserPassword(CommandLineHttpClient client, SecureString bootstrapPassword) throws Exception {
+        final URL passwordSetUrl = setElasticUserPasswordUrl(client);
+        final HttpResponse response;
+        SecureString password = new SecureString(generatePassword(20));
+        try {
+            response = client.execute("POST", passwordSetUrl, ELASTIC_USER, bootstrapPassword,
+                () -> {
+                    XContentBuilder xContentBuilder = JsonXContent.contentBuilder();
+                    xContentBuilder.startObject().field("password", password).endObject();
+                    return Strings.toString(xContentBuilder);
+                }, CommandLineHttpClient::responseBuilder);
+            if (response.getHttpStatus() != HttpURLConnection.HTTP_OK) {
+                throw new UserException(ExitCodes.UNAVAILABLE, null);
+            }
+        } catch (IOException e) {
+            throw new UserException(ExitCodes.IO_ERROR, null);
+        }
+        return password;
+    }
+
+    SecureString readBootstrapPassword(Environment env, SecureString keystorePassword) throws Exception {
+        final KeyStoreWrapper keyStoreWrapper = keyStoreFunction.apply(env);
+        keyStoreWrapper.decrypt(keystorePassword.getChars());
+        Settings.Builder settingsBuilder = Settings.builder();
+        settingsBuilder.put(env.settings(), true);
+        if (settingsBuilder.getSecureSettings() == null) {
+            settingsBuilder.setSecureSettings(keyStoreWrapper);
+        }
+        final Settings settings = settingsBuilder.build();
+        SecureString bootstrapPassword = ReservedRealm.BOOTSTRAP_ELASTIC_PASSWORD.get(settings);
+        return bootstrapPassword;
+    }
+
+    URL checkClusterHealthUrl(CommandLineHttpClient client) throws MalformedURLException, URISyntaxException {
+        return createURL(new URL(client.getDefaultURL()), "_cluster/health", "?pretty");
+    }
+
+    URL setElasticUserPasswordUrl(CommandLineHttpClient client) throws MalformedURLException, URISyntaxException {
+        return createURL(new URL(client.getDefaultURL()), "/_security/user/" + ELASTIC_USER + "/_password",
+            "?pretty");
+    }
+
+    protected char[] generatePassword(int passwordLength) {
+        final char[] passwordChars = ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789~!@#$%^&*-_=+?").toCharArray();
+        char[] characters = new char[passwordLength];
+        for (int i = 0; i < passwordLength; ++i) {
+            characters[i] = passwordChars[secureRandom.nextInt(passwordChars.length)];
+        }
+        return characters;
+    }
+}