[UIAM] Cloud API key authentication #128440
Conversation
n1v0lg
added
>non-issue
:Security/Authentication
elasticsearchmachine
added
serverless-linked
| @@ -128,6 +129,10 @@ default ServiceAccountTokenStore getServiceAccountTokenStore(SecurityComponents | |||
| return null; | |||
| } | |||
|
|
|||
| default CloudApiKeyService getCloudApiKeyService(SecurityComponents components) { | |||
| return null; | |||
| } | |||
There was a problem hiding this comment.
I really don't love this. Is there a reason you specifically want a pluggable CloudApiKeyService rather than just additional authenticators?
That is, I would have opted to have a more generic extension point and push most of the CloudApiKey code into the extension itself rather than in core security.
There was a problem hiding this comment.
That was my original idea too. It would require moving quite a lot of classes around though since Authenticator is not accessible from SecurityExtension:
SecurityExtensionis inorg.elasticsearch.xpack.core.securitywhich does not have access toAuthenticatorAuthenticatoris inorg.elasticsearch.xpack.security.authcwhich depends onorg.elasticsearch.xpack.core.security
Moving it would require quite a few classes getting pulled up -- it feels like something we can follow up on in a bigger refactor subsequently but let me know if it's too big a blocker for you.
There was a problem hiding this comment.
One thing we could consider is injecting a cloud API key authenticator like class into ApiKeyAuthenticator
There was a problem hiding this comment.
I pushed a commit that uses a CustomApiKeyAuthenticator extension point -- as discussed on Slack.
This PR adds a new cloud API key subject type and authenticator, and an extension point for internal plugins to inject custom implementations for cloud API key authentication.
Resolves: ES-11882