Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow non super users to create API keys #40029

Closed
bizybot opened this issue Mar 14, 2019 · 1 comment · Fixed by #40028
Closed

Allow non super users to create API keys #40029

bizybot opened this issue Mar 14, 2019 · 1 comment · Fixed by #40028
Assignees
@bizybot
Labels
>bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)

Comments

@bizybot
Copy link
Contributor

bizybot commented Mar 14, 2019

A non-super user cannot create API keys and fails with the following exception:
action [indices:data/read/search] is unauthorized for user [non-super-user]

Expected Behavior:
The non-super user should be able to create API keys.
@bizybot bizybot added >bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Mar 14, 2019
@bizybot bizybot self-assigned this Mar 14, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@bizybot bizybot mentioned this issue Mar 14, 2019
Merged
bizybot added a commit that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (#40028)
3c1d851 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes #40029
bizybot added a commit to bizybot/elasticsearch that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (elastic#40028)
4b50203 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes elastic#40029
@bizybot bizybot mentioned this issue Mar 21, 2019
Merged
bizybot added a commit to bizybot/elasticsearch that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (elastic#40028)
81165a9 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes elastic#40029
@bizybot bizybot mentioned this issue Mar 21, 2019
Merged
bizybot added a commit to bizybot/elasticsearch that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (elastic#40028)
b24e825 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes elastic#40029
@bizybot bizybot mentioned this issue Mar 21, 2019
Merged
bizybot added a commit that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (#40028) (#40286)
5d30df5 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes #40029
bizybot added a commit that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (#40028) (#40287)
34c939e 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes #40029
bizybot added a commit that referenced this issue Mar 21, 2019
@bizybot
Fix so non super users can also create API keys (#40028) (#40288)
145e10b 
When creating API keys we check for if API key with
the same key name already exists and fail the request if it does.
The check should have been performed with XPackSecurityUser
instead of the authenticated user. This caused the request to fail
in case of the non-super user trying to create an API key.
This commit fixes by executing search action with SECURITY_ORIGIN
so it can be executed with XPackSecurityUser.
Also fixed the Rest test to avoid using a user with `super_user` role.

Closes #40029
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bizybot bizybot

Labels
>bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Allow non super users to create API keys bizybot/elasticsearch
2 participants
@bizybot @elasticmachine