Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add warning about derived API keys to docs #62351

Merged
merged 4 commits into from
Sep 17, 2020
Merged

Add warning about derived API keys to docs #62351

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
238a459
Add warning about derived API keys to docs
tvernum Sep 15, 2020
b885b3a
[DOCS] Nests admonition block
lcawl Sep 15, 2020
03c35a5
Apply suggestions from code review
tvernum Sep 17, 2020
5c3c6e8
Merge branch 'master' into docs/derived-api-key
elasticmachine Sep 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions x-pack/docs/en/rest-api/security/create-api-keys.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,10 @@ Creates an API key for access without requiring basic authentication.

* To use this API, you must have at least the `manage_api_key` cluster privilege.

IMPORTANT: If the credential that is used to authenticate this request is
an API key, then the derived API key that is created cannot have any privileges.
tvernum marked this conversation as resolved.
Show resolved Hide resolved
See the note under `role_descriptors`.

[[security-api-create-api-key-desc]]
==== {api-description-title}

Expand Down Expand Up @@ -57,6 +61,12 @@ thereby limiting the access scope for API keys.
The structure of role descriptor is the same as the request for create role API.
For more details, see <<security-api-put-role, create or update roles API>>.

NOTE: Due to the way in which this permission intersection is calculated, it is not
possible to create an API key that is a child of another API key, unless the derived
key is created without any privileges. In this case, you must explicitly specify a
role descriptor with no privileges, and the derived API key can be used for
tvernum marked this conversation as resolved.
Show resolved Hide resolved
authentication only, but will not have access to call {es} APIs.
tvernum marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, it is not "only" the authentication, but a few actions that requires "the same user", e.g. it can also call GET _security/api_key?owner=true. Without complicating things too much by explaining all the details, maybe we could just drop the only bit.


`expiration`::
(Optional, string) Expiration time for the API key. By default, API keys never
expire.
Expand Down