Module org.elasticsearch.security

Package org.elasticsearch.xpack.security.transport

Class CrossClusterAccessTransportInterceptor

java.lang.Object

org.elasticsearch.xpack.security.transport.CrossClusterAccessTransportInterceptor

All Implemented Interfaces:

RemoteClusterTransportInterceptor

public class CrossClusterAccessTransportInterceptor
extends Object
implements RemoteClusterTransportInterceptor

Constructor Summary

Constructors

Constructor	Description
CrossClusterAccessTransportInterceptor(Settings settings, ThreadPool threadPool, AuthenticationService authcService, AuthorizationService authzService, SecurityContext securityContext, CrossClusterAccessAuthenticationService crossClusterAccessAuthcService, CrossClusterApiKeySignatureManager crossClusterApiKeySignatureManager, XPackLicenseState licenseState)

Method Summary

Modifier and Type	Method	Description
Optional<ServerTransportFilter>	getRemoteProfileTransportFilter(SslProfile sslProfile, DestructiveOperations destructiveOperations)	Allows interceptors to provide a custom ServerTransportFilter implementation for intercepting requests for RemoteClusterPortSettings.REMOTE_CLUSTER_PROFILE transport profile.
boolean	hasRemoteClusterAccessHeadersInContext(SecurityContext securityContext)	Returns true if any of the remote cluster access headers are in the security context.
TransportInterceptor.AsyncSender	interceptSender(TransportInterceptor.AsyncSender sender)	Allows to intercept all transport requests on the sender side.
boolean	isRemoteClusterConnection(Transport.Connection connection)	This method returns true if the outbound connection is targeting a remote cluster.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CrossClusterAccessTransportInterceptor

public CrossClusterAccessTransportInterceptor(Settings settings,
 ThreadPool threadPool,
 AuthenticationService authcService,
 AuthorizationService authzService,
 SecurityContext securityContext,
 CrossClusterAccessAuthenticationService crossClusterAccessAuthcService,
 CrossClusterApiKeySignatureManager crossClusterApiKeySignatureManager,
 XPackLicenseState licenseState)

Method Details

interceptSender

public TransportInterceptor.AsyncSender interceptSender(TransportInterceptor.AsyncSender sender)

Description copied from interface: RemoteClusterTransportInterceptor

Allows to intercept all transport requests on the sender side.

Specified by:

interceptSender in interface RemoteClusterTransportInterceptor

isRemoteClusterConnection

public boolean isRemoteClusterConnection(Transport.Connection connection)

Description copied from interface: RemoteClusterTransportInterceptor

This method returns true if the outbound connection is targeting a remote cluster.

Specified by:

isRemoteClusterConnection in interface RemoteClusterTransportInterceptor

getRemoteProfileTransportFilter

public Optional<ServerTransportFilter> getRemoteProfileTransportFilter(SslProfile sslProfile,
 DestructiveOperations destructiveOperations)

Description copied from interface: RemoteClusterTransportInterceptor

Allows interceptors to provide a custom ServerTransportFilter implementation for intercepting requests for RemoteClusterPortSettings.REMOTE_CLUSTER_PROFILE transport profile.

The transport filter is called on the receiver side to filter incoming remote cluster requests and to execute authentication and authorization for all incoming requests.

This method is only called when setting RemoteClusterPortSettings.REMOTE_CLUSTER_SERVER_ENABLED is set to true.

Specified by:

getRemoteProfileTransportFilter in interface RemoteClusterTransportInterceptor

Returns:

a custom ServerTransportFilters for the given transport profile, or an empty optional to fall back to the default transport filter

hasRemoteClusterAccessHeadersInContext

public boolean hasRemoteClusterAccessHeadersInContext(SecurityContext securityContext)

Description copied from interface: RemoteClusterTransportInterceptor

Returns true if any of the remote cluster access headers are in the security context. This method is used to assert we don't have access headers already in the security context, before we even run remote cluster intercepts. Serves as an integrity check that we properly clear the security context between requests.

Specified by:

hasRemoteClusterAccessHeadersInContext in interface RemoteClusterTransportInterceptor