---
setup:
- skip:
    features:
    - "headers"
    - "transform_and_set"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "api_key_granter_role"
      body: "{\n  \"cluster\": [\"grant_api_key\"]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "api_key_grant_target_role"
      body: "{\n  \"cluster\": [\"manage_token\"],\n  \"indices\": [\n    {\n    \
        \  \"names\": \"index\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "api_key_grant_runas_role"
      body: "{\n  \"run_as\": [\"api_key_grant_target_user\"]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_granter"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"api_key_granter_role\"\
        \ ],\n  \"full_name\" : \"API key granter\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_grant_target_user"
      body: "{\n  \"password\" : \"x-pack-test-password-2\",\n  \"roles\" : [ \"api_key_grant_target_role\"\
        \ ],\n  \"full_name\" : \"API key grant target user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_grant_runas_user"
      body: "{\n  \"password\" : \"x-pack-test-password-3\",\n  \"roles\" : [ \"api_key_grant_runas_role\"\
        \ ],\n  \"full_name\" : \"API key grant runas user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_role:
      name: "api_key_granter_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "api_key_grant_target_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "api_key_grant_runas_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_granter"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_grant_target_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_grant_runas_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test grant api key with password:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudGVyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key\",\n    \"expiration\"\
        : \"1d\",\n    \"role_descriptors\": {\n      \"role\": {\n        \"index\"\
        : [\n          {\n            \"names\": [\"index\"],\n            \"privileges\"\
        : [\"read\"]\n          }\n        ]\n      }\n    }\n  },\n  \"grant_type\"\
        : \"password\",\n  \"username\": \"api_key_grant_target_user\",\n  \"password\"\
        : \"x-pack-test-password-2\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_grant_target_user"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "my-api-key"
- do:
    security.clear_api_key_cache:
      ids: "${api_key_id}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test grant api key with token:
- do:
    security.get_token:
      body:
        grant_type: "password"
        username: "api_key_grant_target_user"
        password: "x-pack-test-password-2"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    type: "Bearer"
- is_true: "access_token"
- set:
    access_token: "token"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudGVyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key\",\n    \"expiration\"\
        : \"1d\",\n    \"role_descriptors\": {\n      \"role\": {\n        \"index\"\
        : [\n          {\n            \"names\": [\"index\"],\n            \"privileges\"\
        : [\"read\"]\n          }\n        ]\n      }\n    }\n  },\n  \"grant_type\"\
        : \"access_token\",\n  \"access_token\": \"$token\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_grant_target_user"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "my-api-key"
- do:
    security.clear_api_key_cache:
      ids: "${api_key_id}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test grant api key with non-JWT token and client authentication fails:
- do:
    security.get_token:
      body:
        grant_type: "password"
        username: "api_key_grant_target_user"
        password: "x-pack-test-password-2"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    type: "Bearer"
- is_true: "access_token"
- set:
    access_token: "token"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudGVyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    catch: "bad_request"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"wrong-api-key\"\n  },\n  \"grant_type\"\
        : \"access_token\",\n  \"access_token\": \"$token\",\n  \"client_authentication\"\
        : {\n    \"scheme\": \"SharedSecret\",\n    \"value\": \"whatever\"\n  }\n\
        }\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "[client_authentication] not supported with the supplied access_token\
      \ type"
---
Test grant api key forbidden:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudF90YXJnZXRfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZC0y"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    catch: "forbidden"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key\",\n    \"expiration\"\
        : \"1d\",\n    \"role_descriptors\": {\n      \"role\": {\n        \"index\"\
        : [\n          {\n            \"names\": [\"index\"],\n            \"privileges\"\
        : [\"read\"]\n          }\n        ]\n      }\n    }\n  },\n  \"grant_type\"\
        : \"password\",\n  \"username\": \"api_key_granter\",\n  \"password\": \"\
        x-pack-test-password\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "action [cluster:admin/xpack/security/api_key/grant] is unauthorized\
      \ for user [api_key_grant_target_user] with effective roles [api_key_grant_target_role],\
      \ this action is granted by the cluster privileges [grant_api_key,manage_api_key,manage_security,all]"
---
Test grant api key forbidden with manage_own_api_key privilege:
- do:
    security.put_role:
      name: "api_key_grant_target_role"
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"indices\": [\n    {\n\
        \      \"names\": \"index\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n\
        }\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudF90YXJnZXRfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZC0y"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- set:
    id: "api_key_id"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudF90YXJnZXRfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZC0y"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    catch: "forbidden"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key\"\n  },\n  \"grant_type\"\
        : \"password\",\n  \"username\": \"api_key_grant_target_user\",\n  \"password\"\
        : \"x-pack-test-password-2\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "action [cluster:admin/xpack/security/api_key/grant] is unauthorized\
      \ for user [api_key_grant_target_user] with effective roles [api_key_grant_target_role],\
      \ this action is granted by the cluster privileges [grant_api_key,manage_api_key,manage_security,all]"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudF90YXJnZXRfdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZC0y"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    catch: "forbidden"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key\"\n  },\n  \"grant_type\"\
        : \"password\",\n  \"username\": \"api_key_granter\",\n  \"password\": \"\
        x-pack-test-password\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "action [cluster:admin/xpack/security/api_key/grant] is unauthorized\
      \ for user [api_key_grant_target_user] with effective roles [api_key_grant_target_role],\
      \ this action is granted by the cluster privileges [grant_api_key,manage_api_key,manage_security,all]"
- do:
    security.clear_api_key_cache:
      ids: "${api_key_id}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test grant api key with password and run_as:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudGVyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key-with-password-runas\"\
        \n  },\n  \"grant_type\": \"password\",\n  \"username\": \"api_key_grant_runas_user\"\
        ,\n  \"password\": \"x-pack-test-password-3\",\n  \"run_as\": \"api_key_grant_target_user\"\
        \n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key-with-password-runas"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_grant_target_user"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "my-api-key-with-password-runas"
---
Test grant api key with access token and run_as:
- do:
    security.get_token:
      body:
        grant_type: "password"
        username: "api_key_grant_runas_user"
        password: "x-pack-test-password-3"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    type: "Bearer"
- is_true: "access_token"
- set:
    access_token: "token"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9ncmFudGVyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.grant_api_key:
      body: "{\n  \"api_key\": {\n    \"name\": \"my-api-key-with-access-token-runas\"\
        \n  },\n  \"grant_type\": \"access_token\",\n  \"access_token\": \"$token\"\
        ,\n  \"run_as\": \"api_key_grant_target_user\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key-with-access-token-runas"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_grant_target_user"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "my-api-key-with-access-token-runas"
