Module org.elasticsearch.security

Package org.elasticsearch.xpack.security.authc.oidc

Class OpenIdConnectRealm

java.lang.Object

org.elasticsearch.xpack.core.security.authc.Realm

org.elasticsearch.xpack.security.authc.oidc.OpenIdConnectRealm

All Implemented Interfaces:

Closeable, AutoCloseable, Comparable<Realm>, Releasable

public class OpenIdConnectRealm
extends Realm
implements Releasable

Nested Class Summary

Nested classes/interfaces inherited from class org.elasticsearch.xpack.core.security.authc.Realm

Realm.Factory

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONTEXT_TOKEN_DATA

Fields inherited from class org.elasticsearch.xpack.core.security.authc.Realm

config, logger

Constructor Summary

Constructors

Constructor	Description
OpenIdConnectRealm(RealmConfig config, SSLService sslService, UserRoleMapper roleMapper, ResourceWatcherService watcherService)

Method Summary

Modifier and Type	Method	Description
void	authenticate(AuthenticationToken token, ActionListener<AuthenticationResult<User>> listener)
OpenIdConnectPrepareAuthenticationResponse	buildAuthenticationRequestUri(String existingState, String existingNonce, String loginHint)	Creates the URI for an OIDC Authentication Request from the realm configuration using URI Query String Serialization and possibly generates a state parameter and a nonce.
OpenIdConnectLogoutResponse	buildLogoutResponse(com.nimbusds.jwt.JWT idTokenHint)
void	close()
void	initialize(Iterable<Realm> realms, XPackLicenseState licenseState)
boolean	isIssuerValid(String issuer)
void	lookupUser(String username, ActionListener<User> listener)
boolean	supports(AuthenticationToken token)
AuthenticationToken	token(ThreadContext context)

Methods inherited from class org.elasticsearch.xpack.core.security.authc.Realm

compareTo, getAuthenticationFailureHeaders, name, order, realmRef, setRealmRef, toString, type, usageStats

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

CONTEXT_TOKEN_DATA

public static final String CONTEXT_TOKEN_DATA

See Also:

• Constant Field Values

Constructor Details

OpenIdConnectRealm

public OpenIdConnectRealm(RealmConfig config,
 SSLService sslService,
 UserRoleMapper roleMapper,
 ResourceWatcherService watcherService)

Method Details

initialize

public void initialize(Iterable<Realm> realms,
 XPackLicenseState licenseState)

Overrides:

initialize in class Realm

supports

public boolean supports(AuthenticationToken token)

Specified by:

supports in class Realm

token

public AuthenticationToken token(ThreadContext context)

Specified by:

token in class Realm

authenticate

public void authenticate(AuthenticationToken token,
 ActionListener<AuthenticationResult<User>> listener)

Specified by:

authenticate in class Realm

lookupUser

public void lookupUser(String username,
 ActionListener<User> listener)

Specified by:

lookupUser in class Realm

buildAuthenticationRequestUri

public OpenIdConnectPrepareAuthenticationResponse buildAuthenticationRequestUri(@Nullable
 String existingState,
 @Nullable
 String existingNonce,
 @Nullable
 String loginHint)

Creates the URI for an OIDC Authentication Request from the realm configuration using URI Query String Serialization and possibly generates a state parameter and a nonce. It then returns the URI, state and nonce encapsulated in a OpenIdConnectPrepareAuthenticationResponse. A facilitator can provide a state and a nonce parameter in two cases:

• In case of Kibana, it allows for a better UX by ensuring that all requests to an OpenID Connect Provider within the same browser context (even across tabs) will use the same state and nonce values.
• In case of custom facilitators, the implementer might require/support generating the state parameter in order to tie this to an anti-XSRF token.

Parameters:

existingState - An existing state that can be reused or null if we need to generate one

existingNonce - An existing nonce that can be reused or null if we need to generate one

loginHint - A String with a login hint to add to the authentication request in case of a 3rd party initiated login

Returns:

an OpenIdConnectPrepareAuthenticationResponse

isIssuerValid

public boolean isIssuerValid(String issuer)

buildLogoutResponse

public OpenIdConnectLogoutResponse buildLogoutResponse(com.nimbusds.jwt.JWT idTokenHint)

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Specified by:

close in interface Releasable