[8.x](backport #3935) Fix bad error handling in api key auth

changelog/fragments/1726845328-Fix-authentication-return-error-code.yaml

@@ -0,0 +1,33 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: bug-fix
+
+# Change summary; a 80ish characters long description of the change.
+summary: Fix authentication return error code
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+description: |
+ A non-401 error code from elasticsearch will no longer result in a 401 error code being returned to the caller.
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component:
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/fleet-server/pull/3935
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+issue: https://github.com/elastic/fleet-server/issues/3929

internal/pkg/apikey/auth.go

@@ -9,9 +9,12 @@
  "encoding/json"
  "errors"
  "fmt"
+ "net/http"
 
  "github.com/elastic/go-elasticsearch/v8"
  "github.com/elastic/go-elasticsearch/v8/esapi"
+
+ "github.com/elastic/fleet-server/v7/internal/pkg/es"
 )
 
 var (
@@ -33,15 +36,15 @@
 
 // Authenticate will return the SecurityInfo associated with the APIKey (retrieved from Elasticsearch).
 // Note: Prefer the bulk wrapper on this API
-func (k APIKey) Authenticate(ctx context.Context, es *elasticsearch.Client) (*SecurityInfo, error) {
+func (k APIKey) Authenticate(ctx context.Context, client *elasticsearch.Client) (*SecurityInfo, error) {
 
  token := fmt.Sprintf("%s%s", authPrefix, k.Token())
 
  req := esapi.SecurityAuthenticateRequest{
  Header: map[string][]string{AuthKey: []string{token}},
  }
 
- res, err := req.Do(ctx, es)
+ res, err := req.Do(ctx, client)
 
  if err != nil {
  return nil, fmt.Errorf("apikey auth request %s: %w", k.ID, err)
@@ -52,11 +55,18 @@
  }
 
  if res.IsError() {
- returnError := ErrUnauthorized
- if res.StatusCode == 429 {
+ var returnError error
+ switch res.StatusCode {
+ case http.StatusUnauthorized:
+ returnError = ErrUnauthorized
+ case http.StatusTooManyRequests:
  returnError = ErrElasticsearchAuthLimit
  }
- return nil, fmt.Errorf("%w: %w", returnError, fmt.Errorf("apikey auth response %s: %s", k.ID, res.String()))
+ if returnError != nil {
+ return nil, fmt.Errorf("%w: %w", returnError, fmt.Errorf("apikey auth response %s: %s", k.ID, res.String()))
+ }
+ // body is not parsed to not give the caller too much information
+ return nil, es.TranslateError(res.StatusCode, nil)
  }
 
  var info SecurityInfo

internal/pkg/apikey/auth_test.go

@@ -7,6 +7,7 @@
 import (
  "context"
  "encoding/base64"
+ "fmt"
  "net/http"
  "testing"
 
@@ -19,7 +20,7 @@
  rawToken = " foo:bar"
 )
 
 func setup(t *testing.T, statusCode int) (context.Context, *APIKey, *elasticsearch.Client) {
  token := base64.StdEncoding.EncodeToString([]byte(rawToken))
  apiKey, err := NewAPIKeyFromToken(token)
  assert.NoError(t, err)
@@ -32,15 +33,41 @@
 }
 
 func TestAuth429(t *testing.T) {
- ctx, apiKey, mockES := setup(t, 429)
+ ctx, apiKey, mockES := setup(t, http.StatusTooManyRequests)
  _, err := apiKey.Authenticate(ctx, mockES)
 
  assert.Equal(t, "elasticsearch auth limit: apikey auth response foo: [429 Too Many Requests] ", err.Error())
 }
 
 func TestAuth401(t *testing.T) {
- ctx, apiKey, mockES := setup(t, 401)
+ ctx, apiKey, mockES := setup(t, http.StatusUnauthorized)
  _, err := apiKey.Authenticate(ctx, mockES)
 
  assert.Equal(t, "unauthorized: apikey auth response foo: [401 Unauthorized] ", err.Error())
 }
+
+func TestAuthOtherErrors(t *testing.T) {
+ scenarios := []struct {
+ StatusCode int
+ }{
+ {StatusCode: http.StatusBadRequest},
+ // 401 is handled in TestAuth401
+ {StatusCode: http.StatusForbidden},
+ {StatusCode: http.StatusNotFound},
+ {StatusCode: http.StatusMethodNotAllowed},
+ {StatusCode: http.StatusConflict},
+ // 429 is handled in TestAuth429
+ {StatusCode: http.StatusInternalServerError},
+ {StatusCode: http.StatusBadGateway},
+ {StatusCode: http.StatusServiceUnavailable},
+ {StatusCode: http.StatusGatewayTimeout},
+ }
+ for _, scenario := range scenarios {
+ t.Run(fmt.Sprintf("%d", scenario.StatusCode), func(t *testing.T) {
+ ctx, apiKey, mockES := setup(t, scenario.StatusCode)
+ _, err := apiKey.Authenticate(ctx, mockES)
+
+ assert.Equal(t, fmt.Sprintf("elastic fail %d", scenario.StatusCode), err.Error())
+ })
+ }
+}