Merge branch 'master' into ingest/fix/ds-no-pkg

docs/user/security/api-keys/index.asciidoc

@@ -3,18 +3,18 @@
 === API Keys
 
 
-API keys enable you to create secondary credentials so that you can send 
-requests on behalf of the user. Secondary credentials have 
-the same or lower access rights. 
+API keys enable you to create secondary credentials so that you can send
+requests on behalf of the user. Secondary credentials have
+the same or lower access rights.
 
 For example, if you extract data from an {es} cluster on a daily
-basis, you might create an API key tied to your credentials, 
-configure it with minimum access, 
+basis, you might create an API key tied to your credentials,
+configure it with minimum access,
 and then put the API credentials into a cron job.
-Or, you might create API keys to automate ingestion of new data from 
-remote sources, without a live user interaction. 
+Or, you might create API keys to automate ingestion of new data from
+remote sources, without a live user interaction.
 
-You can create API keys from the {kib} Console. To view and invalidate 
+You can create API keys from the {kib} Console. To view and invalidate
 API keys, use *Management > Security > API Keys*.
 
 [role="screenshot"]
@@ -24,63 +24,80 @@ image:user/security/api-keys/images/api-keys.png["API Keys UI"]
 [[api-keys-service]]
 === {es} API key service
 
-The {es} API key service is automatically enabled when you configure 
-{ref}/configuring-tls.html#tls-http[TLS on the HTTP interface]. 
+The {es} API key service is automatically enabled when you configure
+{ref}/configuring-tls.html#tls-http[TLS on the HTTP interface].
 This ensures that clients are unable to send API keys in clear-text.
 
-When HTTPS connections are not enabled between {kib} and {es}, 
+When HTTPS connections are not enabled between {kib} and {es},
 you cannot create or manage API keys, and you get an error message.
-For more information, see the 
-{ref}/security-api-create-api-key.html[{es} API key documentation], 
+For more information, see the
+{ref}/security-api-create-api-key.html[{es} API key documentation],
 or contact your system administrator.
 
 [float]
 [[api-keys-security-privileges]]
 === Security privileges
 
-You must have the `manage_security`, `manage_api_key`, or the `manage_own_api_key` 
-cluster privileges to use API keys in {kib}. You can manage roles in 
-*Management > Security > Roles*, or use the <<role-management-api, {kib} Role Management API>>. 
+You must have the `manage_security`, `manage_api_key`, or the `manage_own_api_key`
+cluster privileges to use API keys in {kib}. You can manage roles in
+*Management > Security > Roles*, or use the <<role-management-api, {kib} Role Management API>>.
 
 
 [float]
 [[create-api-key]]
 === Create an API key
-You can {ref}/security-api-create-api-key.html[create an API key] from 
-the Kibana Console. For example:
+You can {ref}/security-api-create-api-key.html[create an API key] from
+the {kib} Console. This example shows how to create an API key
+to authenticate to a <<api, Kibana API>>.
 
 [source,js]
 POST /_security/api_key
 {
- "name": "my_api_key",
- "expiration": "1d"
+ "name": "kibana_api_key",
 }
 
-This creates an API key with the name `my_api_key` that 
-expires after one day. API key names must be globally unique. 
-An expiration date is optional and follows {ref}/common-options.html#time-units[{es} time unit format]. 
+This creates an API key with the
+name `kibana_api_key`. API key
+names must be globally unique.
+An expiration date is optional and follows
+{ref}/common-options.html#time-units[{es} time unit format].
 When an expiration is not provided, the API key does not expire.
 
+The response should look something like this:
+
+[source,js]
+{
+ "id" : "XFcbCnIBnbwqt2o79G4q",
+ "name" : "kibana_api_key",
+ "api_key" : "FD6P5UA4QCWlZZQhYF3YGw"
+}
+
+Now, you can use the API key to request {kib} roles. You will need
+to base64-encode the `id` and `api_key` provided in the response
+and add it to your request as an authorization header. For example:
+
+[source,js]
+curl --location --request GET 'http://localhost:5601/api/security/role' \
+--header 'Content-Type: application/json;charset=UTF-8' \
+--header 'kbn-xsrf: true' \
+--header 'Authorization: ApiKey aVZlLUMzSUJuYndxdDJvN0k1bU46aGxlYUpNS2lTa2FKeVZua1FnY1VEdw==' \
+
 [float]
 [[view-api-keys]]
 === View and invalidate API keys
-The *API Keys* UI lists your API keys, including the name, date created, 
+The *API Keys* feature in Kibana lists your API keys, including the name, date created,
 and expiration date. If an API key expires, its status changes from `Active` to `Expired`.
 
-If you have `manage_security` or `manage_api_key` permissions, 
-you can view the API keys of all users, and see which API key was 
+If you have `manage_security` or `manage_api_key` permissions,
+you can view the API keys of all users, and see which API key was
 created by which user in which realm.
 If you have only the `manage_own_api_key` permission, you see only a list of your own keys.
 
-You can invalidate API keys individually or in bulk. 
+You can invalidate API keys individually or in bulk.
 Invalidated keys are deleted in batch after seven days.
 
 [role="screenshot"]
 image:user/security/api-keys/images/api-key-invalidate.png["API Keys invalidate"]
 
-You cannot modify an API key. If you need additional privileges, 
+You cannot modify an API key. If you need additional privileges,
 you must create a new key with the desired configuration and invalidate the old key.
-
-
-
-

packages/kbn-es/src/utils/native_realm.js

@@ -76,10 +76,6 @@ exports.NativeRealm = class NativeRealm {
  }
 
  const reservedUsers = await this.getReservedUsers();
- if (!reservedUsers || reservedUsers.length < 1) {
- throw new Error('no reserved users found, unable to set native realm passwords');
- }
-
  await Promise.all(
  reservedUsers.map(async user => {
  await this.setPassword(user, options[`password.${user}`]);
@@ -88,16 +84,18 @@ exports.NativeRealm = class NativeRealm {
  }
 
  async getReservedUsers() {
- const users = await this._autoRetry(async () => {
- return await this._client.security.getUser();
- });
+ return await this._autoRetry(async () => {
+ const resp = await this._client.security.getUser();
+ const usernames = Object.keys(resp.body).filter(
+ user => resp.body[user].metadata._reserved === true
+ );
 
- return Object.keys(users.body).reduce((acc, user) => {
- if (users.body[user].metadata._reserved === true) {
- acc.push(user);
+ if (!usernames?.length) {
+ throw new Error('no reserved users found, unable to set native realm passwords');
  }
- return acc;
- }, []);
+
+ return usernames;
+ });
  }
 
  async isSecurityEnabled() {
@@ -125,10 +123,9 @@ exports.NativeRealm = class NativeRealm {
  throw error;
  }
 
- this._log.warning(
- 'assuming [elastic] user not available yet, waiting 1.5 seconds and trying again'
- );
- await new Promise(resolve => setTimeout(resolve, 1500));
+ const sec = 1.5 * attempt;
+ this._log.warning(`assuming ES isn't initialized completely, trying again in ${sec} seconds`);
+ await new Promise(resolve => setTimeout(resolve, sec * 1000));
  return await this._autoRetry(fn, attempt + 1);
  }
  }

test/functional/apps/visualize/_tsvb_chart.ts

@@ -28,7 +28,8 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
  const security = getService('security');
  const PageObjects = getPageObjects(['visualize', 'visualBuilder', 'timePicker', 'visChart']);
 
- describe('visual builder', function describeIndexTests() {
+ // FLAKY: https://github.com/elastic/kibana/issues/43150
+ describe.skip('visual builder', function describeIndexTests() {
  this.tags('includeFirefox');
  beforeEach(async () => {
  await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader']);

x-pack/test/functional/apps/dashboard/_async_dashboard.ts

@@ -26,8 +26,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
  'timePicker',
  ]);
 
- // FLAKY: https://github.com/elastic/kibana/issues/65949
- describe.skip('sample data dashboard', function describeIndexTests() {
+ describe('sample data dashboard', function describeIndexTests() {
  before(async () => {
  await PageObjects.common.sleep(5000);
  await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {

x-pack/test/functional_endpoint/apps/endpoint/policy_list.ts

@@ -12,7 +12,8 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
  const testSubjects = getService('testSubjects');
  const policyTestResources = getService('policyTestResources');
 
- describe('When on the Endpoint Policy List', function() {
+ // FLAKY: https://github.com/elastic/kibana/issues/66579
+ describe.skip('When on the Endpoint Policy List', function() {
  this.tags(['ciGroup7']);
  before(async () => {
  await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/policy');
@@ -46,7 +47,7 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
  expect(noItemsFoundMessage).to.equal('No items found');
  });
 
- describe('and policies exists', () => {
+ xdescribe('and policies exists', () => {
  let policyInfo: PolicyTestResourceInfo;
 
  before(async () => {