Add API Keys app to Management > Security. #45740

cjcenizal · 2019-09-14T01:01:35Z

Release note

The API Keys app allows users to view and invalidate their own API keys and administrators to view and invalidate all users' API keys.

Details

Loading state

API keys not enabled state

Loading error state

Not allowed state

If the user doesn't have manage_security, manage_api_key, and/or manage_own_api_key permissions, they'll be disallowed from using this app.

Admin view

If the user has manage_security or manage_api_key privileges, they have the ability to see and invalidate all users' API keys, as well as see which API key was created by which user in which realm.

Empty prompt:

Non-admin view

If the user only has the manage_own_api_key privilege then they'll see a list of only their own keys. User and Realm is excluded from the table because this information would be redundant.

Empty prompt:

To test

Run Elasticsearch with a flag enabled API keys:

yarn es snapshot --license=trial -E xpack.security.authc.api_key.enabled=true

Create an API key in Console:

POST /_security/api_key
{
  "name": "my-api-key",
  "expiration": "1d"
}

Verify that it shows up in the table with the expected information.

To test with limited privileges

Create a new role, and assign it the privilege you want to test (manage_security, manage_api_key, and/or manage_own_api_key).
Create a new user, with this new role and kibana_user.
Log out and log back in as this user.

elasticmachine · 2019-09-14T01:01:37Z

Pinging @elastic/kibana-security

cjcenizal · 2019-09-14T01:06:34Z

CC @jethr0null @bytebilly @roncohen

elasticmachine · 2019-09-14T02:34:16Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

bytebilly · 2019-09-16T10:01:00Z

@cjcenizal I like it!

This allows users to manage their own keys, that is great, but if I get it correctly it doesn't allow "admins" to manage the entire list of keys (e.g., application keys for APM).
Since this scenario is where the discussion started, I want to be sure that we are all aware of that.

I'm not sure if we need to expose the ID field, since we already have the Name field and it should be unique per-user (see elastic/elasticsearch#46646). Probably the ID field is not really interesting for users, and I feel it could be entirely transparent to the UI.

What do you think?

legrego · 2019-09-16T12:50:47Z

This allows users to manage their own keys, that is great, but if I get it correctly it doesn't allow "admins" to manage the entire list of keys (e.g., application keys for APM).

I haven't pulled this PR down to look yet, but if this is the case, maybe API key management would make more sense as part of the user profile page, rather than under the security management interface?

bytebilly · 2019-09-16T13:03:39Z

I haven't pulled this PR down to look yet, but if this is the case, maybe API key management would make more sense as part of the user profile page, rather than under the security management interface?

It makes sense, as this is normally the place where you manage your own API keys in other software (GitHub, GitLab, etc).

I'm still wondering how the "admin" management works. If we want to reuse the same panel for both "admin" and "own" flows, probably the user profile doesn't fit very well since it's not the place I'd go, as an "admin", to manage the keys for the entire instance. Having two places where the same component is reused makes sense, anyway, from a logical point of view.

legrego · 2019-09-16T13:07:55Z

I'm still wondering how the "admin" management works. If we want to reuse the same panel for both "admin" and "own" flows, probably the user profile doesn't fit very well since it's not the place I'd go, as an "admin", to manage the keys for the entire instance.

I agree, the management interface to administer other user's keys wouldn't make sense in the user profile. I would expect that to live in the Management -> Security section. It's similar to how user management works today: Users can access their own account via the user profile page, and change their password from there if necessary. Administrators can go to the Management -> Security -> Users view to manage other user accounts.

cjcenizal · 2019-09-17T00:43:47Z

This allows users to manage their own keys, that is great, but if I get it correctly it doesn't allow "admins" to manage the entire list of keys

Yes, this is correct. It seems like the current API doesn't expose an easy way of retrieving all existing keys. Do you know who I could ping about that / would you mind following up on that for me?

Probably the ID field is not really interesting for users, and I feel it could be entirely transparent to the UI.

Works for me. I will move this detail into a separate detail panel and out of the table.

I haven't pulled this PR down to look yet, but if this is the case, maybe API key management would make more sense as part of the user profile page, rather than under the security management interface?

I think this makes a lot of sense. I'll make this change, thanks for the suggestion!

bytebilly · 2019-09-17T13:39:44Z

Do you know who I could ping about that / would you mind following up on that for me?

I'll bring this question to the team, and we'll take the opportunity to talk about the future of API keys API (inception intended 🙂).
Updates here, as soon as possible.

bmcconaghy · 2019-09-17T14:40:28Z

Playing around with the get API keys API, looks like there’s not currently a way to list all API keys. If you know a specific username and you’re an admin, you can list their keys. Wildcards don’t work for username, and if you specify only a realm_name, you get nothing back. The alerting project was hoping for a screen where an admin could go in and disable all API keys for a given user, say they’ve left the company, or have had their access revoked or changed. CJ had a good idea where you could select another user and then be shown all their keys. Verified that I can see other user's keys with cluster "all" privilege.

bytebilly · 2019-09-20T13:39:51Z

@cjcenizal based on discussions we had, we should carefully consider the use case that the feature is trying to address (limited scope service accounts), and defer the personal access token flow when/if we'll move in that direction.

I feel the UX for this is essential to guarantee that the current API keys are used properly and not misunderstood in scope.

Discussion about getting more information in the response is in elastic/elasticsearch#46887.

elasticmachine · 2019-10-01T00:57:30Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request

elasticmachine · 2019-10-03T01:34:57Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: c0673d258b85820409f5949a276763bf326f9437

elasticmachine · 2019-10-04T23:53:26Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 82c1c06824739bdf347da0553dfb7342d1b0b4f1

…y keys past their expiration dates.

Using the Shield plugin methods instead

…ey-list

- Use '/internal/security' route. - Move to internal v1 directory. - Use Joi validation.

… comments.

cjcenizal · 2019-10-12T00:47:44Z

@kobelb @gchaps @alisonelizabeth Thanks for your feedback! I've incorporated the changes I think are appropriate for this stage. Brandon, could you please re-review and approve if you're OK with merging this?

elasticmachine · 2019-10-12T02:12:42Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: e58ab8e

elasticmachine · 2019-10-14T16:39:30Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 56167df

cjcenizal · 2019-10-14T17:21:55Z

Retest

elasticmachine · 2019-10-14T18:47:19Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 56167df

Last nit-picks, I promise

…s immediately.

elasticmachine · 2019-10-14T20:13:27Z

💔 Build Failed

continuous-integration/kibana-ci/pull-request
Commit: 5da0a8f

elasticmachine · 2019-10-14T21:21:34Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 8e6b934

elasticmachine · 2019-10-14T23:56:09Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 8e6b934

* Add API Keys app to Management > Security. - For admins, list all API Keys created by the user: Name, Date Created, Expiration Date, Status, User, and Realm. - For non-admins, list own API keys: Name, Date Created, Expiration Date, and Status. - Surface admin status above table. - Ability to search by Name and Revoke (invalidate) API keys, and filter by User and Realm. - Surface feedback when API keys are disabled on Elasticsearch or when user lacks required permissions. * Add `SectionLoading` component to `es_ui_shared` plugin.

cjcenizal added release_note:enhancement Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! Feature:Users/Roles/API Keys v8.0.0 v7.5.0 labels Sep 14, 2019

cjcenizal requested review from kobelb and bmcconaghy September 14, 2019 01:01

cjcenizal requested a review from a team as a code owner September 14, 2019 01:01

cjcenizal force-pushed the api-key-list branch from bf389df to 7b3049b Compare September 30, 2019 23:50

cjcenizal force-pushed the api-key-list branch from 7b3049b to c0673d2 Compare October 3, 2019 00:27

cjcenizal force-pushed the api-key-list branch from c0673d2 to 82c1c06 Compare October 4, 2019 23:07

cjcenizal changed the title ~~Add API Keys app to Management > Security.~~ [skip-ci] [WIP] Add API Keys app to Management > Security. Oct 4, 2019

cjcenizal force-pushed the api-key-list branch 3 times, most recently from 318b75a to fe9a04a Compare October 7, 2019 22:49

cjcenizal mentioned this pull request Oct 8, 2019

[Mappings editor] Core #47335

Merged

cjcenizal added 7 commits October 11, 2019 16:38

Add time to rendered dates and add Status column so users can identif…

43698ce

…y keys past their expiration dates.

Merge pull request #20 from kobelb/pr/cjcenizal/45740

f0298cd

Using the Shield plugin methods instead

Merge branch 'api-key-list' of github.com:cjcenizal/kibana into api-k…

be05d8d

…ey-list

Address API feedback.

14a5839

- Use '/internal/security' route. - Move to internal v1 directory. - Use Joi validation.

Update copy.

8d725a4

Rename ApiKeyCore type to ApiKeyToInvalidate. Remove unnecessary lint…

3296f33

… comments.

Hide app title and description in inactive states.

e58ab8e

Merge branch 'master' of github.com:elastic/kibana into api-key-list

56167df

kobelb added 2 commits October 14, 2019 11:38

Renaming API_BASE_PATH to INTERNAL_API_BASE_PATH

27be6e6

Making isAdmin required

86ff3aa

Merge pull request #21 from kobelb/pr/cjcenizal/45740

5da0a8f

Last nit-picks, I promise

kobelb approved these changes Oct 14, 2019

View reviewed changes

cjcenizal added 2 commits October 14, 2019 12:50

Fix TS error.

4ad8055

Sort on expiration date by default, so users will see expired API key…

8e6b934

…s immediately.

cjcenizal merged commit e8df2fa into elastic:master Oct 14, 2019

cjcenizal deleted the api-key-list branch October 14, 2019 22:37

cjcenizal mentioned this pull request Oct 14, 2019

[7.x] Add API Keys app to Management > Security. (#45740) #48175

Merged

alisonelizabeth mentioned this pull request Oct 21, 2019

[Security] tests for API keys app #48560

Merged

cwurm mentioned this pull request Oct 30, 2019

Libbeat: Add support for API keys in Elasticsearch outputs elastic/beats#14324

Merged

peterschretlen mentioned this pull request Nov 1, 2019

Performance test API keys in Elasticsearch #49397

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add API Keys app to Management > Security. #45740

Add API Keys app to Management > Security. #45740

cjcenizal commented Sep 14, 2019 •

edited

Loading

elasticmachine commented Sep 14, 2019

cjcenizal commented Sep 14, 2019

elasticmachine commented Sep 14, 2019

bytebilly commented Sep 16, 2019

legrego commented Sep 16, 2019

bytebilly commented Sep 16, 2019

legrego commented Sep 16, 2019

cjcenizal commented Sep 17, 2019 •

edited

Loading

bytebilly commented Sep 17, 2019

bmcconaghy commented Sep 17, 2019

bytebilly commented Sep 20, 2019 •

edited

Loading

elasticmachine commented Oct 1, 2019

elasticmachine commented Oct 3, 2019

elasticmachine commented Oct 4, 2019

cjcenizal commented Oct 12, 2019

elasticmachine commented Oct 12, 2019

elasticmachine commented Oct 14, 2019

cjcenizal commented Oct 14, 2019

elasticmachine commented Oct 14, 2019

elasticmachine commented Oct 14, 2019

elasticmachine commented Oct 14, 2019

elasticmachine commented Oct 14, 2019

Add API Keys app to Management > Security. #45740

Add API Keys app to Management > Security. #45740

Conversation

cjcenizal commented Sep 14, 2019 • edited Loading

Release note

Details

Loading state

API keys not enabled state

Loading error state

Not allowed state

Admin view

Non-admin view

To test

To test with limited privileges

elasticmachine commented Sep 14, 2019

cjcenizal commented Sep 14, 2019

elasticmachine commented Sep 14, 2019

💔 Build Failed

bytebilly commented Sep 16, 2019

legrego commented Sep 16, 2019

bytebilly commented Sep 16, 2019

legrego commented Sep 16, 2019

cjcenizal commented Sep 17, 2019 • edited Loading

bytebilly commented Sep 17, 2019

bmcconaghy commented Sep 17, 2019

bytebilly commented Sep 20, 2019 • edited Loading

elasticmachine commented Oct 1, 2019

💔 Build Failed

elasticmachine commented Oct 3, 2019

💔 Build Failed

elasticmachine commented Oct 4, 2019

💔 Build Failed

cjcenizal commented Oct 12, 2019

elasticmachine commented Oct 12, 2019

💔 Build Failed

elasticmachine commented Oct 14, 2019

💔 Build Failed

cjcenizal commented Oct 14, 2019

elasticmachine commented Oct 14, 2019

💔 Build Failed

elasticmachine commented Oct 14, 2019

💔 Build Failed

elasticmachine commented Oct 14, 2019

💚 Build Succeeded

elasticmachine commented Oct 14, 2019

💚 Build Succeeded

cjcenizal commented Sep 14, 2019 •

edited

Loading

cjcenizal commented Sep 17, 2019 •

edited

Loading

bytebilly commented Sep 20, 2019 •

edited

Loading