Expose API key name to the ingest pipeline

docs/reference/ingest/processors/set-security-user.asciidoc

@@ -5,9 +5,9 @@ Sets user-related details (such as `username`,  `roles`, `email`, `full_name`,
 authenticated user to the current document by pre-processing the ingest.
 The `api_key` property is only applicable when the authentication is
 through API key. It is an object containing two fields, `id` and `name`.
+The `realm` property is also an object with two fields, `name` and `type`.
 When using API key authentication, the `realm` property refers to the realm
-from which the API key is created. It is also an object with two fields,
-`name` and `type`.
+from which the API key is created.
 
 IMPORTANT: Requires an authenticated user for the index request.
 

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java

@@ -76,6 +76,10 @@ public RealmRef getLookedUpBy() {
         return lookedUpBy;
     }
 
+    public RealmRef getNominalRealm() {
+        return lookedUpBy == null ? authenticatedBy : lookedUpBy;
+    }
+
     public Version getVersion() {
         return version;
     }

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authc/AuthenticationTests.java

@@ -0,0 +1,33 @@
+/*
+ *
+ *  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ *  * or more contributor license agreements. Licensed under the Elastic License;
+ *  * you may not use this file except in compliance with the Elastic License.
+ *
+ */
+
+package org.elasticsearch.xpack.core.security.authc;
+
+import org.elasticsearch.test.ESTestCase;
+import org.elasticsearch.xpack.core.security.user.User;
+
+public class AuthenticationTests extends ESTestCase {
+
+    public void testWillGetLookupByWhenItExists() {
+        final Authentication.RealmRef authenticatedBy = new Authentication.RealmRef("auth_by", "auth_by_type", "node");
+        final Authentication.RealmRef lookedUpBy = new Authentication.RealmRef("lookup_by", "lookup_by_type", "node");
+        final Authentication authentication = new Authentication(
+            new User("user"), authenticatedBy, lookedUpBy);
+
+        assertEquals(lookedUpBy, authentication.getNominalRealm());
+    }
+
+    public void testWillGetAuthenticateByWhenLookupIsNull() {
+        final Authentication.RealmRef authenticatedBy = new Authentication.RealmRef("auth_by", "auth_by_type", "node");
+        final Authentication authentication = new Authentication(
+            new User("user"), authenticatedBy, null);
+
+        assertEquals(authenticatedBy, authentication.getNominalRealm());
+    }
+
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/ApiKeyService.java

@@ -273,10 +273,8 @@ XContentBuilder newDocument(SecureString apiKey, String name, Authentication aut
             .startObject("creator")
             .field("principal", authentication.getUser().principal())
             .field("metadata", authentication.getUser().metadata())
-            .field("realm", authentication.getLookedUpBy() == null ?
-                authentication.getAuthenticatedBy().getName() : authentication.getLookedUpBy().getName())
-            .field("realm_type", authentication.getLookedUpBy() == null ?
-                authentication.getAuthenticatedBy().getType() : authentication.getLookedUpBy().getType())
+            .field("realm", authentication.getNominalRealm().getName())
+            .field("realm_type", authentication.getNominalRealm().getType())
             .endObject()
             .endObject();
 
@@ -886,7 +884,7 @@ public static String getCreatorRealmName(final Authentication authentication) {
         if (authentication.getAuthenticatedBy().getType().equals(API_KEY_REALM_TYPE)) {
             return (String) authentication.getMetadata().get(API_KEY_CREATOR_REALM_NAME);
         } else {
-            return authentication.getAuthenticatedBy().getName();
+            return authentication.getNominalRealm().getName();
         }
     }
 
@@ -901,7 +899,7 @@ public static String getCreatorRealmType(final Authentication authentication) {
         if (authentication.getAuthenticatedBy().getType().equals(API_KEY_REALM_TYPE)) {
             return (String) authentication.getMetadata().get(API_KEY_CREATOR_REALM_TYPE);
         } else {
-            return authentication.getAuthenticatedBy().getType();
+            return authentication.getNominalRealm().getType();
         }
     }
 

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/ingest/SetSecurityUserProcessor.java

@@ -87,31 +87,39 @@ public IngestDocument execute(IngestDocument ingestDocument) throws Exception {
                     }
                     break;
                 case API_KEY:
-                    final HashMap<String, Object> apiKey = new HashMap<>();
+                    final String apiKey = "api_key";
+                    final Object existingApiKeyField = userObject.get(apiKey);
+                    @SuppressWarnings("unchecked")
+                    final Map<String, Object> apiKeyField =
+                        existingApiKeyField instanceof Map ? (Map<String, Object>) existingApiKeyField : new HashMap<>();
                     Object apiKeyName = authentication.getMetadata().get(ApiKeyService.API_KEY_NAME_KEY);
                     if (apiKeyName != null) {
-                        apiKey.put("name", apiKeyName);
+                        apiKeyField.put("name", apiKeyName);
                     }
                     Object apiKeyId = authentication.getMetadata().get(ApiKeyService.API_KEY_ID_KEY);
                     if (apiKeyId != null) {
-                        apiKey.put("id", apiKeyId);
+                        apiKeyField.put("id", apiKeyId);
                     }
-                    if (false == apiKey.isEmpty()) {
-                        userObject.put("api_key", apiKey);
+                    if (false == apiKeyField.isEmpty()) {
+                        userObject.put(apiKey, apiKeyField);
                     }
                     break;
                 case REALM:
+                    final String realmKey = "realm";
+                    final Object existingRealmField = userObject.get(realmKey);
+                    @SuppressWarnings("unchecked")
+                    final Map<String, Object> realmField =
+                        existingRealmField instanceof Map ? (Map<String, Object>) existingRealmField : new HashMap<>();
                     final Object realmName = ApiKeyService.getCreatorRealmName(authentication);
-                    final Object realmType = ApiKeyService.getCreatorRealmType(authentication);
-                    final HashMap<String, Object> realm = new HashMap<>();
                     if (realmName != null) {
-                        realm.put("name", realmName);
+                        realmField.put("name", realmName);
                     }
+                    final Object realmType = ApiKeyService.getCreatorRealmType(authentication);
                     if (realmType != null) {
-                        realm.put("type", realmType);
+                        realmField.put("type", realmType);
                     }
-                    if (false == realm.isEmpty()) {
-                        userObject.put("realm", realm);
+                    if (false == realmField.isEmpty()) {
+                        userObject.put(realmKey, realmField);
                     }
                     break;
                 case AUTHENTICATION_TYPE:

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ApiKeyServiceTests.java

@@ -566,6 +566,22 @@ public void testApiKeyCacheDisabled() {
         assertNull(cachedApiKeyHashResult);
     }
 
+    public void testWillGetLookupRealmNameWhenItExists() {
+        final Authentication.RealmRef authenticatedBy = new Authentication.RealmRef("auth_by", "auth_by_type", "node");
+        final Authentication.RealmRef lookedUpBy = new Authentication.RealmRef("lookup_by", "lookup_by_type", "node");
+        final Authentication authentication = new Authentication(
+            new User("user"), authenticatedBy, lookedUpBy);
+        assertEquals("lookup_by", ApiKeyService.getCreatorRealmName(authentication));
+    }
+
+    public void testWillGetLookupRealmTypeWhenItExists() {
+        final Authentication.RealmRef authenticatedBy = new Authentication.RealmRef("auth_by", "auth_by_type", "node");
+        final Authentication.RealmRef lookedUpBy = new Authentication.RealmRef("lookup_by", "lookup_by_type", "node");
+        final Authentication authentication = new Authentication(
+            new User("user"), authenticatedBy, lookedUpBy);
+        assertEquals("lookup_by_type", ApiKeyService.getCreatorRealmType(authentication));
+    }
+
     private ApiKeyService createApiKeyService(Settings baseSettings) {
         final Settings settings = Settings.builder()
             .put(XPackSettings.API_KEY_SERVICE_ENABLED_SETTING.getKey(), true)

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/ingest/SetSecurityUserProcessorTests.java

@@ -209,4 +209,31 @@ public void testApiKeyPopulation() throws Exception {
         assertThat(result.get("authentication_type"), equalTo("API_KEY"));
     }
 
+    public void testWillNotOverwriteExistingApiKeyAndRealm() throws Exception {
+        User user = new User(null, null, null);
+        Authentication.RealmRef realmRef = new Authentication.RealmRef(
+            ApiKeyService.API_KEY_REALM_NAME, ApiKeyService.API_KEY_REALM_TYPE, "_node_name");
+        ThreadContext threadContext = new ThreadContext(Settings.EMPTY);
+
+        threadContext.putTransient(AuthenticationField.AUTHENTICATION_KEY, new Authentication(user, realmRef, null, Version.CURRENT,
+            Authentication.AuthenticationType.API_KEY,
+            Map.of(
+                ApiKeyService.API_KEY_ID_KEY, "api_key_id",
+                ApiKeyService.API_KEY_NAME_KEY, "api_key_name",
+                ApiKeyService.API_KEY_CREATOR_REALM_NAME, "creator_realm_name",
+                ApiKeyService.API_KEY_CREATOR_REALM_TYPE, "creator_realm_type"
+            )));
+
+        IngestDocument ingestDocument = new IngestDocument(IngestDocument.deepCopyMap(Map.of(
+            "_field", Map.of("api_key", Map.of("version", 42), "realm", Map.of("id", 7))
+        )), new HashMap<>());
+        SetSecurityUserProcessor processor = new SetSecurityUserProcessor("_tag", threadContext, "_field", EnumSet.allOf(Property.class));
+        processor.execute(ingestDocument);
+
+        Map<String, Object> result = ingestDocument.getFieldValue("_field", Map.class);
+        assertThat(result.size(), equalTo(3));
+        assertThat(((Map) result.get("api_key")).get("version"), equalTo(42));
+        assertThat(((Map) result.get("realm")).get("id"), equalTo(7));
+    }
+
 }