Package com.floragunn.searchguard.dlic.rest.api

Class RestApiPrivilegesEvaluator

java.lang.Object

com.floragunn.searchguard.dlic.rest.api.RestApiPrivilegesEvaluator

public class RestApiPrivilegesEvaluator
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
protected org.apache.logging.log4j.Logger	logger

Constructor Summary

Constructors

Constructor	Description
RestApiPrivilegesEvaluator(org.elasticsearch.common.settings.Settings settings, com.floragunn.searchguard.configuration.AdminDNs adminDNs, com.floragunn.searchguard.privileges.PrivilegesEvaluator privilegesEvaluator, com.floragunn.searchguard.ssl.transport.PrincipalExtractor principalExtractor, Path configPath, org.elasticsearch.threadpool.ThreadPool threadPool)

Method Summary

Modifier and Type	Method	Description
String	checkAccessPermissions(org.elasticsearch.rest.RestRequest request, Endpoint endpoint)	Check if the current request is allowed to use the REST API and the requested end point.
Boolean	currentUserHasRestApiAccess(Set<String> userRoles)
Map<Endpoint,List<org.elasticsearch.rest.RestRequest.Method>>	getDisabledEndpointsForCurrentUser(String userPrincipal, Set<String> userRoles)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

protected final org.apache.logging.log4j.Logger logger

Constructor Detail

RestApiPrivilegesEvaluator

public RestApiPrivilegesEvaluator(org.elasticsearch.common.settings.Settings settings,
                                  com.floragunn.searchguard.configuration.AdminDNs adminDNs,
                                  com.floragunn.searchguard.privileges.PrivilegesEvaluator privilegesEvaluator,
                                  com.floragunn.searchguard.ssl.transport.PrincipalExtractor principalExtractor,
                                  Path configPath,
                                  org.elasticsearch.threadpool.ThreadPool threadPool)

Method Detail

checkAccessPermissions

public String checkAccessPermissions(org.elasticsearch.rest.RestRequest request,
                                     Endpoint endpoint)
                              throws IOException

Check if the current request is allowed to use the REST API and the requested end point. Using an admin certificate grants all permissions. A user/role can have restricted end points.

Returns:

an error message if user does not have access, null otherwise TODO: log failed attempt in audit log

Throws:

IOException

currentUserHasRestApiAccess

public Boolean currentUserHasRestApiAccess(Set<String> userRoles)

getDisabledEndpointsForCurrentUser

public Map<Endpoint,List<org.elasticsearch.rest.RestRequest.Method>> getDisabledEndpointsForCurrentUser(String userPrincipal,
                                                                                                              Set<String> userRoles)