Delegate PKI authentication

  • POST /_security/delegate_pki
Auth

This API implements the exchange of an X509Certificate chain for an Elasticsearch access token. The certificate chain is validated, according to RFC 5280, by sequentially considering the trust configuration of every installed PKI realm that has delegation.enabled set to true. A successfully trusted client certificate is also subject to the validation of the subject distinguished name according to thw username_pattern of the respective realm.

This API is called by smart and trusted proxies, such as Kibana, which terminate the user's TLS session but still want to authenticate the user by using a PKI realm—- as if the user connected directly to Elasticsearch.

Important

The association between the subject public key in the target certificate and the corresponding private key is not validated. This is part of the TLS authentication process and it is delegated to the proxy that calls this API. The proxy is trusted to have performed the TLS authentication and this API translates that authentication into an Elasticsearch access token.

Learn more about pki

Required authorization

Cluster privileges all

Request body

x509_certificate_chain string[] required

The X509Certificate chain, which is represented as an ordered string array. Each string in the array is a base64-encoded (Section 4 of RFC4648 - not base64url-encoded) of the certificate's DER encoding.

The first element is the target certificate that contains the subject distinguished name that is requesting access. This may be followed by additional certificates; each subsequent certificate is used to certify the previous one.

Response

application/json
access_token string required

An access token associated with the subject distinguished name of the client's certificate.

expires_in number required

The amount of time (in seconds) before the token expires.

type string required

The type of token.

authentication object
username string required
roles string[] required
full_name union string required nullable
One of: string
email union string required nullable
One of: string
token map string to string
metadata object required
enabled boolean required
authentication_realm object required
name string required
type string required
domain string
lookup_realm object required
name string required
type string required
domain string
authentication_type string required
api_key map string to string