Add logic to return to user the token and store an encrypted version …

…in the index Signed-off-by: Derek Ho <[email protected]>
derek-ho · Dec 17, 2024 · 3a2e483 · 3a2e483
1 parent ae4e8f8
commit 3a2e483
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 7 deletions.
diff --git a/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java b/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java
@@ -132,7 +132,7 @@ private RestChannelConsumer handlePost(RestRequest request, NodeClient client) {
                 );
 
                 builder.startObject();
-                builder.field("token", token);
+                builder.field("Api Token: ", token);
                 builder.endObject();
 
                 response = new BytesRestResponse(RestStatus.OK, builder);

diff --git a/src/main/java/org/opensearch/security/action/apitokens/ApiTokenRepository.java b/src/main/java/org/opensearch/security/action/apitokens/ApiTokenRepository.java
@@ -16,6 +16,7 @@
 
 import org.opensearch.client.Client;
 import org.opensearch.cluster.service.ClusterService;
+import org.opensearch.common.collect.Tuple;
 import org.opensearch.index.IndexNotFoundException;
 import org.opensearch.security.authtoken.jwt.ExpiringBearerAuthToken;
 import org.opensearch.security.identity.SecurityTokenManager;
@@ -39,9 +40,11 @@ public String createApiToken(
         // TODO: Implement logic of creating JTI to match against during authc/z
         // TODO: Add validation on whether user is creating a token with a subset of their permissions
         ApiToken apiToken = new ApiToken(name, clusterPermissions, indexPermissions, expiration);
-        ExpiringBearerAuthToken token = securityTokenManager.issueApiToken(apiToken);
-        apiToken.setJti(token.getCompleteToken());
-        return apiTokenIndexHandler.indexTokenMetadata(apiToken);
+        Tuple<ExpiringBearerAuthToken, String> token = securityTokenManager.issueApiToken(apiToken);
+        apiToken.setJti(token.v2());
+        apiTokenIndexHandler.indexTokenMetadata(apiToken);
+
+        return token.v1().getCompleteToken();
     }
 
     public void deleteApiToken(String name) throws ApiTokenException, IndexNotFoundException {

diff --git a/src/main/java/org/opensearch/security/authtoken/jwt/JwtVendor.java b/src/main/java/org/opensearch/security/authtoken/jwt/JwtVendor.java
@@ -153,7 +153,7 @@ public ExpiringBearerAuthToken createJwt(
     }
 
     @SuppressWarnings("removal")
-    public ExpiringBearerAuthToken createJwt(
+    public Tuple<ExpiringBearerAuthToken, String> createJwt(
         final String issuer,
         final String subject,
         final String audience,
@@ -199,6 +199,9 @@ public ExpiringBearerAuthToken createJwt(
             );
         }
 
-        return new ExpiringBearerAuthToken(signedJwt.serialize(), subject, expiryTime);
+        return Tuple.tuple(
+            new ExpiringBearerAuthToken(signedJwt.serialize(), subject, expiryTime),
+            encryptionDecryptionUtil.encrypt(signedJwt.serialize())
+        );
     }
 }
diff --git a/src/main/java/org/opensearch/security/identity/SecurityTokenManager.java b/src/main/java/org/opensearch/security/identity/SecurityTokenManager.java
@@ -20,6 +20,7 @@
 
 import org.opensearch.OpenSearchSecurityException;
 import org.opensearch.cluster.service.ClusterService;
+import org.opensearch.common.collect.Tuple;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.core.common.transport.TransportAddress;
 import org.opensearch.identity.Subject;
@@ -140,7 +141,7 @@ public ExpiringBearerAuthToken issueOnBehalfOfToken(final Subject subject, final
         }
     }
 
-    public ExpiringBearerAuthToken issueApiToken(final ApiToken apiToken) {
+    public Tuple<ExpiringBearerAuthToken, String> issueApiToken(final ApiToken apiToken) {
         final User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER);
         if (user == null) {
             throw new OpenSearchSecurityException("Unsupported user to generate Api Token");