mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 23:57:20 -04:00
b2e626e7df
Adds support for JWTs with client authentication to the activate user profile API. Closes #105342
135 lines
4.3 KiB
Text
135 lines
4.3 KiB
Text
[role="xpack"]
|
||
[[security-api-activate-user-profile]]
|
||
=== Activate user profile API
|
||
++++
|
||
<titleabbrev>Activate user profile</titleabbrev>
|
||
++++
|
||
|
||
NOTE: The user profile feature is designed only for use by {kib} and
|
||
Elastic’s {observability}, {ents}, and {elastic-sec} solutions. Individual
|
||
users and external applications should not call this API directly. Elastic reserves
|
||
the right to change or remove this feature in future releases without prior notice.
|
||
|
||
Creates or updates a user profile on behalf of another user.
|
||
|
||
[[security-api-activate-user-profile-request]]
|
||
==== {api-request-title}
|
||
|
||
`POST /_security/profile/_activate`
|
||
|
||
[[security-api-activate-user-profile-prereqs]]
|
||
==== {api-prereq-title}
|
||
|
||
* To use this API, you must have the `manage_user_profile` cluster privilege.
|
||
|
||
[[security-api-activate-user-profile-desc]]
|
||
==== {api-description-title}
|
||
|
||
The activate user profile API creates or updates a profile document for end
|
||
users with information that is extracted from the user's authentication object,
|
||
including `username`, `full_name`, `roles`, and the authentication realm.
|
||
For example, in the JWT `access_token` case, the profile user's `username` is
|
||
extracted from the JWT token claim pointed to by the `claims.principal`
|
||
setting of the JWT realm that authenticated the token.
|
||
|
||
When updating a profile document, the API enables the document if it was
|
||
disabled. Any updates do not change existing content for either the `labels` or
|
||
`data` fields.
|
||
|
||
This API is intended only for use by applications (such as {kib}) that need to
|
||
create or update profiles for end users.
|
||
|
||
IMPORTANT: The calling application must have either an `access_token`, or a
|
||
combination of `username` and `password` for the user that the profile document
|
||
is intended for.
|
||
|
||
[role="child_attributes"]
|
||
[[security-api-activate-user-profile-request-body]]
|
||
==== {api-request-body-title}
|
||
|
||
`access_token`::
|
||
(Required*, string)
|
||
The user's <<security-api-get-token, {es} access token>>, or JWT. Both <<jwt-realm-oauth2, access>> and
|
||
<<jwt-realm-oidc, id>> JWT token types are supported, and they depend on the underlying JWT realm configuration.
|
||
If you specify the `access_token` grant type, this parameter is required. It is not valid with other grant types.
|
||
|
||
include::client-authentication.asciidoc[]
|
||
|
||
`grant_type`::
|
||
(Required, string)
|
||
The type of grant.
|
||
+
|
||
.Valid values for `grant_type`
|
||
[%collapsible%open]
|
||
====
|
||
`access_token`::
|
||
In this type of grant, you must supply either an access token, that was created by the
|
||
{es} token service (see <<security-api-get-token>> and <<encrypt-http-communication>>),
|
||
or a <<jwt-auth-realm, JWT>> (either a JWT `access_token` or a JWT `id_token`).
|
||
|
||
`password`::
|
||
In this type of grant, you must supply the `username` and `password` for the
|
||
user that you want to create the API key for.
|
||
====
|
||
|
||
`password`::
|
||
(Required*, string)
|
||
The user's password. If you specify the `password` grant type, this parameter is
|
||
required. It is not valid with other grant types.
|
||
|
||
`username`::
|
||
(Required*, string)
|
||
The username that identifies the user. If you specify the `password` grant type,
|
||
this parameter is required. It is not valid with other grant types.
|
||
|
||
*Indicates that the setting is required in some, but not all situations.
|
||
|
||
[[security-api-activate-user-profile-response-body]]
|
||
==== {api-response-body-title}
|
||
|
||
A successful activate user profile API call returns a JSON structure that contains
|
||
the profile unique ID, user information, timestamp for the operation and version
|
||
control numbers.
|
||
|
||
[[security-api-activate-user-profile-example]]
|
||
==== {api-examples-title}
|
||
|
||
[source,console]
|
||
----
|
||
POST /_security/profile/_activate
|
||
{
|
||
"grant_type": "password",
|
||
"username" : "jacknich",
|
||
"password" : "l0ng-r4nd0m-p@ssw0rd"
|
||
}
|
||
----
|
||
// TEST[setup:jacknich_user]
|
||
|
||
The API returns the following response:
|
||
|
||
[source,console-result]
|
||
----
|
||
{
|
||
"uid": "u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0",
|
||
"enabled": true,
|
||
"last_synchronized": 1642650651037,
|
||
"user": {
|
||
"username": "jacknich",
|
||
"roles": [
|
||
"admin", "other_role1"
|
||
],
|
||
"realm_name": "native",
|
||
"full_name": "Jack Nicholson",
|
||
"email": "jacknich@example.com"
|
||
},
|
||
"labels": {},
|
||
"data": {},
|
||
"_doc": {
|
||
"_primary_term": 88,
|
||
"_seq_no": 66
|
||
}
|
||
}
|
||
----
|
||
// TESTRESPONSE[s/1642650651037/$body.last_synchronized/]
|
||
// TESTRESPONSE[s/88/$body._doc._primary_term/]
|
||
// TESTRESPONSE[s/66/$body._doc._seq_no/]
|