Fix conflict, closes #5082

src/plugins/elasticsearch/lib/__tests__/get_basic_auth_realm.js

@@ -0,0 +1,27 @@
+const getBasicAuthRealm = require('../get_basic_auth_realm');
+const expect = require('expect.js');
+const exception = '[security_exception] missing authentication token for REST request [/logstash-*/_search],' +
+                  ' with: {"header":{"WWW-Authenticate":"Basic realm=\\"shield\\""}}';
+
+
+describe('plugins/elasticsearch', function () {
+  describe('lib/get_basic_auth_realm', function () {
+
+    it('should return null if passed something other than a string', function () {
+      expect(getBasicAuthRealm({})).to.be(null);
+      expect(getBasicAuthRealm(500)).to.be(null);
+      expect(getBasicAuthRealm([exception])).to.be(null);
+    });
+
+    // TODO: This should be updated to match header strings when the client supports that
+    it('should return the realm when passed an elasticsearch security exception', function () {
+      expect(getBasicAuthRealm(exception)).to.be('shield');
+    });
+
+    it('should return null when no basic realm information is found', function () {
+      expect(getBasicAuthRealm('Basically nothing="the universe"')).to.be(null);
+    });
+
+  });
+});
+

src/plugins/elasticsearch/lib/call_with_request.js

@@ -1,6 +1,8 @@
 const _ = require('lodash');
 const Promise = require('bluebird');
 const Boom = require('boom');
+const getBasicAuthRealm = require('./get_basic_auth_realm');
+
 module.exports = (client) => {
   return (req, endpoint, params = {}) => {
     if (req.headers.authorization) {
@@ -11,8 +13,11 @@ module.exports = (client) => {
     return api.call(client, params)
       .catch((err) => {
         if (err.status === 401) {
-          const options = { realm: 'Authorization Required' };
-          return Promise.reject(Boom.unauthorized(err.body, 'Basic', options));
+          // TODO: The err.message is temporary until we have support for getting headers in the client.
+          // Once we have that, we should be able to pass the contents of the WWW-Authenticate head to getRealm
+          const realm = getBasicAuthRealm(err.message) || 'Authorization Required';
+          const options = { realm: realm };
+          return Promise.reject(Boom.unauthorized('Unauthorized', 'Basic', options));
         }
         return Promise.reject(err);
       });

src/plugins/elasticsearch/lib/get_basic_auth_realm.js

@@ -0,0 +1,7 @@
+module.exports = function getBasicAuthRealm(message) {
+  if (!message || typeof message !== 'string') return null;
+
+  const parts = message.match(/Basic\ realm=\\"(.*)\\"/);
+  if (parts && parts.length === 2) return parts[1];
+  else return null;
+};