Return API key name in _authentication response

client/rest-high-level/src/main/java/org/elasticsearch/client/security/AuthenticateResponse.java

@@ -44,6 +44,9 @@ public final class AuthenticateResponse implements ToXContentObject {
     static final ParseField REALM_TYPE = new ParseField("type");
     static final ParseField AUTHENTICATION_TYPE = new ParseField("authentication_type");
     static final ParseField TOKEN = new ParseField("token");
+    static final ParseField API_KEY_INFO = new ParseField("api_key"); // authentication.api_key={"id":"abc123","name":"my-api-key"}
+    static final ParseField API_KEY_INFO_ID = new ParseField("id");
+    static final ParseField API_KEY_INFO_NAME = new ParseField("name");
 
     @SuppressWarnings("unchecked")
     private static final ConstructingObjectParser<AuthenticateResponse, Void> PARSER = new ConstructingObjectParser<>(
@@ -55,7 +58,8 @@ public final class AuthenticateResponse implements ToXContentObject {
             (RealmInfo) a[6],
             (RealmInfo) a[7],
             (String) a[8],
-            (Map<String, Object>) a[9]
+            (Map<String, Object>) a[9],
+            (ApiKeyInfo) a[10]
         )
     );
     static {
@@ -66,6 +70,15 @@ public final class AuthenticateResponse implements ToXContentObject {
         );
         realmInfoParser.declareString(constructorArg(), REALM_NAME);
         realmInfoParser.declareString(constructorArg(), REALM_TYPE);
+
+        final ConstructingObjectParser<ApiKeyInfo, Void> apiKeyInfoParser = new ConstructingObjectParser<>(
+            "api_key",
+            true,
+            a -> new ApiKeyInfo((String) a[0], (String) a[1])
+        );
+        apiKeyInfoParser.declareString(constructorArg(), API_KEY_INFO_ID);
+        apiKeyInfoParser.declareString(optionalConstructorArg(), API_KEY_INFO_NAME);
+
         PARSER.declareString(constructorArg(), USERNAME);
         PARSER.declareStringArray(constructorArg(), ROLES);
         PARSER.<Map<String, Object>>declareObject(constructorArg(), (parser, c) -> parser.map(), METADATA);
@@ -76,6 +89,7 @@ public final class AuthenticateResponse implements ToXContentObject {
         PARSER.declareObject(constructorArg(), realmInfoParser, LOOKUP_REALM);
         PARSER.declareString(constructorArg(), AUTHENTICATION_TYPE);
         PARSER.declareObjectOrNull(optionalConstructorArg(), (p, c) -> p.map(), null, TOKEN);
+        PARSER.declareObjectOrNull(optionalConstructorArg(), apiKeyInfoParser, null, API_KEY_INFO);
     }
 
     private final User user;
@@ -85,6 +99,8 @@ public final class AuthenticateResponse implements ToXContentObject {
     private final String authenticationType;
     @Nullable
     private final Map<String, Object> token;
+    @Nullable
+    private final ApiKeyInfo apikeyinfo;
 
     public AuthenticateResponse(
         User user,
@@ -103,13 +119,26 @@ public AuthenticateResponse(
         RealmInfo lookupRealm,
         String authenticationType,
         @Nullable Map<String, Object> token
+    ) {
+        this(user, enabled, authenticationRealm, lookupRealm, authenticationType, null, null);
+    }
+
+    public AuthenticateResponse(
+        User user,
+        boolean enabled,
+        RealmInfo authenticationRealm,
+        RealmInfo lookupRealm,
+        String authenticationType,
+        @Nullable Map<String, Object> token,
+        @Nullable ApiKeyInfo apikeyinfo
     ) {
         this.user = user;
         this.enabled = enabled;
         this.authenticationRealm = authenticationRealm;
         this.lookupRealm = lookupRealm;
         this.authenticationType = authenticationType;
         this.token = token;
+        this.apikeyinfo = apikeyinfo;
     }
 
     /**
@@ -150,6 +179,10 @@ public Map<String, Object> getToken() {
         return token;
     }
 
+    public ApiKeyInfo getApiKeyInfo() {
+        return apikeyinfo;
+    }
+
     @Override
     public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
         builder.startObject();
@@ -175,6 +208,14 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
         if (token != null) {
             builder.field(AuthenticateResponse.TOKEN.getPreferredName(), token);
         }
+        if (apikeyinfo != null) {
+            builder.startObject(AuthenticateResponse.API_KEY_INFO.getPreferredName());
+            builder.field(AuthenticateResponse.API_KEY_INFO_ID.getPreferredName(), apikeyinfo.getId());
+            if (apikeyinfo.getName() != null) {
+                builder.field(AuthenticateResponse.API_KEY_INFO_NAME.getPreferredName(), apikeyinfo.getName());
+            }
+            builder.endObject();
+        }
         return builder.endObject();
     }
 
@@ -188,12 +229,13 @@ public boolean equals(Object o) {
             && Objects.equals(authenticationRealm, that.authenticationRealm)
             && Objects.equals(lookupRealm, that.lookupRealm)
             && Objects.equals(authenticationType, that.authenticationType)
-            && Objects.equals(token, that.token);
+            && Objects.equals(token, that.token)
+            && Objects.equals(apikeyinfo, that.apikeyinfo);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(user, enabled, authenticationRealm, lookupRealm, authenticationType, token);
+        return Objects.hash(user, enabled, authenticationRealm, lookupRealm, authenticationType, token, apikeyinfo);
     }
 
     public static AuthenticateResponse fromXContent(XContentParser parser) throws IOException {
@@ -230,4 +272,35 @@ public int hashCode() {
             return Objects.hash(name, type);
         }
     }
+
+    public static class ApiKeyInfo { // authentication.api_key={"id":"abc123","name":"my-api-key"}
+        private String id;
+        private String name;
+
+        ApiKeyInfo(String id, String name) {
+            this.id = id;
+            this.name = name;
+        }
+
+        public String getId() {
+            return id;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+            final ApiKeyInfo that = (ApiKeyInfo) o;
+            return Objects.equals(this.id, that.id) && Objects.equals(this.name, that.name);
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(id, name);
+        }
+    }
 }

client/rest-high-level/src/test/java/org/elasticsearch/client/security/AuthenticateResponseTests.java

@@ -77,13 +77,23 @@ protected AuthenticateResponse createTestInstance() {
 
         final String authenticationType = randomFrom("realm", "api_key", "token", "anonymous", "internal");
 
+        final AuthenticateResponse.ApiKeyInfo apiKeyInfo;
+        if ("api_key".equals(authenticationType)) {
+            final String apiKeyId = randomAlphaOfLength(16);                            // mandatory
+            final String apiKeyName = randomBoolean() ? randomAlphaOfLength(20) : null; // optional
+            apiKeyInfo = new AuthenticateResponse.ApiKeyInfo(apiKeyId, apiKeyName);
+        } else {
+            apiKeyInfo = null;
+        }
+
         return new AuthenticateResponse(
             new User(username, roles, metadata, fullName, email),
             enabled,
             authenticationRealm,
             lookupRealm,
             authenticationType,
-            tokenInfo
+            tokenInfo,
+            apiKeyInfo
         );
     }
 
@@ -106,13 +116,15 @@ private AuthenticateResponse copy(AuthenticateResponse response) {
             response.getAuthenticationRealm(),
             response.getLookupRealm(),
             response.getAuthenticationType(),
-            Map.copyOf(response.getToken())
+            Map.copyOf(response.getToken()),
+            response.getApiKeyInfo()
         );
     }
 
     private AuthenticateResponse mutate(AuthenticateResponse response) {
         final User originalUser = response.getUser();
-        switch (randomIntBetween(1, 10)) {
+        int randomSwitchCase = randomIntBetween(1, 11); // range is inclusive
+        switch (randomSwitchCase) {
             case 1:
                 return new AuthenticateResponse(
                     new User(
@@ -126,7 +138,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 2:
                 final List<String> wrongRoles = new ArrayList<>(originalUser.getRoles());
@@ -143,7 +156,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 3:
                 final Map<String, Object> wrongMetadata = new HashMap<>(originalUser.getMetadata());
@@ -160,7 +174,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 4:
                 return new AuthenticateResponse(
@@ -174,7 +189,9 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.enabled(),
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
-                    response.getAuthenticationType()
+                    response.getAuthenticationType(),
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 5:
                 return new AuthenticateResponse(
@@ -189,7 +206,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 6:
                 return new AuthenticateResponse(
@@ -204,7 +222,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 7:
                 return new AuthenticateResponse(
@@ -219,7 +238,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     response.getAuthenticationRealm(),
                     new AuthenticateResponse.RealmInfo(randomAlphaOfLength(5), randomAlphaOfLength(5)),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 8:
                 return new AuthenticateResponse(
@@ -234,7 +254,8 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                     new AuthenticateResponse.RealmInfo(randomAlphaOfLength(5), randomAlphaOfLength(5)),
                     response.getLookupRealm(),
                     response.getAuthenticationType(),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
             case 9:
                 return new AuthenticateResponse(
@@ -252,9 +273,10 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                         response.getAuthenticationType(),
                         () -> randomFrom("realm", "api_key", "token", "anonymous", "internal")
                     ),
-                    response.getToken()
+                    response.getToken(),
+                    response.getApiKeyInfo()
                 );
-            default:
+            case 10:
                 return new AuthenticateResponse(
                     new User(
                         originalUser.getUsername(),
@@ -277,9 +299,33 @@ private AuthenticateResponse mutate(AuthenticateResponse response) {
                                 randomValueOtherThan(response.getToken().get("type"), () -> randomAlphaOfLengthBetween(3, 8))
                             ),
                             null
+                        ),
+                    response.getApiKeyInfo()
+                );
+            case 11:
+                return new AuthenticateResponse(
+                    new User(
+                        originalUser.getUsername(),
+                        originalUser.getRoles(),
+                        originalUser.getMetadata(),
+                        originalUser.getFullName(),
+                        originalUser.getEmail()
+                    ),
+                    response.enabled(),
+                    response.getAuthenticationRealm(),
+                    response.getLookupRealm(),
+                    response.getAuthenticationType(),
+                    response.getToken(),
+                    response.getApiKeyInfo() == null
+                        ? new AuthenticateResponse.ApiKeyInfo(
+                            randomAlphaOfLength(16),                         // mandatory
+                            randomBoolean() ? randomAlphaOfLength(20) : null // optional
                         )
+                        : null
                 );
-
+            default:
+                fail("Random number " + randomSwitchCase + " did not match any switch cases");
+                return null;
         }
     }
 }

client/rest-high-level/src/test/java/org/elasticsearch/client/security/CreateTokenResponseTests.java

@@ -34,7 +34,12 @@ public void testFromXContent() throws IOException {
             true,
             new AuthenticateResponse.RealmInfo(randomAlphaOfLength(5), randomAlphaOfLength(7)),
             new AuthenticateResponse.RealmInfo(randomAlphaOfLength(5), randomAlphaOfLength(5)),
-            "realm"
+            "realm",
+            null,
+            new AuthenticateResponse.ApiKeyInfo(
+                randomAlphaOfLength(16),                         // mandatory
+                randomBoolean() ? randomAlphaOfLength(20) : null // optional
+            )
         );
 
         final XContentType xContentType = randomFrom(XContentType.values());

client/rest-high-level/src/test/java/org/elasticsearch/client/security/DelegatePkiAuthenticationResponseTests.java

@@ -14,6 +14,7 @@
 import org.elasticsearch.xcontent.XContentParser;
 import org.elasticsearch.xcontent.XContentType;
 import org.elasticsearch.xpack.core.security.authc.Authentication;
+import org.elasticsearch.xpack.core.security.authc.AuthenticationField;
 import org.elasticsearch.xpack.core.security.user.User;
 
 import java.io.IOException;
@@ -82,6 +83,10 @@ protected Authentication createAuthentication() {
         final String lookupRealmType = randomFrom("file", "native", "ldap", "active_directory", "saml", "kerberos");
         final String nodeName = randomAlphaOfLengthBetween(1, 10);
         final Authentication.AuthenticationType authenticationType = randomFrom(Authentication.AuthenticationType.values());
+        if (Authentication.AuthenticationType.API_KEY.equals(authenticationType)) {
+            metadata.put(AuthenticationField.API_KEY_ID_KEY, randomAlphaOfLengthBetween(1, 10));
+            metadata.put(AuthenticationField.API_KEY_NAME_KEY, randomBoolean() ? null : randomAlphaOfLengthBetween(1, 10));
+        }
         return new Authentication(
             new User(username, roles, fullName, email, metadata, true),
             new Authentication.RealmRef(authenticationRealmName, authenticationRealmType, nodeName),
@@ -113,12 +118,22 @@ AuthenticateResponse createServerAuthenticationResponse(Authentication authentic
                 ? authentication.getAuthenticatedBy().getType()
                 : authentication.getLookedUpBy().getType()
         );
+        final AuthenticateResponse.ApiKeyInfo apiKeyInfo;
+        if (Authentication.AuthenticationType.API_KEY.equals(authentication.getAuthenticationType())) {
+            final String apiKeyId = (String) authentication.getMetadata().get(AuthenticationField.API_KEY_ID_KEY);   // mandatory
+            final String apiKeyName = (String) authentication.getMetadata().get(AuthenticationField.API_KEY_NAME_KEY); // optional
+            apiKeyInfo = new AuthenticateResponse.ApiKeyInfo(apiKeyId, apiKeyName);
+        } else {
+            apiKeyInfo = null;
+        }
         return new AuthenticateResponse(
             cUser,
             user.enabled(),
             authenticatedBy,
             lookedUpBy,
-            authentication.getAuthenticationType().toString().toLowerCase(Locale.ROOT)
+            authentication.getAuthenticationType().toString().toLowerCase(Locale.ROOT),
+            null,
+            apiKeyInfo
         );
     }
 }