API keys should throw an error, if unknown privilege gets added

[spinscale]

Elasticsearch version (bin/elasticsearch --version): 7.10.1

Description of the problem including expected versus actual behavior:

Adding an API key with a non-existing privilege returns successfully, but throws an error on the first operation that tries to get executed.

Steps to reproduce:

POST /_security/api_key
{
  "name": "my-api-key",
  "role_descriptors": { 
    "my-management": {
      "cluster": ["manage_index_template"]
    }
  }
}

Note the missing s at the end of manage_index_template - this returns a successful response with an API key.

However the next request trying to create an index template returns

Exception in thread "main" java.lang.RuntimeException: error storing index template [my_analytics_template]: status [400], body [{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"unknown cluster privilege [manage_index_template]. a privilege must be either one of the predefined cluster privilege names [monitor_ml,manage_enrich,read_slm,monitor_watcher,manage_index_templates,manage_ccr,monitor_transform,manage_logstash_pipelines,delegate_pki,none,monitor_snapshot,manage_data_frame_transforms,read_ilm,monitor_data_frame_transforms,manage_api_key,manage_security,manage_saml,manage_own_api_key,all,manage_ilm,manage_oidc,manage_ingest_pipelines,read_ccr,monitor,manage_rollup,manage_slm,manage_watcher,manage,manage_transform,manage_token,manage_autoscaling,manage_ml,manage_pipeline,monitor_rollup,grant_api_key,transport_client,create_snapshot] or a pattern over one of the available cluster actions"}],"type":"illegal_argument_exception","reason":"unknown cluster privilege [manage_index_template]. a privilege must be either one of the predefined cluster privilege names [monitor_ml,manage_enrich,read_slm,monitor_watcher,manage_index_templates,manage_ccr,monitor_transform,manage_logstash_pipelines,delegate_pki,none,monitor_snapshot,manage_data_frame_transforms,read_ilm,monitor_data_frame_transforms,manage_api_key,manage_security,manage_saml,manage_own_api_key,all,manage_ilm,manage_oidc,manage_ingest_pipelines,read_ccr,monitor,manage_rollup,manage_slm,manage_watcher,manage,manage_transform,manage_token,manage_autoscaling,manage_ml,manage_pipeline,monitor_rollup,grant_api_key,transport_client,create_snapshot] or a pattern over one of the available cluster actions"},"status":400}]

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[albertzaharovits]

Thank you for reporting it @spinscale !
I concur that we have validation when creating roles but no validation when creating API keys (which internally use the same role descriptor structure).