Enhance Invalidate Token API

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/token/InvalidateTokenAction.java

@@ -8,7 +8,7 @@
 import org.elasticsearch.action.Action;
 
 /**
- * Action for invalidating a given token
+ * Action for invalidating one or more tokens
  */
 public final class InvalidateTokenAction extends Action<InvalidateTokenResponse> {
 

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/token/InvalidateTokenRequest.java

@@ -8,6 +8,7 @@
 import org.elasticsearch.Version;
 import org.elasticsearch.action.ActionRequest;
 import org.elasticsearch.action.ActionRequestValidationException;
+import org.elasticsearch.common.Nullable;
 import org.elasticsearch.common.Strings;
 import org.elasticsearch.common.io.stream.StreamInput;
 import org.elasticsearch.common.io.stream.StreamOutput;
@@ -22,31 +23,88 @@
 public final class InvalidateTokenRequest extends ActionRequest {
 
     public enum Type {
-        ACCESS_TOKEN,
-        REFRESH_TOKEN
+        ACCESS_TOKEN("token"),
+        REFRESH_TOKEN("refresh_token");
+
+        private final String value;
+
+        Type(String value) {
+            this.value = value;
+        }
+
+        public String getValue() {
+            return value;
+        }
+
+        public static Type fromString(String tokenType) {
+            if (tokenType != null) {
+                for (Type type : values()) {
+                    if (type.getValue().equals(tokenType)) {
+                        return type;
+                    }
+                }
+            }
+            return null;
+        }
     }
 
     private String tokenString;
     private Type tokenType;
+    private String realmName;
+    private String userName;
 
     public InvalidateTokenRequest() {}
 
     /**
-     * @param tokenString the string representation of the token
+     * @param tokenString the string representation of the token to be invalidated
+     * @param tokenType the type of the token to be invalidated
+     * @param realmName the name of the realm for which all tokens will be invalidated
+     * @param userName the principal of the user for which all tokens will be invalidated
      */
-    public InvalidateTokenRequest(String tokenString, Type type) {
+    public InvalidateTokenRequest(@Nullable String tokenString, @Nullable String tokenType, @Nullable String realmName, @Nullable String userName) {
         this.tokenString = tokenString;
-        this.tokenType = type;
+        this.tokenType = Type.fromString(tokenType);
+        this.realmName = realmName;
+        this.userName = userName;
+    }
+
+    /**
+     * @param tokenString the string representation of the token to be invalidated
+     * @param tokenType   the type of the token to be invalidated
+     */
+    public InvalidateTokenRequest(String tokenString, String tokenType) {
+        this.tokenString = tokenString;
+        this.tokenType = Type.fromString(tokenType);
+        this.realmName = null;
+        this.userName = null;
     }
 
     @Override
     public ActionRequestValidationException validate() {
         ActionRequestValidationException validationException = null;
-        if (Strings.isNullOrEmpty(tokenString)) {
-            validationException = addValidationError("token string must be provided", null);
-        }
-        if (tokenType == null) {
-            validationException = addValidationError("token type must be provided", validationException);
+        if (Strings.hasText(realmName)) {
+            if (Strings.hasText(tokenString)) {
+                validationException = addValidationError("token string must not be provided when realm name is specified", null);
+            }
+            if (tokenType != null) {
+                validationException = addValidationError("token type must not be provided when realm name is specified", null);
+            }
+        } else if (Strings.hasText(userName)) {
+            if (Strings.hasText(tokenString)) {
+                validationException = addValidationError("token string must not be provided when username is specified", null);
+            }
+            if (tokenType != null) {
+                validationException = addValidationError("token type must not be provided when username is specified", null);
+            }
+        } else {
+            if (Strings.isNullOrEmpty(tokenString)) {
+                validationException =
+                    addValidationError("token string must be provided when not specifying a realm name or a username", null);
+            }
+            if (tokenType == null) {
+                validationException =
+                    addValidationError("token type must be provided when a token string is specified", null);
+            }
         }
         return validationException;
     }
@@ -67,26 +125,52 @@ void setTokenType(Type tokenType) {
         this.tokenType = tokenType;
     }
 
+    public String getRealmName() {
+        return realmName;
+    }
+
+    public void setRealmName(String realmName) {
+        this.realmName = realmName;
+    }
+
+    public String getUserName() {
+        return userName;
+    }
+
+    public void setUserName(String userName) {
+        this.userName = userName;
+    }
+
     @Override
     public void writeTo(StreamOutput out) throws IOException {
         super.writeTo(out);
-        out.writeString(tokenString);
+        out.writeOptionalString(tokenString);
         if (out.getVersion().onOrAfter(Version.V_6_2_0)) {
-            out.writeVInt(tokenType.ordinal());
+            out.writeOptionalVInt(tokenType == null ? null : tokenType.ordinal());
         } else if (tokenType == Type.REFRESH_TOKEN) {
-            throw new IllegalArgumentException("refresh token invalidation cannot be serialized with version [" + out.getVersion() +
-                    "]");
+            throw new IllegalArgumentException("refresh token invalidation cannot be serialized with version [" + out.getVersion() + "]");
+        }
+        if (out.getVersion().onOrAfter(Version.V_6_6_0)) {
+            out.writeOptionalString(realmName);
+            out.writeOptionalString(userName);
+        } else {
+            throw new IllegalArgumentException("realm token invalidation cannot be serialized with version [" + out.getVersion() + "]");
         }
     }
 
     @Override
     public void readFrom(StreamInput in) throws IOException {
         super.readFrom(in);
-        tokenString = in.readString();
+        tokenString = in.readOptionalString();
         if (in.getVersion().onOrAfter(Version.V_6_2_0)) {
-            tokenType = Type.values()[in.readVInt()];
+            Integer type = in.readOptionalVInt();
+            tokenType = type == null ? null : Type.values()[type];
         } else {
             tokenType = Type.ACCESS_TOKEN;
         }
+        if (in.getVersion().onOrAfter(Version.V_6_6_0)) {
+            realmName = in.readOptionalString();
+            userName = in.readOptionalString();
+        }
     }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/token/InvalidateTokenRequestBuilder.java

@@ -34,4 +34,20 @@ public InvalidateTokenRequestBuilder setType(InvalidateTokenRequest.Type type) {
         request.setTokenType(type);
         return this;
     }
+
+    /**
+     * Sets the name of the realm for which all tokens should be invalidated
+     */
+    public InvalidateTokenRequestBuilder setRealmName(String realmName) {
+        request.setRealmName(realmName);
+        return this;
+    }
+
+    /**
+     * Sets the username for which all tokens should be invalidated
+     */
+    public InvalidateTokenRequestBuilder setUserName(String username) {
+        request.setUserName(username);
+        return this;
+    }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/token/InvalidateTokenResponse.java

@@ -8,38 +8,43 @@
 import org.elasticsearch.action.ActionResponse;
 import org.elasticsearch.common.io.stream.StreamInput;
 import org.elasticsearch.common.io.stream.StreamOutput;
+import org.elasticsearch.common.xcontent.ToXContent;
+import org.elasticsearch.common.xcontent.XContentBuilder;
+import org.elasticsearch.xpack.core.security.authc.support.TokensInvalidationResult;
 
 import java.io.IOException;
 
 /**
- * Response for a invalidation of a token.
+ * Response for a invalidation of one or multiple tokens.
  */
-public final class InvalidateTokenResponse extends ActionResponse {
+public final class InvalidateTokenResponse extends ActionResponse implements ToXContent {
 
-    private boolean created;
+    private TokensInvalidationResult result;
 
     public InvalidateTokenResponse() {}
 
-    public InvalidateTokenResponse(boolean created) {
-        this.created = created;
+    public InvalidateTokenResponse(TokensInvalidationResult result) {
+        this.result = result;
     }
 
-    /**
-     * If the token is already invalidated then created will be <code>false</code>
-     */
-    public boolean isCreated() {
-        return created;
+    public TokensInvalidationResult getResult() {
+        return result;
     }
 
     @Override
     public void writeTo(StreamOutput out) throws IOException {
         super.writeTo(out);
-        out.writeBoolean(created);
+        TokensInvalidationResult.writeTo(result, out);
     }
 
     @Override
     public void readFrom(StreamInput in) throws IOException {
         super.readFrom(in);
-        created = in.readBoolean();
+        result = TokensInvalidationResult.readFrom(in);
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params params) throws IOException {
+        return result.toXContent(builder, params);
     }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/support/TokensInvalidationResult.java

@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+package org.elasticsearch.xpack.core.security.authc.support;
+
+import org.elasticsearch.common.Nullable;
+import org.elasticsearch.common.io.stream.StreamInput;
+import org.elasticsearch.common.io.stream.StreamOutput;
+import org.elasticsearch.common.xcontent.ToXContentObject;
+import org.elasticsearch.common.xcontent.XContentBuilder;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Objects;
+
+/**
+ * The result of attempting to invalidate one or multiple tokens. The result contains information about:
+ * <ul>
+ * <li>how many of the tokens were actually invalidated</li>
+ * <li>how many tokens are not invalidated in this request because they were already invalidated</li>
+ * <li>how many tokens were not invalidated because of an error and what the error was</li>
+ * </ul>
+ */
+public class TokensInvalidationResult implements ToXContentObject {
+
+    private final String[] invalidatedTokens;
+    private final String[] prevInvalidatedTokens;
+    private final String[] errors;
+    private final int attemptCounter;
+
+
+    public TokensInvalidationResult(String[] invalidatedTokens, String[] notInvalidatedTokens,
+                                    @Nullable String[] errors, int attemptCounter) {
+        Objects.requireNonNull(invalidatedTokens, "invalidated_tokens must be provided");
+        this.invalidatedTokens = invalidatedTokens;
+        Objects.requireNonNull(notInvalidatedTokens, "not_invalidated_must be provided");
+        this.prevInvalidatedTokens = notInvalidatedTokens;
+        if (null != errors) {
+            this.errors = errors;
+        } else {
+            this.errors = new String[0];
+        }
+        this.attemptCounter = attemptCounter;
+    }
+
+    public static TokensInvalidationResult emptyResult(){
+        return new TokensInvalidationResult(new String[0], new String[0], new String[0], 0);
+    }
+
+    public String[] getInvalidatedTokens() {
+        return invalidatedTokens;
+    }
+
+    public String[] getPrevInvalidatedTokens() {
+        return prevInvalidatedTokens;
+    }
+
+    public String[] getErrors() {
+        return errors;
+    }
+
+    public int getAttemptCounter() {
+        return attemptCounter;
+    }
+
+    public static void writeTo(TokensInvalidationResult result, StreamOutput out) throws IOException {
+        out.writeVInt(result.getInvalidatedTokens().length);
+        out.writeStringArray(result.getInvalidatedTokens());
+        out.writeVInt(result.getPrevInvalidatedTokens().length);
+        out.writeStringArray(result.getPrevInvalidatedTokens());
+        out.writeVInt(result.getErrors().length);
+        out.writeStringArray(result.getErrors());
+        out.writeVInt(result.getAttemptCounter());
+    }
+
+    public static TokensInvalidationResult readFrom(StreamInput in) throws IOException {
+        int invalidatedTokensSize = in.readVInt();
+        String[] invalidatedTokens = in.readStringArray();
+        int prevInvalidatedTokensSize = in.readVInt();
+        String[] prevUnvalidatedTokens = in.readStringArray();
+        int errorsSize = in.readVInt();
+        String[] errors = in.readStringArray();
+        int attemptCounter = in.readVInt();
+        return new TokensInvalidationResult(invalidatedTokens, prevUnvalidatedTokens, errors, attemptCounter);
+    }
+
+    @Override
+    public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
+        builder.startObject()
+            .field("invalidated_tokens", invalidatedTokens.length)
+            .field("prev_invalidated_tokens", prevInvalidatedTokens.length)
+            .startObject("errors")
+            .field("size", errors.length);
+        if (errors.length > 0) {
+            builder.field("error_messages");
+            builder.startArray();
+            for (String error : errors) {
+                builder.value(error);
+            }
+            builder.endArray();
+        }
+        builder.endObject()
+            .endObject();
+        return builder;
+    }
+}

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/client/SecurityClient.java

@@ -326,6 +326,10 @@ public InvalidateTokenRequestBuilder prepareInvalidateToken(String token) {
         return new InvalidateTokenRequestBuilder(client).setTokenString(token);
     }
 
+    public InvalidateTokenRequestBuilder prepareInvalidateToken() {
+        return new InvalidateTokenRequestBuilder(client);
+    }
+
     public void invalidateToken(InvalidateTokenRequest request, ActionListener<InvalidateTokenResponse> listener) {
         client.execute(InvalidateTokenAction.INSTANCE, request, listener);
     }