move run-as consistency check

slobodanadamovic · slobodanadamovic · commit 52348f672d4c · 2025-06-20T18:11:51.000+02:00
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java
@@ -949,7 +949,6 @@ private void checkConsistencyForApiKeyAuthenticationType() {
         }
         if (authenticatingSubject.getType() == Subject.Type.CLOUD_API_KEY) {
             checkConsistencyForCloudApiKeyAuthenticatingSubject("Cloud API key");
-            checkNoRunAs(this, "Cloud API key");
             return;
         }
 
@@ -1050,6 +1049,7 @@ private void checkConsistencyForCloudApiKeyAuthenticatingSubject(String prefixMe
         final RealmRef authenticatingRealm = authenticatingSubject.getRealm();
         checkNoDomain(authenticatingRealm, prefixMessage);
         checkNoInternalUser(authenticatingSubject, prefixMessage);
+        checkNoRunAs(this, prefixMessage);
         if (authenticatingSubject.getMetadata().get(CROSS_CLUSTER_ACCESS_ROLE_DESCRIPTORS_KEY) != null
             || authenticatingSubject.getMetadata().get(API_KEY_ROLE_DESCRIPTORS_KEY) != null
             || authenticatingSubject.getMetadata().get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY) != null) {

Original file line number	Diff line number	Diff line change
`@@ -949,7 +949,6 @@ private void checkConsistencyForApiKeyAuthenticationType() {`
`949`	`949`	`}`
`950`	`950`	`if (authenticatingSubject.getType() == Subject.Type.CLOUD_API_KEY) {`
`951`	`951`	`checkConsistencyForCloudApiKeyAuthenticatingSubject("Cloud API key");`
`952`		`- checkNoRunAs(this, "Cloud API key");`
`953`	`952`	`return;`
`954`	`953`	`}`
`955`	`954`
`@@ -1050,6 +1049,7 @@ private void checkConsistencyForCloudApiKeyAuthenticatingSubject(String prefixMe`
`1050`	`1049`	`final RealmRef authenticatingRealm = authenticatingSubject.getRealm();`
`1051`	`1050`	`checkNoDomain(authenticatingRealm, prefixMessage);`
`1052`	`1051`	`checkNoInternalUser(authenticatingSubject, prefixMessage);`
	`1052`	`+ checkNoRunAs(this, prefixMessage);`
`1053`	`1053`	`if (authenticatingSubject.getMetadata().get(CROSS_CLUSTER_ACCESS_ROLE_DESCRIPTORS_KEY) != null`
`1054`	`1054`	`\|\| authenticatingSubject.getMetadata().get(API_KEY_ROLE_DESCRIPTORS_KEY) != null`
`1055`	`1055`	`\|\| authenticatingSubject.getMetadata().get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY) != null) {`