[ML] Improve EIS auth call logs and fix revocation bug

[jonathan-buttner]

This PR adds some logging to the EIS authorization call to help debugging authorization failures. While I was doing that I found a bug and made some improvements. The bug was that we didn't use the "merged" authorization object for the revoking but we use it for determining whether the service supports streaming and which task types.

After talking with the team we decided we don't need to merge the previous authorization object with the newly retrieved one. That way when we get a successful response it is always the source of truth. This also means we don't need a node reboot to perform revocation.

I'm backporting this to when we added the periodic auth call in this PR: #123639

New logs

Here's an example of what the logs will look like

[2025-08-07T15:51:45,535][DEBUG][o.e.x.i.s.e.a.ElasticInferenceServiceAuthorizationRequestHandler] [runTask-0] Received authorization information from gateway {modelName='rainbow-sprinkles', taskTypes='[chat_completion]'}
[2025-08-07T15:51:45,536][DEBUG][o.e.x.i.s.e.a.ElasticInferenceServiceAuthorizationHandler] [runTask-0] Received authorization response, {taskTypeToModels={chat_completion=[rainbow-sprinkles]}, authorizedTaskTypes=[chat_completion], authorizedModelIds=[rainbow-sprinkles]}
[2025-08-07T15:51:45,536][DEBUG][o.e.x.i.s.e.a.ElasticInferenceServiceAuthorizationHandler] [runTask-0] Authorization entity limited to service task types, {taskTypeToModels={chat_completion=[rainbow-sprinkles]}, authorizedTaskTypes=[chat_completion], authorizedModelIds=[rainbow-sprinkles]}
[2025-08-07T15:51:45,536][DEBUG][o.e.x.i.s.e.a.ElasticInferenceServiceAuthorizationHandler] [runTask-0] Synchronizing default inference endpoints, attempting to remove ids: [.elser-2-elastic, .multilingual-embed-v1-elastic, .rerank-v1-elastic]
[2025-08-07T15:51:45,543][DEBUG][o.e.x.i.s.e.a.ElasticInferenceServiceAuthorizationHandler] [runTask-0] Successfully revoked access to default inference endpoint IDs: [elser_model_2, rerank-v1, multilingual-embed-v1]

Testing

Modify the acl that EIS returns in this file to change which models are authorized:

eis_dir/acl/acl.yaml

Execute EIS locally:

make TLS_VERIFY_CLIENT_CERTS=false run

Run ES pointing to EIS

run-es -Dtests.es.xpack.inference.elastic.url=https://localhost:8443 -Dtests.es.xpack.inference.elastic.http.ssl.verification_mode=none -Dtests.es.logger.org.elasticsearch.xpack.inference.services.elastic.authorization.ElasticInferenceServiceAuthorizationRequestHandler=DEBUG -Dtests.es.logger.org.elasticsearch.xpack.inference.services.elastic.authorization.ElasticInferenceServiceAuthorizationHandler=DEBUG

Change how often ES polls for authorization

PUT _cluster/settings
{
  "persistent": {
    "xpack.inference.elastic.authorization_request_interval": "10s",
    "xpack.inference.elastic.max_authorization_request_jitter": "2s",
    "logger.org.elasticsearch.xpack.inference.services.elastic.authorization.ElasticInferenceServiceAuthorizationHandler": "DEBUG"
  }
}

Then you can stop EIS, modify the ACL file and restart it and ES will pickup the change.

Then use GET _inference/_all to retrieve the authorized default endpoints to ensure they match what EIS is returning.

[elasticsearchmachine]

Hi @jonathan-buttner, I've created a changelog YAML for you.

[jonathan-buttner]

The bug is here and the line below where we reference auth instead of authorizedTaskTypesAndModels. In the fixed version we're using the auth.newLimitedToTaskTypes response instead.

[jonathan-buttner]

Previously the first response was merged with the second auth response. Now the latest successful auth response dictates the auth so we need to repeat the model again in the second response for this test.

[jonathan-buttner]

We're now returning an error when a failure occurs. The caller will ignore the error and it will not affect the authorization. This way we can differentiate between a failure authorization and a successful one. Whenever onResponse is called we'll use that response object as the source of truth for authorization.

[elasticsearchmachine]

Pinging @elastic/ml-core (Team:ML)

[prwhelan]

For future reference, loggers have a formatter, I believe, something like:

logger.debug("Received authorization response, {}", auth);

[prwhelan]

Suggested change

	return String.join(", ", authorizedModels.stream().map(AuthorizedModel::toString).toList());
	return authorizedModels.stream().map(AuthorizedModel::toString).collect(Collectors.joining(", "));

[elasticsearchmachine]

💚 Backport successful

Status	Branch	Result
✅	8.19
✅	9.1
✅	8.18
✅	9.0