Custom authenticator followup + tests

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authc/Authentication.java

@@ -823,6 +823,9 @@ public void toXContentFragment(XContentBuilder builder) throws IOException {
             apiKeyField.put("managed_by", CredentialManagedBy.CLOUD.getDisplayName());
             builder.field("api_key", Collections.unmodifiableMap(apiKeyField));
         }
+        if (metadata.containsKey("managed_by")) {
+            builder.field("managed_by", metadata.get("managed_by"));
+        }
     }
 
     public static Authentication getAuthenticationFromCrossClusterAccessMetadata(Authentication authentication) {

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/PluggableAuthenticatorChain.java

@@ -8,13 +8,15 @@
 package org.elasticsearch.xpack.security.authc;
 
 import org.elasticsearch.action.ActionListener;
+import org.elasticsearch.xpack.core.common.IteratingActionListener;
 import org.elasticsearch.xpack.core.security.authc.Authentication;
 import org.elasticsearch.xpack.core.security.authc.AuthenticationResult;
 import org.elasticsearch.xpack.core.security.authc.AuthenticationToken;
 import org.elasticsearch.xpack.core.security.authc.CustomAuthenticator;
 
 import java.util.Collections;
 import java.util.List;
+import java.util.function.BiConsumer;
 
 public class PluggableAuthenticatorChain implements Authenticator {
 
@@ -59,28 +61,48 @@ public void authenticate(Context context, ActionListener<AuthenticationResult<Au
         }
         AuthenticationToken token = context.getMostRecentAuthenticationToken();
         if (token != null) {
-            // TODO switch to IteratingActionListener
-            for (CustomAuthenticator customAuthenticator : customAuthenticators) {
-                if (customAuthenticator.supports(token)) {
-                    customAuthenticator.authenticate(token, ActionListener.wrap(response -> {
-                        if (response.isAuthenticated()) {
-                            listener.onResponse(response);
-                        } else if (response.getStatus() == AuthenticationResult.Status.TERMINATE) {
-                            final Exception ex = response.getException();
-                            if (ex == null) {
-                                listener.onFailure(context.getRequest().authenticationFailed(token));
-                            } else {
-                                listener.onFailure(context.getRequest().exceptionProcessingRequest(ex, token));
-                            }
-                        } else if (response.getStatus() == AuthenticationResult.Status.CONTINUE) {
-                            listener.onResponse(AuthenticationResult.notHandled());
-                        }
-                    }, ex -> listener.onFailure(context.getRequest().exceptionProcessingRequest(ex, token))));
-                    return;
-                }
-            }
+            var lis = new IteratingActionListener<>(
+                listener,
+                getAuthConsumer(context),
+                customAuthenticators,
+                context.getThreadContext(),
+                result -> {
+                    if (result == null) {
+                        // all custom authenticators left the token unhandled
+                        return AuthenticationResult.notHandled();
+                    }
+                    return result;
+                },
+                result -> result == null || result.getStatus() == AuthenticationResult.Status.CONTINUE
+            );
+            lis.run();
+            return;
         }
         listener.onResponse(AuthenticationResult.notHandled());
     }
 
+    private BiConsumer<CustomAuthenticator, ActionListener<AuthenticationResult<Authentication>>> getAuthConsumer(Context context) {
+        AuthenticationToken token = context.getMostRecentAuthenticationToken();
+        return (authenticator, iteratingListener) -> {
+            if (authenticator.supports(token)) {
+                authenticator.authenticate(token, ActionListener.wrap(response -> {
+                    if (response.isAuthenticated()) {
+                        iteratingListener.onResponse(response);
+                    } else if (response.getStatus() == AuthenticationResult.Status.TERMINATE) {
+                        final Exception ex = response.getException();
+                        if (ex == null) {
+                            iteratingListener.onFailure(context.getRequest().authenticationFailed(token));
+                        } else {
+                            iteratingListener.onFailure(context.getRequest().exceptionProcessingRequest(ex, token));
+                        }
+                    } else if (response.getStatus() == AuthenticationResult.Status.CONTINUE) {
+                        iteratingListener.onResponse(AuthenticationResult.notHandled());
+                    }
+                }, ex -> iteratingListener.onFailure(context.getRequest().exceptionProcessingRequest(ex, token))));
+            } else {
+                iteratingListener.onResponse(null); // try the next custom authenticator
+            }
+        };
+    }
+
 }