Skip to content

Commit cf683c0

Browse files
jonathan-buttnerncordon
jonathan-buttner
authored and
ncordon
committed
[ML] When using CCM, EIS authorization header should use ApiKey instead of Bearer (elastic#138590)
* Switch eis auth key to ApiKey instead of Bearer * Addressing feedback, adding test
1 parent 5e4a055 commit cf683c0

File tree

10 files changed

+46
-20
lines changed

10 files changed

+46
-20
lines changed

‎x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/external/request/RequestUtils.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,14 @@ public static String bearerToken(String apiKey) {
2929
return "Bearer " + apiKey;
3030
}
3131

32+
public static Header createAuthApiKeyHeader(SecureString apiKey) {
33+
return new BasicHeader(HttpHeaders.AUTHORIZATION, apiKey(apiKey.toString()));
34+
}
35+
36+
public static String apiKey(String apiKey) {
37+
return "ApiKey " + apiKey;
38+
}
39+
3240
public static URI buildUri(URI accountUri, String service, CheckedSupplier<URI, URISyntaxException> uriBuilder) {
3341
try {
3442
return accountUri == null ? uriBuilder.get() : accountUri;

‎x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/services/elastic/ccm/CCMAuthenticationApplierFactory.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
import java.util.Objects;
1818
import java.util.function.Function;
1919

20-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.createAuthBearerHeader;
20+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.createAuthApiKeyHeader;
2121
import static org.elasticsearch.xpack.inference.rest.Paths.INFERENCE_CCM_PATH;
2222

2323
/**
@@ -70,7 +70,7 @@ public AuthenticationHeaderApplier(String apiKey) {
7070

7171
@Override
7272
public HttpRequestBase apply(HttpRequestBase request) {
73-
request.setHeader(createAuthBearerHeader(apiKey));
73+
request.setHeader(createAuthApiKeyHeader(apiKey));
7474
return request;
7575
}
7676
}

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/external/request/RequestUtilsTests.java‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,37 @@
1010
import org.elasticsearch.common.settings.SecureString;
1111
import org.elasticsearch.test.ESTestCase;
1212

13+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
1314
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
15+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.createAuthApiKeyHeader;
1416
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.createAuthBearerHeader;
1517
import static org.hamcrest.Matchers.is;
1618

1719
public class RequestUtilsTests extends ESTestCase {
20+
private static final String SECRET = "abc";
21+
private static final String BEARER_PREFIX = "Bearer ";
22+
private static final String APIKEY_PREFIX = "ApiKey ";
23+
private static final String AUTHORIZATION_HEADER = "Authorization";
24+
1825
public void testCreateAuthBearerHeader() {
19-
var header = createAuthBearerHeader(new SecureString("abc".toCharArray()));
26+
var header = createAuthBearerHeader(new SecureString(SECRET.toCharArray()));
2027

21-
assertThat(header.getName(), is("Authorization"));
22-
assertThat(header.getValue(), is("Bearer abc"));
28+
assertThat(header.getName(), is(AUTHORIZATION_HEADER));
29+
assertThat(header.getValue(), is(BEARER_PREFIX + SECRET));
2330
}
2431

2532
public void testBearerToken() {
26-
assertThat(bearerToken("abc"), is("Bearer abc"));
33+
assertThat(bearerToken(SECRET), is(BEARER_PREFIX + SECRET));
34+
}
35+
36+
public void testCreateAuthApiKeyHeader() {
37+
var header = createAuthApiKeyHeader(new SecureString(SECRET.toCharArray()));
38+
39+
assertThat(header.getName(), is(AUTHORIZATION_HEADER));
40+
assertThat(header.getValue(), is(APIKEY_PREFIX + SECRET));
41+
}
42+
43+
public void testApiKey() {
44+
assertThat(apiKey(SECRET), is(APIKEY_PREFIX + SECRET));
2745
}
2846
}

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/external/request/elastic/ElasticInferenceServiceRerankRequestTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
import java.util.List;
2121

2222
import static org.elasticsearch.xpack.inference.external.http.Utils.entityAsMap;
23-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
23+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
2424
import static org.elasticsearch.xpack.inference.services.elastic.request.ElasticInferenceServiceRequestTests.randomElasticInferenceServiceRequestMetadata;
2525
import static org.hamcrest.Matchers.aMapWithSize;
2626
import static org.hamcrest.Matchers.instanceOf;
@@ -99,7 +99,7 @@ public void testDecorate_HttpRequest_WithAuthorizationHeader() {
9999
assertThat(httpPost.getLastHeader(Task.TRACE_STATE).getValue(), is(traceState));
100100
var headers = httpPost.getHeaders(HttpHeaders.AUTHORIZATION);
101101
assertThat(headers.length, is(1));
102-
assertThat(headers[0].getValue(), is(bearerToken(secret)));
102+
assertThat(headers[0].getValue(), is(apiKey(secret)));
103103
}
104104

105105
private ElasticInferenceServiceRerankRequest createRequest(

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/action/ElasticInferenceServiceActionCreatorTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
import static org.elasticsearch.xpack.inference.external.http.Utils.getUrl;
5353
import static org.elasticsearch.xpack.inference.external.http.retry.RetrySettingsTests.buildSettingsWithRetryFields;
5454
import static org.elasticsearch.xpack.inference.external.http.sender.HttpRequestSenderTests.createSender;
55-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
55+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
5656
import static org.elasticsearch.xpack.inference.services.ServiceComponentsTests.createWithEmptySettings;
5757
import static org.elasticsearch.xpack.inference.services.elastic.ccm.CCMAuthenticationApplierFactoryTests.createApplierFactory;
5858
import static org.elasticsearch.xpack.inference.services.elastic.ccm.CCMAuthenticationApplierFactoryTests.createNoopApplierFactory;
@@ -208,7 +208,7 @@ public void testExecute_SparseEmbedding_AddsAuthorizationHeader() throws IOExcep
208208

209209
private static void assertHeadersWithAuth(List<MockRequest> requests, String secret) {
210210
var request = assertSingleRequestSent(requests);
211-
assertThat(request.getHeader(HttpHeaders.AUTHORIZATION), equalTo(bearerToken(secret)));
211+
assertThat(request.getHeader(HttpHeaders.AUTHORIZATION), equalTo(apiKey(secret)));
212212
}
213213

214214
private static MockRequest assertSingleRequestSent(List<MockRequest> requests) {

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/authorization/ElasticInferenceServiceAuthorizationRequestHandlerTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
import static org.elasticsearch.xpack.inference.Utils.mockClusterServiceEmpty;
4242
import static org.elasticsearch.xpack.inference.external.http.Utils.getUrl;
4343
import static org.elasticsearch.xpack.inference.external.http.retry.RetryingHttpSender.MAX_RETIES;
44-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
44+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
4545
import static org.elasticsearch.xpack.inference.services.SenderServiceTests.createMockSender;
4646
import static org.elasticsearch.xpack.inference.services.elastic.ccm.CCMAuthenticationApplierFactoryTests.createApplierFactory;
4747
import static org.elasticsearch.xpack.inference.services.elastic.ccm.CCMAuthenticationApplierFactoryTests.createNoopApplierFactory;
@@ -266,7 +266,7 @@ public void testGetAuthorization_ReturnsAValidResponse_WithAuthHeader() throws I
266266

267267
private static void assertAuthHeader(List<MockRequest> requests, String secret) {
268268
assertThat(requests.size(), is(1));
269-
assertThat(requests.get(0).getHeader(HttpHeaders.AUTHORIZATION), is(bearerToken(secret)));
269+
assertThat(requests.get(0).getHeader(HttpHeaders.AUTHORIZATION), is(apiKey(secret)));
270270
}
271271

272272
public void testGetAuthorization_OnResponseCalledOnce() throws IOException {

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/ccm/CCMAuthenticationApplierFactoryTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
import org.elasticsearch.core.TimeValue;
1717
import org.elasticsearch.test.ESTestCase;
1818

19-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
19+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
2020
import static org.hamcrest.Matchers.containsString;
2121
import static org.hamcrest.Matchers.is;
2222
import static org.hamcrest.Matchers.sameInstance;
@@ -61,7 +61,7 @@ public void testAuthenticationHeaderApplierSetsAuthorizationHeader() {
6161
var applier = new CCMAuthenticationApplierFactory.AuthenticationHeaderApplier(secret);
6262
var request = new HttpGet("http://localhost");
6363
applier.apply(request);
64-
assertThat(request.getFirstHeader(HttpHeaders.AUTHORIZATION).getValue(), is(bearerToken(secret)));
64+
assertThat(request.getFirstHeader(HttpHeaders.AUTHORIZATION).getValue(), is(apiKey(secret)));
6565
}
6666

6767
public void testGetAuthenticationApplier_ReturnsNoopWhenConfiguringCCMIsDisabled() {

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/request/ElasticInferenceServiceDenseTextEmbeddingsRequestTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323

2424
import static org.elasticsearch.xpack.inference.InferencePlugin.X_ELASTIC_PRODUCT_USE_CASE_HTTP_HEADER;
2525
import static org.elasticsearch.xpack.inference.external.http.Utils.entityAsMap;
26-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
26+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
2727
import static org.elasticsearch.xpack.inference.services.elastic.request.ElasticInferenceServiceRequestTests.randomElasticInferenceServiceRequestMetadata;
2828
import static org.hamcrest.Matchers.aMapWithSize;
2929
import static org.hamcrest.Matchers.equalTo;
@@ -200,7 +200,7 @@ public void testDecorate_HttpRequest_WithAuthorizationHeader() {
200200

201201
var headers = httpPost.getHeaders(HttpHeaders.AUTHORIZATION);
202202
assertThat(headers.length, is(1));
203-
assertThat(headers[0].getValue(), is(bearerToken(secret)));
203+
assertThat(headers[0].getValue(), is(apiKey(secret)));
204204
}
205205
}
206206

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/request/ElasticInferenceServiceRequestTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020

2121
import static org.elasticsearch.xpack.inference.InferencePlugin.X_ELASTIC_ES_VERSION;
2222
import static org.elasticsearch.xpack.inference.InferencePlugin.X_ELASTIC_PRODUCT_USE_CASE_HTTP_HEADER;
23-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
23+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
2424
import static org.hamcrest.Matchers.equalTo;
2525
import static org.hamcrest.Matchers.is;
2626

@@ -36,7 +36,7 @@ public void testElasticInferenceServiceRequestSubclasses_Decorate_HttpRequest_Wi
3636
var httpRequest = elasticInferenceServiceRequestWrapper.createHttpRequest();
3737

3838
assertThat(httpRequest.httpRequestBase().getHeaders(HttpHeaders.AUTHORIZATION).length, equalTo(1));
39-
assertThat(httpRequest.httpRequestBase().getFirstHeader(HttpHeaders.AUTHORIZATION).getValue(), is(bearerToken(secret)));
39+
assertThat(httpRequest.httpRequestBase().getFirstHeader(HttpHeaders.AUTHORIZATION).getValue(), is(apiKey(secret)));
4040
}
4141

4242
public void testElasticInferenceServiceRequestSubclasses_Decorate_HttpRequest_WithProductOrigin() {

‎x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/services/elastic/request/ElasticInferenceServiceSparseEmbeddingsRequestTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
import static org.elasticsearch.xpack.inference.InferencePlugin.X_ELASTIC_PRODUCT_USE_CASE_HTTP_HEADER;
2626
import static org.elasticsearch.xpack.inference.external.http.Utils.entityAsMap;
27-
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.bearerToken;
27+
import static org.elasticsearch.xpack.inference.external.request.RequestUtils.apiKey;
2828
import static org.elasticsearch.xpack.inference.services.elastic.request.ElasticInferenceServiceRequestTests.randomElasticInferenceServiceRequestMetadata;
2929
import static org.hamcrest.Matchers.aMapWithSize;
3030
import static org.hamcrest.Matchers.equalTo;
@@ -152,7 +152,7 @@ public void testDecorate_HttpRequest_WithAuthorizationHeader() {
152152

153153
var headers = httpPost.getHeaders(HttpHeaders.AUTHORIZATION);
154154
assertThat(headers.length, is(1));
155-
assertThat(headers[0].getValue(), is(bearerToken(secret)));
155+
assertThat(headers[0].getValue(), is(apiKey(secret)));
156156
}
157157
}
158158

0 commit comments

Comments
 (0)