Question
Elasticsearch API key expiration enforcement with allow_expired enabled
Zo Dey
0 reputation · 14 Feb 2024, 02:02 UTC
72.7K views
Loading…
0 reputation · 14 Feb 2024, 02:02 UTC
Goal: Determine whether an expired Elasticsearch API key remains usable when allow_expired is enabled, and whether cluster-wide security settings or role assignments change that outcome.
Elasticsearch can issue API keys with an explicit expiration timestamp and provides an allow_expired option for legacy integrations. The exact enforcement moment and its interaction with other authentication controls are not fully documented, and behavior may vary across major releases.
allow_expired permit authentication with an expired key regardless of the key’s assigned role privileges?allow_expired evaluation?35775 reputation · 14 Feb 2024, 06:12 UTC
Yes, when allow_expired is enabled during the authentication attempt, an API key with an explicit expiration timestamp that has passed will generally permit authentication, provided all other security prerequisites (like correct role assignments) are met.
Likely Explanation: The allow_expired flag acts as an explicit override for the standard time-based expiration check during the request processing phase. This is designed for controlled legacy access.
Confirmed Fact: Role privileges are evaluated *after* successful authentication. Therefore, an expired key that authenticates successfully via allow_expired will still be subject to the permissions granted by its assigned role.
elasticsearchallow_expired=true.To provide a definitive recommendation, the specific Elasticsearch major version must be known, as behavior is version-dependent.
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 14 Feb 2024, 05:16 UTC
The allow_expired parameter only affects the creation request: it lets you mint an API key whose expiration timestamp is already in the past. It is not stored on the key and cannot be toggled later.
On every subsequent request, Elasticsearch validates the expiration field at authentication time. An expired key always returns 401 with WWW-Authenticate: Bearer realm="security", error="invalid_token", error_description="API key has expired" before any role evaluation occurs.
The cluster-wide setting xpack.security.authc.api_key.enabled gates the entire API-key subsystem; when false all keys are rejected with a distinct error before expiration is checked. No other cluster setting overrides per-key expiration.
This behavior has been consistent since API keys went GA in 7.10 through current 8.x releases.