html5 token api,Get token API

Examplesedit

The following example obtains a token using the client_credentials grant type,

which simply creates a token as the authenticated user:

POST /_security/oauth2/token

{

"grant_type" : "client_credentials"

}

The following example output contains the access token, the amount of time (in

seconds) that the token expires in, and the type:

{

"access_token" : "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",

"type" : "Bearer",

"expires_in" : 1200,

"authentication" : {

"username" : "test_admin",

"roles" : [

"superuser"

],

"full_name" : null,

"email" : null,

"metadata" : { },

"enabled" : true,

"authentication_realm" : {

"name" : "file",

"type" : "file"

},

"lookup_realm" : {

"name" : "file",

"type" : "file"

},

"authentication_type" : "realm"

}

}

The token returned by this API can be used by sending a request with an

Authorization header with a value having the prefix "Bearer " followed

by the value of the access_token.

curl -H "Authorization: Bearer dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==" http://localhost:9200/_cluster/health

The following example obtains a token for the test_admin user using the

password grant type:

POST /_security/oauth2/token

{

"grant_type" : "password",

"username" : "test_admin",

"password" : "x-pack-test-password"

}

The following example output contains the access token, the amount of time (in

seconds) that the token expires in, the type, and the refresh token:

{

"access_token" : "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",

"type" : "Bearer",

"expires_in" : 1200,

"refresh_token": "vLBPvmAB6KvwvJZr27cS",

"authentication" : {

"username" : "test_admin",

"roles" : [

"superuser"

],

"full_name" : null,

"email" : null,

"metadata" : { },

"enabled" : true,

"authentication_realm" : {

"name" : "file",

"type" : "file"

},

"lookup_realm" : {

"name" : "file",

"type" : "file"

},

"authentication_type" : "realm"

}

}

To extend the life of an existing token obtained using the password grant type,

you can call the API again with the refresh token within 24 hours of the token’s

creation. For example:

POST /_security/oauth2/token

{

"grant_type": "refresh_token",

"refresh_token": "vLBPvmAB6KvwvJZr27cS"

}

The API will return a new token and refresh token. Each refresh token may only

be used one time.

{

"access_token" : "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",

"type" : "Bearer",

"expires_in" : 1200,

"refresh_token": "vLBPvmAB6KvwvJZr27cS",

"authentication" : {

"username" : "test_admin",

"roles" : [

"superuser"

],

"full_name" : null,

"email" : null,

"metadata" : { },

"enabled" : true,

"authentication_realm" : {

"name" : "file",

"type" : "file"

},

"lookup_realm" : {

"name" : "file",

"type" : "file"

},

"authentication_type" : "token"

}

}

The following example obtains a access token and refresh token using the kerberos grant type,

which simply creates a token in exchange for the base64 encoded kerberos ticket:

POST /_security/oauth2/token

{

"grant_type" : "_kerberos",

"kerberos_ticket" : "YIIB6wYJKoZIhvcSAQICAQBuggHaMIIB1qADAgEFoQMCAQ6iBtaDcp4cdMODwOsIvmvdX//sye8NDJZ8Gstabor3MOGryBWyaJ1VxI4WBVZaSn1WnzE06Xy2"

}

The API will return a new token and refresh token if kerberos authentication is successful.

Each refresh token may only be used one time. When the mutual authentication is requested in the Spnego GSS context,

a base64 encoded token will be returned by the server in the kerberos_authentication_response_token

for clients to consume and finalize the authentication.

{

"access_token" : "dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==",

"type" : "Bearer",

"expires_in" : 1200,

"refresh_token": "vLBPvmAB6KvwvJZr27cS"

"kerberos_authentication_response_token": "YIIB6wYJKoZIhvcSAQICAQBuggHaMIIB1qADAg",

"authentication" : {

"username" : "test_admin",

"roles" : [

"superuser"

],

"full_name" : null,

"email" : null,

"metadata" : { },

"enabled" : true,

"authentication_realm" : {

"name" : "file",

"type" : "file"

},

"lookup_realm" : {

"name" : "file",

"type" : "file"

},

"authentication_type" : "realm"

}

}