elasticsearch - Elasticsearch中所有匹配用户的角色映射

Question

如何在Elasticsearch中获取单个用户的所有角色映射。
我有这样的角色映射:

"sdbsd21tdsbjvbriuu": {
        "enabled": true,
        "roles": [
            "kibana_dashboard_only_user",
            "5e3bb57222b49800016b666f"
        ],
        "rules": {
            "all": [
                {
                    "field": {
                        "realm.name": "oidc1"
                    }
                },
                {
                    "field": {
                        "username": [
                            "user001@one.com",
                            "User002@two.com",
                            "USER003@three.com"
                        ]
                    }
                }
            ]
        },
        "metadata": {
            "migrated": false
        }
    }

例如 user001@one.com可以跨越多个角色映射。我想使用 user001@one.com获取所有角色映射。怎么做？
我试图搜索 security-7索引。但是，无法对此进行单个搜索查询。

GET .security-7/_search
{
    "query": {
        "bool": {
            "must": [
                {
                    "term": {
                        "doc_type": "role-mapping"
                    }
                }                
            ]
        }
    }
}

.security-7索引的映射为:

{
    ".security-7": {
        "mappings": {
            "dynamic": "strict",
            "_meta": {
                "security-version": "7.6.2"
            },
            "properties": {
                "access_token": {
                    "properties": {
                        "invalidated": {
                            "type": "boolean"
                        },
                        "realm": {
                            "type": "keyword"
                        },
                        "user_token": {
                            "properties": {
                                "authentication": {
                                    "type": "binary"
                                },
                                "expiration_time": {
                                    "type": "date",
                                    "format": "epoch_millis"
                                },
                                "id": {
                                    "type": "keyword"
                                },
                                "metadata": {
                                    "type": "object",
                                    "dynamic": "false"
                                },
                                "version": {
                                    "type": "integer"
                                }
                            }
                        }
                    }
                },
                "actions": {
                    "type": "keyword"
                },
                "api_key_hash": {
                    "type": "keyword",
                    "index": false,
                    "doc_values": false
                },
                "api_key_invalidated": {
                    "type": "boolean"
                },
                "application": {
                    "type": "keyword"
                },
                "applications": {
                    "properties": {
                        "application": {
                            "type": "keyword"
                        },
                        "privileges": {
                            "type": "keyword"
                        },
                        "resources": {
                            "type": "keyword"
                        }
                    }
                },
                "cluster": {
                    "type": "keyword"
                },
                "creation_time": {
                    "type": "date",
                    "format": "epoch_millis"
                },
                "creator": {
                    "properties": {
                        "metadata": {
                            "type": "object",
                            "dynamic": "false"
                        },
                        "principal": {
                            "type": "keyword"
                        },
                        "realm": {
                            "type": "keyword"
                        }
                    }
                },
                "doc_type": {
                    "type": "keyword"
                },
                "email": {
                    "type": "text",
                    "analyzer": "email"
                },
                "enabled": {
                    "type": "boolean"
                },
                "expiration_time": {
                    "type": "date",
                    "format": "epoch_millis"
                },
                "full_name": {
                    "type": "text"
                },
                "global": {
                    "properties": {
                        "application": {
                            "properties": {
                                "manage": {
                                    "properties": {
                                        "applications": {
                                            "type": "keyword"
                                        }
                                    }
                                }
                            }
                        }
                    }
                },
                "indices": {
                    "properties": {
                        "allow_restricted_indices": {
                            "type": "boolean"
                        },
                        "field_security": {
                            "properties": {
                                "except": {
                                    "type": "keyword"
                                },
                                "grant": {
                                    "type": "keyword"
                                }
                            }
                        },
                        "names": {
                            "type": "keyword"
                        },
                        "privileges": {
                            "type": "keyword"
                        },
                        "query": {
                            "type": "keyword"
                        }
                    }
                },
                "limited_by_role_descriptors": {
                    "type": "object",
                    "enabled": false
                },
                "metadata": {
                    "type": "object",
                    "dynamic": "false"
                },
                "name": {
                    "type": "keyword"
                },
                "password": {
                    "type": "keyword",
                    "index": false,
                    "doc_values": false
                },
                "refresh_token": {
                    "properties": {
                        "client": {
                            "properties": {
                                "realm": {
                                    "type": "keyword"
                                },
                                "type": {
                                    "type": "keyword"
                                },
                                "user": {
                                    "type": "keyword"
                                }
                            }
                        },
                        "invalidated": {
                            "type": "boolean"
                        },
                        "refresh_time": {
                            "type": "date",
                            "format": "epoch_millis"
                        },
                        "refreshed": {
                            "type": "boolean"
                        },
                        "superseding": {
                            "properties": {
                                "encrypted_tokens": {
                                    "type": "binary"
                                },
                                "encryption_iv": {
                                    "type": "binary"
                                },
                                "encryption_salt": {
                                    "type": "binary"
                                }
                            }
                        },
                        "token": {
                            "type": "keyword"
                        }
                    }
                },
                "role_descriptors": {
                    "type": "object",
                    "enabled": false
                },
                "role_templates": {
                    "properties": {
                        "format": {
                            "type": "keyword"
                        },
                        "template": {
                            "type": "text"
                        }
                    }
                },
                "roles": {
                    "type": "keyword"
                },
                "rules": {
                    "type": "object",
                    "dynamic": "false"
                },
                "run_as": {
                    "type": "keyword"
                },
                "type": {
                    "type": "keyword"
                },
                "username": {
                    "type": "keyword"
                },
                "version": {
                    "type": "integer"
                }
            }
        }
    }
}

编辑:
对于所有以后这个问题的读者，我都跟着Elasticsearch团队进行了跟进。因为我有基于OIDC Realm 的角色映射。从Elasticsearch 7.8开始，我的问题没有可用的解决方案。最好的方法是解析响应JSON。我已经采用了这种方法。

Answer 1

您可以使用get用户API，为此，您需要按_security而不是.security-7索引，
我在启用x-pack时创建，如下所示:
网址http:// {{hostname}}:{{port}} / _security / user / foo

{
    "username": "foo",
    "full_name": "foo bar",
    "email": "foo@gmail.com",
    "password": "123456",
    "roles": [
        "ADMIN"
    ]
}

然后使用获取用户API可以获得其详细信息:
只需将上述方法更改为GET，您将获得低于o / p的值，您还可以在其中看到其作用。

{
    "foo": {
        "username": "foo",
        "roles": [
            "ADMIN"
        ],
        "full_name": "foo bar",
        "email": "foo@gmail.com",
        "metadata": {},
        "enabled": true
    }
}