# Custom realm and roles provider that uses PKI

**URL:** <https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939>\
**Category:** Elasticsearch\
**Created:** [October 23, 2017, 5:03pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939 "2017-10-23T17:03:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asanderson](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@asanderson](https://discuss.elastic.co/u/asanderson)\
**Post date:** [October 23, 2017, 5:03pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939/1 "2017-10-23T17:03:44Z")

</div>

I'm trying to develop a x-pack plugin that implements a **_custom realm_** and **_custom roles provider_** which uses the DN of a user certificate to authenticate and create custom roles based upon a RESTful request to an external legacy authentication and authorization system. I'm using the [shield-custom-realm-example](https://github.com/elastic/shield-custom-realm-example) as my guide, but since there's no x-pack-api javadoc, I don't see how it's possible to obtain the user DN from the user's Elasticsearch request and/or PKI realm. Please advise.

---

<div class="post-metadata">

**Author:** ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)\
**Post date:** [October 23, 2017, 9:28pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939/2 "2017-10-23T21:28:26Z")

</div>

@asanderson don't know if this is helpful, but you should be able to do something like this in the custom realm implementation:

```auto
import org.elasticsearch.xpack.security.authc.pki.X509AuthenticationToken;

 public void authenticate(AuthenticationToken authenticationToken, 
    ActionListener<AuthenticationResult> listener) {
    X509AuthenticationToken token = (X509AuthenticationToken)authToken;
    String dn = token.dn();
    String principal = token.principal();
    java.security.cert.X509Certificate[] creds = token.credentials();
}
```

---

<div class="post-metadata">

**Author:** ![asanderson](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@asanderson](https://discuss.elastic.co/u/asanderson)\
**Post date:** [October 23, 2017, 10:18pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939/3 "2017-10-23T22:18:03Z")

</div>

If that works, then that's exactly what I was seeking.  
I'll give it a try.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 10:18pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939/4 "2017-11-20T22:18:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.