# Integrating REST API call into role template

**URL:** <https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790>\
**Category:** Elasticsearch\
**Created:** [July 12, 2018, 4:04pm UTC](https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790 "2018-07-12T16:04:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ewalters-cspace](https://avatars.discourse-cdn.com/v4/letter/e/35a633/32.png) [@ewalters-cspace](https://discuss.elastic.co/u/ewalters-cspace)\
**Post date:** [July 12, 2018, 4:04pm UTC](https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790/1 "2018-07-12T16:04:15Z")

</div>

I am trying to implement an ABAC scheme, similar to the link below.

> **[Document-Level Attribute-Based Access Control with X-Pack 6.1
	  	 | Elastic](https://www.elastic.co/blog/attribute-based-access-control-with-xpack)**
>
> Thanks to a new feature in Lucene 7.1, the CoveringQuery, and the exposure of that feature in the new terms\_set query released with Elasticsearch 6.1, it is possible to setup an attribute-ba...

I would like to add on certain functionality - my users authenticate through PKI and their attributes, instead of being hardcoded into Elasticsearch through a metadata field, are stored in and accessible through a third-party API. Using a DN, I can retrieve a JSON object containing the attributes that I need.

My issue is then integrating this JSON object into the mustache template so I can use the fields for terms\_set. My idea so far, mostly based off of the example scripting plugin ([https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-engine.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-engine.html)  
) is to write a custom `ScriptEngine` plugin so that I can make the API call and get my JSON object in Java, then retrieve it and access it similar to below.

```
        "script":{
            "source": "custom_API_call",
            "lang" : "expert_scripts",
            "params": {
                "DN": "CN=test,...,...",
            }
        }

```

`{\"terms\": {{#toJson}}API_JSON_RESULT.metadata.security_attributes{{/toJson}},":...}`

Would anybody be able to give me some guidance on how best to do this? I haven't been able to make much headway looking at the Javadocs - I don't really need any of the advanced functionality that many of the plugin classes give. Could the `TemplateScript` class be used to return what is essentially simple text?

I'm pretty new to this-thanks for the help!

---

<div class="post-metadata">

**Author:** ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)\
**Post date:** [July 20, 2018, 8:58pm UTC](https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790/2 "2018-07-20T20:58:05Z")

</div>

@ewalters-cspace  
I don't think the role creation step is the right place to do this.

Since you want to add metadata to the user, I think the best idea is creating a [custom realm](https://www.elastic.co/guide/en/x-pack/current/custom-realms.html). That way, you could add the API call into the authentication logic.

You should be able to call most of the existing [PkiRealm](https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/pki/PkiRealm.java) methods from your custom implementation so as to minimize the amount of code you have to write.

That make sense?

With the custom realm in place, the role creation step using the user metadata templates should work as illustrated in the blog.

---

<div class="post-metadata">

**Author:** ![ewalters-cspace](https://avatars.discourse-cdn.com/v4/letter/e/35a633/32.png) [@ewalters-cspace](https://discuss.elastic.co/u/ewalters-cspace)\
**Post date:** [July 20, 2018, 10:02pm UTC](https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790/3 "2018-07-20T22:02:27Z")

</div>

That makes a lot more sense, thank you! That should work great.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2018, 10:02pm UTC](https://discuss.elastic.co/t/integrating-rest-api-call-into-role-template/139790/4 "2018-08-17T22:02:29Z")

</div>

Closed on August 17, 2018, 10:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.