# Oauth and ES tokens
**URL:** https://discuss.elastic.co/t/oauth-and-es-tokens/20128
**Category:** Elasticsearch
**Created:** [October 7, 2014, 9:15pm UTC](https://discuss.elastic.co/t/oauth-and-es-tokens/20128 "2014-10-07T21:15:34Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Zachary\_Buckholz](https://discuss.elastic.co/u/Zachary_Buckholz)
#### Post date: [October 7, 2014, 9:15pm UTC](https://discuss.elastic.co/t/oauth-and-es-tokens/20128/1 "2014-10-07T21:15:34Z")
Is there any work being done to integrating a token lookup service within
ES to see if a request is authorized?
I'd like to implement an angularjs application that is exposed to the
public internet, and at the same time has direct access to ES; with each
query being encapsulated with a token request and signed.
Thanks
Zach
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b32c7fde-c129-47df-8e9f-a6b8978b6c3c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b32c7fde-c129-47df-8e9f-a6b8978b6c3c%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@karmi](https://discuss.elastic.co/u/karmi)
#### Post date: [October 8, 2014, 5:13am UTC](https://discuss.elastic.co/t/oauth-and-es-tokens/20128/2 "2014-10-08T05:13:04Z")
Hi,
what you're looking for is a proxy which can communicate with an OAuth
provider, with an OAuth provider (such as "Google+ Sign-In", "Sign in with
Twitter", etc), verify the cookies, and pass requests between the browser
and Elasticsearch. (See this
diagram: [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/content/themes/elasticsearch-org/images/content/elasticsearch-and-ember-js/notes-app-architecture.png))
There's a full-featured example of such proxy here:
[Ember.js application with elasticsearch persistence and Goliath based proxy [http://www.elasticsearch.org/tutorials/2012/08/22/javascript-web-applications-and-elasticsearch.html] · GitHub](https://gist.github.com/karmi/3369662#file-proxy-rb), written in Ruby, using
the Goliath library. It was written for the following article on the
[Elasticsearch.org](http://Elasticsearch.org) blog, which you might find useful for getting an overview
of concepts and techniques (though it's using Ember.js and not Angular):
--\>
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
For a heavy-loaded system, you should consider using Nginx as the proxy,
implementing the OAuth support via the Lua integration. See this article
for a full
example: [Yak Shaving: Adding OAuth Support to Nginx via Lua - ChairNerd](http://chairnerd.seatgeek.com/oauth-support-for-nginx-with-lua/)
(See this article for general overview of using Nginx together with
Elasticsearch: [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/playing-http-tricks-nginx/))
Karel
On Tuesday, October 7, 2014 11:15:34 PM UTC+2, Zachary Buckholz wrote:
> Is there any work being done to integrating a token lookup service within
> ES to see if a request is authorized?
>
> I'd like to implement an angularjs application that is exposed to the
> public internet, and at the same time has direct access to ES; with each
> query being encapsulated with a token request and signed.
>
> Thanks
> Zach
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f999aa2b-9b55-4d0e-8404-d6bc69edadbb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f999aa2b-9b55-4d0e-8404-d6bc69edadbb%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Zachary\_Buckholz](https://discuss.elastic.co/u/Zachary_Buckholz)
#### Post date: [October 8, 2014, 3:48pm UTC](https://discuss.elastic.co/t/oauth-and-es-tokens/20128/3 "2014-10-08T15:48:57Z")
Thank you for the detailed response.
On Tuesday, October 7, 2014 10:13:04 PM UTC-7, Karel Minařík wrote:
> Hi,
>
> what you're looking for is a proxy which can communicate with an OAuth
> provider, with an OAuth provider (such as "Google+ Sign-In", "Sign in with
> Twitter", etc), verify the cookies, and pass requests between the browser
> and Elasticsearch. (See this diagram:
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/content/themes/elasticsearch-org/images/content/elasticsearch-and-ember-js/notes-app-architecture.png)
> )
>
> There's a full-featured example of such proxy here:
> [Ember.js application with elasticsearch persistence and Goliath based proxy [http://www.elasticsearch.org/tutorials/2012/08/22/javascript-web-applications-and-elasticsearch.html] · GitHub](https://gist.github.com/karmi/3369662#file-proxy-rb), written in Ruby,
> using the Goliath library. It was written for the following article on the
> [Elasticsearch.org](http://Elasticsearch.org) blog, which you might find useful for getting an overview
> of concepts and techniques (though it's using Ember.js and not Angular):
>
> --\>
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/tutorials/javascript-web-applications-and-elasticsearch/)
>
> For a heavy-loaded system, you should consider using Nginx as the proxy,
> implementing the OAuth support via the Lua integration. See this article
> for a full example:
> [Yak Shaving: Adding OAuth Support to Nginx via Lua - ChairNerd](http://chairnerd.seatgeek.com/oauth-support-for-nginx-with-lua/) (See this
> article for general overview of using Nginx together with Elasticsearch:
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/playing-http-tricks-nginx/))
>
> Karel
>
> On Tuesday, October 7, 2014 11:15:34 PM UTC+2, Zachary Buckholz wrote:
>
> > Is there any work being done to integrating a token lookup service within
> > ES to see if a request is authorized?
> >
> > I'd like to implement an angularjs application that is exposed to the
> > public internet, and at the same time has direct access to ES; with each
> > query being encapsulated with a token request and signed.
> >
> > Thanks
> > Zach
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7c54c447-1eb7-4d9a-a76e-2e9b1ca2d24b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7c54c447-1eb7-4d9a-a76e-2e9b1ca2d24b%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:57am UTC](https://discuss.elastic.co/t/oauth-and-es-tokens/20128/4 "2017-07-06T00:57:35Z")