User Authentication | Security | Elasticsearch Tutorial

Introduction

User authentication is a critical aspect of security in any system, ensuring that only authorized users can access certain resources. Elasticsearch provides robust mechanisms to handle user authentication, including built-in user authentication, integration with external identity providers, and role-based access control.

Setting Up Built-in Users

Elasticsearch has several built-in users such as elastic and kibana. To set up these users, follow these steps:

1. Start Elasticsearch:

./bin/elasticsearch

2. Set the password for the built-in users:

./bin/elasticsearch-setup-passwords interactive

You will be prompted to enter passwords for the built-in users. After setting them up, you can use these credentials to log in.

Creating New Users

To create new users, use the users API. Here's an example:

PUT /_security/user/jdoe
{
  "password" : "password123",
  "roles" : [ "admin" ],
  "full_name" : "John Doe",
  "email" : "jdoe@example.com"
}

{ "acknowledged" : true }

This creates a user jdoe with the specified password, roles, full name, and email.

Role-Based Access Control (RBAC)

RBAC allows you to define roles with specific permissions and assign these roles to users. Here's how to create a role:

PUT /_security/role/my_custom_role
{
  "cluster": ["all"],
  "indices": [
    {
      "names": [ "index1", "index2" ],
      "privileges": ["read", "write"]
    }
  ]
}

{ "role" : "my_custom_role", "created" : true }

This creates a role my_custom_role with cluster-wide permissions and specific privileges on indices index1 and index2.

Integrating with External Identity Providers

Elasticsearch can integrate with external identity providers like LDAP, Active Directory, and SAML. Here's an example of configuring LDAP:

xpack:
  security:
    authc:
      realms:
        ldap:
          ldap1:
            order: 0
            url: "ldap://ldap.example.com:389"
            bind_dn: "cn=admin,dc=example,dc=com"
            user_search:
              base_dn: "dc=example,dc=com"
              filter: "(uid={0})"
            group_search:
              base_dn: "dc=example,dc=com"
            files:
              role_mapping: "role_mapping.yml"
            unmapped_groups_as_roles: false

This configuration sets up an LDAP realm in Elasticsearch, allowing it to authenticate users against an LDAP directory.

Testing User Authentication

To test if a user can authenticate and what roles they have, use the authenticate API:

GET /_security/_authenticate

{ "username" : "elastic", "roles" : [ "superuser" ], "full_name" : "Elastic User", "email" : "elastic@example.com", "metadata" : { }, "enabled" : true, "authentication_realm" : { "name" : "reserved", "type" : "reserved" }, "lookup_realm" : { "name" : "reserved", "type" : "reserved" } }

This API returns information about the authenticated user, including roles and realms.

Conclusion

In this tutorial, we've covered the basics of user authentication in Elasticsearch, including setting up built-in users, creating new users, configuring RBAC, integrating with external identity providers, and testing authentication. Proper user authentication is essential for securing your Elasticsearch cluster and ensuring that only authorized users have access to sensitive data.

User Authentication in Elasticsearch