Elasticsearch:Configure LDAP authentication for an Elasticsearch cluster

How it works

Elasticsearch uses X-Pack security realms to authenticate users against an external LDAP directory. When an LDAP user logs in:

1. The user submits a username and password.

2. X-Pack searches the LDAP directory for the user's distinguished name (DN) based on the username.

3. X-Pack binds to the LDAP server with the found DN and the provided password.

4. If the bind succeeds, the user is authenticated and assigned Elasticsearch roles through role mapping.

Two authentication modes are available:

This guide covers user search mode, the most common configuration.

Prerequisites

Before you begin, ensure that you have:

• An Alibaba Cloud Elasticsearch cluster. This guide provides configuration examples for V6.7 and V7.10 or later.

  • For more information, see Create an Alibaba Cloud Elasticsearch cluster

• An LDAP server running in the same virtual private cloud (VPC) as the Elasticsearch cluster. This guide uses OpenLDAP 2.4.44 as an example

  • For more information, see OpenLDAP quick start guide

• LDAP user data prepared with cn and Group attributes

Network connectivity

The network architecture of Alibaba Cloud Elasticsearch changed in October 2020. Your connectivity setup depends on when your cluster was created.

Step 1: Configure the LDAP realm

Add the following LDAP realm configuration to the YML file of your Elasticsearch cluster. For more information about editing the YML file, see Configure the YML file.

xpack.security.authc.realms.ldap1.type: ldap
xpack.security.authc.realms.ldap1.order: 2
xpack.security.authc.realms.ldap1.url: "ldap://<ldap-host>:389"
xpack.security.authc.realms.ldap1.bind_dn: "<bind-user>@<domain>"
xpack.security.authc.realms.ldap1.bind_password: "<bind-password>"
xpack.security.authc.realms.ldap1.user_search.base_dn: "<user-search-base-dn>"
xpack.security.authc.realms.ldap1.user_search.filter: "(cn={0})"
xpack.security.authc.realms.ldap1.group_search.base_dn: "<group-search-base-dn>"
xpack.security.authc.realms.ldap1.unmapped_groups_as_roles: false

xpack.security.authc.realms.ldap.ldap1.order: 2
xpack.security.authc.realms.ldap.ldap1.url: "ldap://<ldap-host>:389"
xpack.security.authc.realms.ldap.ldap1.bind_dn: "<bind-user>@<domain>"
xpack.security.authc.realms.ldap.ldap1.bind_password: "<bind-password>"
xpack.security.authc.realms.ldap.ldap1.user_search.base_dn: "<user-search-base-dn>"
xpack.security.authc.realms.ldap.ldap1.user_search.filter: "(cn={0})"
xpack.security.authc.realms.ldap.ldap1.group_search.base_dn: "<group-search-base-dn>"
xpack.security.authc.realms.ldap.ldap1.unmapped_groups_as_roles: false

Step 2: Map LDAP users to Elasticsearch roles

After you configure the LDAP realm, map LDAP users or groups to Elasticsearch roles so they have appropriate permissions.

1. Log in to the Kibana console of your Elasticsearch cluster. For more information, see Log on to the Kibana console.

   Note

   The following steps use an Elasticsearch V6.7.0 cluster as an example. The interface may differ for other versions.

2. In the left-side navigation pane, click Dev Tools.

3. On the Console tab, run a role mapping command.

   V8.X

   POST _security/role_mapping/ldap_admin
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "username": "zhang*"
           }
         }
       ]
     }
   }

   V6.7 and V7.X

   POST _xpack/security/role_mapping/ldap_admin
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "username": "zhang*"
           }
         }
       ]
     }
   }

   This example maps all usernames matching zhang* to the superuser role. For more information about the role mapping API, see Role mapping APIs.

Step 3: Verify the configuration

1. Log in to the Kibana console with an LDAP user account (for example, zhang*).

   

2. In the left-side navigation pane, click Dev Tools.

3. On the Console tab, run the following command to confirm that the LDAP user has the expected permissions:

   PUT _cluster/settings
   {
     "persistent": {
       "action.auto_create_index": true
     }
   }

4. If the command returns a successful response, the LDAP user has been authenticated and has the assigned superuser role.

   

References

• Create an Alibaba Cloud Elasticsearch cluster

• Configure the YML file

• Configure a private connection for an Elasticsearch cluster

• Log on to the Kibana console

• LDAP realm settings (Elastic documentation)

• Configure an LDAP realm (Elastic documentation)