I have configured search guard with elasticsearch.
In ACL Configuration, if I dont specify any role with the specific access against any indices…it works.
However I want a role where it should be allowed only for a particular index.
Below is my configuration changes. With this configuration I am not able to start kibana itself.
If I remove indices from ACL configuration for role admin, It is working.
Here is my elasticsearch.yml configuration:
searchguard.enabled: true
searchguard.rewrite_get_as_search: true
searchguard.key_path: C:/Test/searchguard_node.key
searchguard.config_index_name: searchguard
searchguard.http.enable_sessions: false
searchguard.auditlog.enabled: true
searchguard.allow_all_from_loopback: true
searchguard.check_for_root: false
searchguard.authentication.authentication_backend.impl: com.floragunn.searchguard.authentication.backend.simple.SettingsBasedAuthenticationBackend
searchguard.authentication.authentication_backend.cache.enable: false
searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.simple.SettingsBasedAuthorizator
searchguard.authentication.authorizer.cache.enable: false
searchguard.authentication.http_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator
searchguard.authentication.settingsdb.user.admin: password
searchguard.authentication.settingsdb.user.manager: password
searchguard.authentication.authorization.settingsdb.roles.admin: [“admin”]
searchguard.authentication.authorization.settingsdb.roles.manager: [“manager”]
searchguard.actionrequestfilter.names: [“readonly”]
searchguard.actionrequestfilter.readonly.allowed_actions: [“indices:data/read/*”, “monitor”]
searchguard.actionrequestfilter.readonly.forbidden_actions: [“cluster:admin*”, “indices:admin*”, “indices:data/write*”]
Here is my ACL configuration:
{
“acl”: [
{
“Comment”: “By default no filters are executed and no filters are by-passed. In such a case a exception is thrown and access will be denied.”,
“filters_bypass”: ,
“filters_execute”:
},
{
“Comment”: “For role ‘admin’ all filters are bypassed (so none will be executed). This means unrestricted access.”,
“roles”: [
“admin”
],
“indices”: [
“logstash-2014.10.05”
],
“filters_bypass”: [“dlsfilter.","dlsfilter.”],
“filters_execute”: [“*”]
},
{
“Comment”: “For role ‘operations’ all filters will be executed.”,
“roles”: [
“manager”
],
“filters_bypass”: ,
“filters_execute”: [“*”]
}
]
}
Please do the needfull.
Thanks,
Lakshmi.