I’ve installed and run the searchguard demo without any problem. I’ve also configured the Kibana plugin and I was able to login with users kibanaro and admin, provided on the demo configs.
Now, I downloaded the LDAP module and I’m tryng to integrate the login page with my LDAP server, but something is missing and searchguard completely ignores the new LDAP configuration. It continues to authenticate against the demo configs (users kibanaro and admin).
I copied dlic-search-guard-authbackend-ldap-5.0-7-jar-with-dependencies.jar to /opt/elasticsearch-5.4.3/plugins/search-guard-5/
And included the LDAP configs in the sg_config.yml
Is there anything else I need to change in elasticsearch.yml or kibana.yml in order to use LDAP authentication?
I’m using ELK 5.4.3, search-guard-5-5.4.3-14 and searchguard-kibana-5.4.3-3
In my sg_config.yml I have the following configuration:
searchguard:
dynamic:
kibana:
Kibana multitenancy - NOT FREE FOR COMMERCIAL USE
see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md
To make this work you need to install Home · floragunncom/search-guard-module-kibana-multitenancy Wiki · GitHub
#multitenancy_enabled: true
#server_username: kibanaserver
#index: ‘.kibana’
#do_not_fail_on_forbidden: false
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern
#internalProxies: ‘.*’ # trust all internal proxies, regex pattern
remoteIpHeader: ‘x-forwarded-for’
proxiesHeader: ‘x-forwarded-by’
#trustedProxies: ‘.*’ # trust all external proxies, regex pattern
see Pattern (Java Platform SE 7 ) for regex help
more information about XFF X-Forwarded-For - Wikipedia
and here RFC 7239: Forwarded HTTP Extension
and Apache Tomcat 8 Configuration Reference (8.0.53) - The Valve Component
authc:
kerberos_auth_domain:
enabled: false
order: 6
http_authenticator:
type: kerberos # NOT FREE FOR COMMERCIAL USE
challenge: true
config:
If true a lot of kerberos/security related debugging output will be logged to standard out
krb_debug: false
If true then the realm will be stripped from the user name
strip_realm_from_principal: true
authentication_backend:
type: noop
basic_internal_auth_domain:
enabled: false
order: 1
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: intern
proxy_auth_domain:
enabled: false
order: 3
http_authenticator:
type: proxy
challenge: false
config:
user_header: “x-proxy-user”
roles_header: “x-proxy-roles”
authentication_backend:
type: noop
host_auth_domain:
enabled: false
order: 1
http_authenticator:
type: host #DEPRECATED, will be removed in a future version
challenge: false
authentication_backend:
type: noop
jwt_auth_domain:
enabled: false
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: “base64 encoded key”
jwt_header: “Authorization”
jwt_url_parameter: null
roles_key: null
subject_key: null
authentication_backend:
type: noop
clientcert_auth_domain:
enabled: false
order: 2
http_authenticator:
type: clientcert
config:
username_attribute: cn #optional, if omitted DN becomes username
challenge: false
authentication_backend:
type: noop
ldap:
enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
config:
enable_ssl: true
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: true
hosts:
- :636
bind_dn: cn=,ou=ServiceAccounts,ou=people,o=,c=
password:
userbase: ‘ou=people,o=,c=’
usersearch: ‘(uid={0})’
username_attribute: name
authz:
roles_from_myldap:
enabled: false
authorization_backend:
LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
type: ldap # NOT FREE FOR COMMERCIAL USE
config:
enable ldaps
enable_ssl: false
enable start tls, enable_ssl should be false
enable_start_tls: false
send client certificate
enable_ssl_client_auth: false
verify ldap hostname
verify_hostnames: true
hosts:
- localhost:8389
bind_dn: null
password: null
rolebase: ‘ou=groups,dc=example,dc=com’
Filter to search for roles (currently in the whole subtree beneath rolebase)
{0} is substituted with the DN of the user
{1} is substituted with the username
{2} is substituted with an attribute value from user’s directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
rolesearch: ‘(member={0})’
Specify the name of the attribute which value should be substituted with {2} above
userroleattribute: null
Roles as an attribute of the user entry
userrolename: disabled
#userrolename: memberOf
The attribute in a role entry containing the name of that role, Default is “name”.
Can also be “dn” to use the full DN as rolename.
rolename: cn
Resolve nested roles transitive (roles which are members of other roles and so on …)
resolve_nested_roles: true
userbase: ‘ou=people,dc=example,dc=com’
Filter to search for users (currently in the whole subtree beneath userbase)
{0} is substituted with the username
usersearch: ‘(uid={0})’
Skip users matching a user name, a wildcard or a regex pattern
#skip_users:
- ‘cn=Michael Jackson,ou*people,o=TEST’
- ‘/\S*/’
roles_from_another_ldap:
enabled: false
authorization_backend:
type: ldap # NOT FREE FOR COMMERCIAL USE
#config goes here …