Hello,
I’m trying to figure out how I can have a generic read only user pass through for kibana. I’ve added the following that I got from the latest commits for SG-2-2.3.2.0-beta2
sg_roles.yml:
sg_users:
indices:
‘*’:
‘*’:
sg_roles_mapping.yml
sg_public:
users:
I even tried ensuring the sg_* name was the same in both files, but I keep getting blocked when I try to log in to kibana with an undefined user. Along with trying to simply curl the ES cluster. Not sure if i’m doing this wrong, but i’m stuck and any help would be appreciated.
Ahh nevermind. See I have to edit the sg_config and enable the domain_proxy section. Though, kibana keeps making me do basic auth after I’ve logged in using google sso. Even though I can just pass it a random user/pass combo.
can you share you configs?
···
Am 17.05.2016 um 00:08 schrieb djtecha <djtecha@gmail.com>:
Ahh nevermind. See I have to edit the sg_config and enable the domain_proxy section. Though, kibana keeps making me do basic auth after I've logged in using google sso. Even though I can just pass it a random user/pass combo.
--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com\.
For more options, visit https://groups.google.com/d/optout\.
sg_config:
searchguard:
dynamic:
http:
xff:
enabled: false
internalProxies: 192.168.0.10|192.168.0.11
remoteIpHeader: “x-forwarded-for”
proxiesHeader: “x-forwarded-by”
trustedProxies: “proxy1|proxy2”
authenticator:
type: com.floragunn.searchguard.http.HTTPBasicAuthenticator
authcz:
authentication_domain_basic_internal:
enabled: true
order: 0
authentication_backend:
type: com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend
authorization_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend
#authentication_ldap:
#enabled: true
#order: 1
#authentication_backend:
#type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthenticationBackend
#config:
#host: [“”,“”]
#authorization_backend:
#type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend
authentication_domain_proxy:
enabled: true
order: 1
authentication_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend
authorization_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend
sg_roles.yml
sg_public:
cluster:
indices:
‘*’:
‘*’:
sg_roles_mapping.yml
sg_public**:**
users:
That should let any user see all indices regardless of if they have a login.
···
On Tuesday, May 17, 2016 at 6:12:39 AM UTC-7, SG wrote:
can you share you configs?
Am 17.05.2016 um 00:08 schrieb djtecha djt...@gmail.com:
Ahh nevermind. See I have to edit the sg_config and enable the domain_proxy section. Though, kibana keeps making me do basic auth after I’ve logged in using google sso. Even though I can just pass it a random user/pass combo.
–
You received this message because you are subscribed to the Google Groups “Search Guard” group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
To post to this group, send email to search...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
i suggest
searchguard:
dynamic:
http:
anonymous_auth_enabled: true
xff:
enabled: false
internalProxies: 192\.168\.0\.10|192\.168\.0\.11
remoteIpHeader: "x-forwarded-for"
proxiesHeader: "x-forwarded-by"
trustedProxies: "proxy1|proxy2"
authenticator:
type: basic
authcz:
authentication_domain_proxy:
enabled: true
order: 1
authentication_backend:
type: intern
authorization_backend:
type: noop
···
Am 18.05.2016 um 18:40 schrieb djtecha <djtecha@gmail.com>:
sg_config:
searchguard:
dynamic:
http:
xff:
enabled: false
internalProxies: 192\.168\.0\.10|192\.168\.0\.11
remoteIpHeader: "x-forwarded-for"
proxiesHeader: "x-forwarded-by"
trustedProxies: "proxy1|proxy2"
authenticator:
type: com.floragunn.searchguard.http.HTTPBasicAuthenticator
authcz:
authentication_domain_basic_internal:
enabled: true
order: 0
authentication_backend:
type: com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend
authorization_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend
#authentication_ldap:
#enabled: true
#order: 1
#authentication_backend:
#type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthenticationBackend
#config:
#host: ["",""]
#authorization_backend:
#type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend
authentication_domain_proxy:
enabled: true
order: 1
authentication_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend
authorization_backend:
type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend
sg_roles.yml
sg_public:
cluster:
- CLUSTER_ALL
indices:
'*':
'*':
- ALL
sg_roles_mapping.yml
sg_public:
users:
- '*'
That should let any user see all indices regardless of if they have a login.
On Tuesday, May 17, 2016 at 6:12:39 AM UTC-7, SG wrote:
can you share you configs?
> Am 17.05.2016 um 00:08 schrieb djtecha <djt...@gmail.com>:
>
> Ahh nevermind. See I have to edit the sg_config and enable the domain_proxy section. Though, kibana keeps making me do basic auth after I've logged in using google sso. Even though I can just pass it a random user/pass combo.
>
> --
> You received this message because you are subscribed to the Google Groups "Search Guard" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
> To post to this group, send email to search...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com\.
> For more options, visit https://groups.google.com/d/optout\.
--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/64ad6081-106e-44c8-b4fc-1969b3f4c61c%40googlegroups.com\.
For more options, visit https://groups.google.com/d/optout\.