Search guard flx and kibana proxy authentication

Search Guard
1

I’m migrating from SG 53.0.0 on 7.17.10. I’m trying to run sgctl migrate-config, but I’m getting:

Errors in /tmp/kibana.yml
searchguard.auth.type:
	The Kibana authentication type PROXY is not supported

The current kibana.yml configuration is:

searchguard:
    cookie:
        secure: true
    auth:
        type: "proxy"
        debug: false
    proxycache:
      user_header: "CAS_sAMAccountName"
      roles_header: "CAS_memberOf"
      proxy_header_ip: "127.0.0.1"
    accountinfo:
        enabled: true

What am I doing wrong ? It’s the actual running setup, and SG FLX is said to keep support of proxy authentication.

2

What are your new versions of ElasticSearch and SearchGuard? Also, what version of sgctl.sh do you use?

3

Elastic 7.17.12 and SG 1.2.0, same for sgctl.

4

Could you share kibana.yml file? Have you tried to manually add searchguard.auth.type: "proxy" to the kibana.yml ?

5

Yes the current configuration is:

searchguard:
    cookie:
        secure: true
    auth:
        type: "proxy"
        debug: false
    accountinfo:
        enabled: true

with SG 1.3, so it’s not an illegal settings. I think the problem is in the proxycache entries which are indeed deprecated. But the error message is missleading.

6

Any one at search guard that have any hint about that ?

7

The issue was created for the development team. You can find it at the link below:

You can use basicauth authentication in kibana.yml instead for the migration process and then switch manually to proxy once migrated. The proxy authentication type is supported as per the SG FLX documentation below:

8

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.

9

What might be a bit confusing here is that the authentication type proxy is only not supported by the sgctl migrate command - as it is a rare thing. Search Guard FLX itself supports proxy authentication.

See the documentation here:

How the configuration should look like would also depend on the previous proxy configuration in sg_config.yml. However, it will likely look similar to this:

sg_authc.yml:

auth_domains:
- type: trusted_origin
  user_mapping.user_name.from: request.headers.CAS_sAMAccountName
  user_mapping.roles.from_comma_separated_string: request.headers.CAS_memberOf
  
network:
  trusted_proxies: 'x.x.x.x/x' # Edit to set the IP of the trusted proxy and of Kibana (which also acts like a trusted proxy)

kibana.yml:

searchguard.auth.type: "proxy"
elasticsearch.requestHeadersWhitelist: [ "Authorization", "sgtenant", "CAS_sAMAccountName", "CAS_memberOf" ]