I’m new to SG. We have our SG community edition working on development AWS environment without Proxy.
Now we are moving to Production with community edition (will have to upgrade to Enterprise edition once everything runs fine on Production if client is ok with SG).
My questions are:
I read the section on the SG document:
It seems, we need to add to add proxy detection in the xff section of sg_config.yml
We have existing proxy, it seems we can use proxy authentication with Kibana.
Do we have any examples on how to configure the proxy?
How about the roles/permissions for the users, do we have to add the users (in proxy) to SG and map roles to the users?
what is it exactly that your proxy is doing? Do you use it for authentication/authorization or just for load-balancing?
If you use it for authentication/authorization then yes, you need to configure XFF as described in the article. Regarding the question for an example - I don’t understand exactly what you mean here. The documentation has a complete example on how to set up Proxy auth for Kibana. What are you missing?
How about the roles/permissions for the users, do we have to add the users (in proxy) to SG and map roles to the users?
You do not need to set up users, SG will trust the user and role HTTP header implicitly (that is why you need to configure the list of trusted proxy IPs). You only need to map the users and / or roles to SG roles in sg_roles_mapping.yml.
Hope that helps!
···
On Tuesday, September 11, 2018 at 1:13:09 AM UTC+2, Li Cui wrote:
Hello there,
I’m new to SG. We have our SG community edition working on development AWS environment without Proxy.
Now we are moving to Production with community edition (will have to upgrade to Enterprise edition once everything runs fine on Production if client is ok with SG).
what is it exactly that your proxy is doing? Do you use it for authentication/authorization or just for load-balancing?
If you use it for authentication/authorization then yes, you need to configure XFF as described in the article. Regarding the question for an example - I don’t understand exactly what you mean here. The documentation has a complete example on how to set up Proxy auth for Kibana. What are you missing?
How about the roles/permissions for the users, do we have to add the users (in proxy) to SG and map roles to the users?
You do not need to set up users, SG will trust the user and role HTTP header implicitly (that is why you need to configure the list of trusted proxy IPs). You only need to map the users and / or roles to SG roles in sg_roles_mapping.yml.
Hope that helps!
On Tuesday, September 11, 2018 at 1:13:09 AM UTC+2, Li Cui wrote:
Hello there,
I’m new to SG. We have our SG community edition working on development AWS environment without Proxy.
Now we are moving to Production with community edition (will have to upgrade to Enterprise edition once everything runs fine on Production if client is ok with SG).