ES version : 5.6.3
Search guard version: search-guard-5-5.6.3-18
My application uses transport client java api to search es . According this url: Security for Elasticsearch | Using Transport Clients | Search Guard , It works fine .
However, According the article of “the Transport client authentication and authorization(Security for Elasticsearch and Kibana | Transport client authentication and authorization )”, ES only read the user client which is assigned in client certificate, can not read the authorization header’s user and pwd.
my code demo:
try {
String cur_path=System.getProperty("user.dir");
System.out.print(cur_path);
Settings.Builder settingsBuilder =
Settings.builder()
.put("searchguard.ssl.transport.enabled", true)
.put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_FILEPATH,cur_path+“\src\test\java\es_login\es_login\hkz123-keystore.jks”)
.put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_FILEPATH, cur_path+"\\src\\test\\java\\es_login\\es_login\\truststore.jks")
//.put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_KEYSTORE_PASSWORD, "changeit")
//.put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, "changeit")
.put("searchguard.ssl.transport.enforce_hostname_verification",false)
.put("client.transport.sniff", true)
.put("cluster.name", "elasticsearch")
.put("searchguard.ssl.transport.resolve_hostname", false)
.put("path.home",".");
Settings settings = settingsBuilder.build();
TransportClient client = new PreBuiltTransportClient(settings,SearchGuardPlugin.class)
.addTransportAddress(new InetSocketTransportAddress(InetAddress.getByName("192.168.2.102"), 9300));
System.out.println("Basic "+encodeBasicHeader("tca", "tca"));
client.threadPool().getThreadContext().putHeader("Authorization", "Basic "+encodeBasicHeader("tca", "tca"));
SearchResponse response = client.prepareSearch("get-together")
.setQuery(boolQuery()
.must(matchQuery("tags.keyword","elasticsearch"))
).setFrom(0).setSize(60).execute().actionGet()
;
SearchHits hits = response.getHits();
for (int i = 0; i < 2; i++) {
System.out.println(hits.getAt(i).getSource().get("organizer"));
}
} catch (UnknownHostException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
ES log:
[2018-02-06T11:44:27,351][INFO ][c.f.s.c.PrivilegesEvaluator] No cluster-level perm match for User [name=CN=hkz123,OU=client,O=client,L=Test,C=DE, roles=] [IndexType [index=index, type=], IndexType [index=get-together, type=], IndexType [index=horse, type=], IndexType [index=test-index, type=], IndexType [index=myindex, type=], IndexType [index=dangerdata, type=], IndexType [index=new-index, type=], IndexType [index=searchguard, type=], IndexType [index=.kibana, type=*]] [Action [[cluster:monitor/state]]] [RolesChecked [sg_own_index, sg_public]]
[2018-02-06T11:44:27,351][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {}
According the log, Search guard use hkz123 which is client certificate access es, not the tca:tca, Why?
elasticsearch.yml:
######## Start Search Guard Demo Configuration ########
#searchguard.disabled: true
searchguard.ssl.transport.keystore_filepath: node-1-keystore.jks
searchguard.ssl.transport.truststore_filepath: truststore_1.jks
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.keystore_filepath: node-1-keystore.jks
searchguard.ssl.http.truststore_filepath: truststore_1.jks
searchguard.ssl.http.clientauth_mode: NONE
searchguard.authcz.admin_dn:
- CN=hkz,OU=client,O=client,L=test, C=de
#searchguard.authcz.impersonation_dn:
“CN=hkz123,OU=client,O=client,L=Test,C=DE”:
- ‘*’
node.max_local_storage_nodes: 3
######## End Search Guard Demo Configuration ########
sg_internal_users.yml:
tca:
hash: $2a$12$G1./WsW7s0dPoJZCH9Bxqe08CgOHtrdZej7yN6iv02bTIRf5UITYG
#password is: admin
CN=hkz123,OU=client,O=client,L=Test,C=DE:
hash: “_transport_only”
sg_roles_mapping.yml:
sg_readall:
users:
-
readall
-
tca