Elasticsearch:Configure Active Directory identity authentication

Step 1: Establish private connectivity (new architecture only)

Elasticsearch clusters created in October 2020 or later are deployed in the new network architecture. These Elasticsearch clusters reside in the VPC of the Elasticsearch service account. If your Elasticsearch cluster is deployed in the new network architecture, you need to use the PrivateLink service to establish a private connection between the VPC and your VPC. Then, obtain the domain name of the related endpoint for future use. To obtain the domain name of an endpoint, perform the following steps:

1. Create a Classic Load Balancer (CLB) instance that supports the PrivateLink service and resides in the same VPC as the created Elasticsearch cluster.

   For more information, see Step 1: Create and configure an CLB instance.

2. Configure the CLB instance.

   Specify the server that hosts the Lightweight Directory Access Protocol (LDAP) service as the backend server and set the listening port to 389.

   For more information, see Create private connections with PrivateLink and SLB.

3. Create an endpoint service.

   For more information, see Step 2: Create an endpoint service.

4. Configure a private connection to the Elasticsearch cluster.

   For more information, see Step 3: Configure a private connection for the Alibaba Cloud Elasticsearch cluster.

5. Obtain the domain name of the endpoint that is used to access the endpoint service.

   For more information, see Create private connections with PrivateLink and SLB.

   Note Record the obtained domain name, which will be used in subsequent configurations.

Step 2: Configure AD authentication

Modify the Elasticsearch YML configuration to define the AD "realm." See Active Directory user authentication in Elasticsearch documentation for details.

1. Log on to the Alibaba Cloud Elasticsearch console.

2. Navigate to Cluster Configuration > Modify Configuration.

3. Add the following snippet (adjust values to match your environment):

xpack.security.authc.realms.active_directory.my_ad.order: 2
xpack.security.authc.realms.active_directory.my_ad.domain_name: ccy.com
xpack.security.authc.realms.active_directory.my_ad.url: ldap://ep-bp1i321219*********-cn-hangzhou-h.epsrv-bp15571d5ps*********.cn-hangzhou.privatelink.aliyuncs.com:389
xpack.security.authc.realms.active_directory.my_ad.bind_dn: cc**@ccy.com
xpack.security.authc.realms.active_directory.my_ad.bind_password: your_password

Step 3: Map AD domain users to Elasticsearch roles

1. Log on to the Kibana console of your Elasticsearch cluster.

2. Go to Dev Tools > Console.

3. Run the following command to map the AD user ccy1 to the superuser role:

   PUT /_security/role_mapping/basic_users
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "groups": "cn=ali,dc=ccy,dc=com"
           }
         },
         {
           "field": {
             "dn": "cn=ccy1,cn=ali,dc=ccy,dc=com"
           }
         }
       ]
     }
   }

Step 4: Verify the results

1. Log on to the Kibana console of your Elasticsearch cluster as the authorized ccy1 user.

2. On the Kibana homepage, go to Dev Tools> Console and run:

3. GET _cat/indices

   If you receive a list of indices, the AD authentication and role mapping are working correctly.