Elasticsearch:Integrate X-Pack with LDAP authentication

Prerequisites

Usage notes

Procedure

1. Step 1: Obtain an endpoint domain name (optional)

2. Step 2: Configure LDAP authentication

3. Step 3: Map LDAP user accounts to roles

4. Step 4: Verify the results

Step 1: Obtain an endpoint domain name (optional)

Elasticsearch clusters created in October 2020 or later are deployed in the new network architecture. These Elasticsearch clusters reside in the VPC of the Elasticsearch service account. If your Elasticsearch cluster is deployed in the new network architecture, you need to use the PrivateLink service to establish a private connection between the VPC and your VPC. Then, obtain the domain name of the related endpoint for future use. To obtain the domain name of an endpoint, perform the following steps:

1. Create a Classic Load Balancer (CLB) instance that supports the PrivateLink service and resides in the same VPC as the created Elasticsearch cluster.

   For more information, see Configure a PrivateLink connection.

2. Configure the load balancer instance.

   When configuring the instance, set the server that hosts your LDAP service as a backend server and the listener port to 389.

   For more information, see Configure a PrivateLink connection.

3. Create an endpoint service.

   For more information, see Configure a PrivateLink connection.

4. Configure a private connection to the Elasticsearch cluster.

   For more information, see Configure a PrivateLink connection.

5. Obtain the domain name of the endpoint that is used to access the endpoint service.

   For more information, see Configure a PrivateLink connection.

   Note Record the obtained domain name, which will be used in subsequent configurations.

Step 2: Configure LDAP authentication

The user search mode is the most common method. In this mode, a privileged user searches the LDAP directory for the distinguished name (DN) of the user being authenticated. The search uses the username received by X-Pack and an LDAP attribute filter. After finding the DN, X-Pack binds to the directory with the DN and password to authenticate the user. For more information, see Configure an LDAP realm.

For more information about the parameters, see Security settings in Elasticsearch.

Step 3: Map LDAP user accounts to roles

1. Log on to the Kibana console of your Elasticsearch cluster.

   For instructions, see Log on to the Kibana console.

   Note

   Examples here use Elasticsearch V6.7.0. Operations may vary slightly for other versions.

2. In the left-side navigation pane, click Developer Tools.

3. In the Console, run the following command to map LDAP users matching zhang* to the superuser role.

   Version 8.x

   POST _security/role_mapping/ldap_super_user1?pretty
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "username": "zhang*"
           }
         }
       ]
     }
   }

   Other versions

   POST _xpack/security/role_mapping/ldap_super_user1?pretty
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "username": "zhang*"
           }
         }
       ]
     }
   }

   For more information, see the documentation for your Elasticsearch version.

Step 4: Verify the results

1. Log on to the Kibana console of your Alibaba Cloud Elasticsearch instance as an authorized zhang* user.

2. In the left-side navigation pane, click Developer Tools.

3. In the Console, run the following command to verify that the zhang* user has the permissions to modify cluster settings.

   PUT _cluster/settings
   {
     "persistent": {
       "action.auto_create_index": true
     }
   }

   A successful command returns the following response:

   {
     "acknowledged" : true,
     "persistent" : {
       "action" : {
         "auto_create_index" : "true"
       }
     },
     "transient" : { }
   }