Elasticsearch:Configure Active Directory authentication

Prerequisites

You have completed the following operations:

• You have created an Alibaba Cloud Elasticsearch instance. This topic uses a version 7.10 instance as an example.

  For more information, see Create an Alibaba Cloud Elasticsearch instance.

• You have prepared an AD domain environment and data in the same VPC as your Alibaba Cloud Elasticsearch instance. This topic uses Windows Server 2012 as an example.

  This topic uses the username ccy1 and the root domain ccy.com. For example, in the AD domain ccy.com, create the user ccy1@ccy.com (the logon name for pre-Windows 2000 versions is CCY\ccy1). On the Account tab of the user properties, select Password never expires and set Account expires to Never.

Limitations

Procedure

1. Step 1: Obtain endpoint domain name (optional)

2. Step 2: Configure AD authentication

3. Step 3: Map roles to domain accounts

4. Step 4: Verify the result

Step 1: Obtain endpoint domain name (optional)

Elasticsearch clusters created in October 2020 or later are deployed in the new network architecture. These Elasticsearch clusters reside in the VPC of the Elasticsearch service account. If your Elasticsearch cluster is deployed in the new network architecture, you need to use the PrivateLink service to establish a private connection between the VPC and your VPC. Then, obtain the domain name of the related endpoint for future use. To obtain the domain name of an endpoint, perform the following steps:

1. Create a Classic Load Balancer (CLB) instance that supports the PrivateLink service and resides in the same VPC as the created Elasticsearch cluster.

   For more information, see Configure a PrivateLink connection.

2. Configure the CLB instance.

   Specify the server that hosts LDAP as the backend server and set the listener port to 389.

   For more information, see Configure a PrivateLink connection.

3. Create an endpoint service.

   For more information, see Configure a PrivateLink connection.

4. Configure a private connection to the Elasticsearch cluster.

   For more information, see Configure a PrivateLink connection.

5. Obtain the domain name of the endpoint that is used to access the endpoint service.

   For more information, see Configure a PrivateLink connection.

   Note Record the obtained domain name, which will be used in subsequent configurations.

Step 2: Configure AD authentication

You can use Elasticsearch security features to communicate with an AD domain for user authentication. The security features communicate with the AD domain by using LDAP. Therefore, the active_directory realm is similar to the ldap realm. Like an LDAP directory, an AD domain stores users and groups hierarchically. The AD domain verifies a user's identity by sending an LDAP bind request. After verification, the AD domain searches for the user's entry in Active Directory. Once the user is found, the AD domain retrieves the user's group membership from the tokenGroups attribute of the user's entry in Active Directory. For more information, see Configuring an Active Directory realm.

xpack.security.authc.realms.active_directory.my_ad.order: 2
xpack.security.authc.realms.active_directory.my_ad.domain_name: ccy.com
xpack.security.authc.realms.active_directory.my_ad.url: ldap://ep-bp1i321219*******-cn-hangzhou-h.epsrv-bp15571d5ps*******.cn-hangzhou.privatelink.aliyuncs.com:389
xpack.security.authc.realms.active_directory.my_ad.bind_dn: cc**@ccy.com
xpack.security.authc.realms.active_directory.my_ad.bind_password: your_password

Step 3: Map roles to domain accounts

1. Log on to your instance's Kibana console.

   For more information, see Log on to the Kibana console.

   Note

   The user interface may differ depending on your Kibana version.

2. On the Kibana homepage, click Developer Tools.

3. On the Console tab, run the following command to set the ccy1 user in the AD domain as an administrator.

   PUT /_security/role_mapping/basic_users
   {
     "roles": [ "superuser" ],
     "enabled": true,
     "rules": {
       "any": [
         {
           "field": {
             "groups": "cn=ali,dc=ccy,dc=com"
           }
         },
         {
           "field": {
             "dn": "cn=ccy1,cn=ali,dc=ccy,dc=com"
           }
         }
       ]
     }
   }

Step 4: Verify the result

1. Log in to Kibana for the target Elasticsearch as the authorized ccy1 user.

2. On the Kibana homepage, click Developer Tools.

3. On the Console tab, run the following command to verify whether the ccy1 user has permission to perform the corresponding action.

   GET _cat/indices

   If the ccy1 user has permissions, the following result is returned, which indicates that the permissions for the ccy1 user in the AD domain are configured successfully.

    1  green open .apm-agent-configuration        4zvRAxNyTv6_xxx  1 1      0      0   522b    261b
    2  green open .monitoring-kibana-7-2021.12.08  Kr9Om1WUQW67xxx  1 1   3732      0  1.9mb   1.1mb
    3  green open product_info                     WPZ11CtfRL-hxxx  5 1      8      0 49.2kb  24.6kb
    4  green open .kibana_1                        ffs3ho7cTte0xxx  1 1     31      0 41.5mb  20.7mb
    5  green open .monitoring-es-7-2021.12.08      1efDbJNWT8uRxxx  1 1  44838  74520 63.1mb  31.6mb
    6  green open .security-7                      Gu8XhA-yQ46mxxx  1 1     58      9 302.1kb   151kb
    7  green open .monitoring-es-7-2021.12.06      PCVdQeP-R2SKxxx  1 1 111372 123120 140.5mb  70.2mb
    8  green open .monitoring-es-7-2021.12.07      udTlD2Q_S1ylxxx  1 1 186883 157638 229.1mb 114.3mb
    9  green open .apm-custom-link                 JVXx0qioQ9uMxxx  1 1      0      0   522b    261b
   10  green open .kibana_task_manager_1            nDKy8KLASsevxxx  1 1      6   3036  720kb   357kb
   11  green open .monitoring-kibana-7-2021.12.06  g0mwhwFaTduGxxx  1 1  12312      0  3.8mb   1.8mb
   12  green open .monitoring-kibana-7-2021.12.07  xfW97NKTT_a6xxx  1 1  17248      0  5.8mb   2.9mb
   13  green open .kibana-event-log-7.10.0-000001  rOefxK00Qtqrxxx  1 1      3      0 33.2kb  16.6kb
   14  green open product_info1                    VUF0kfAfSrG9xxx  1 1      8      0 11.9kb   5.9kb