62 lines
2.3 KiB
Plaintext
62 lines
2.3 KiB
Plaintext
|
[role="xpack"]
|
||
|
|
[[kerberos-realm]]
|
||
|
|
=== Kerberos authentication
|
||
|
|
|
||
|
|
You can configure the {stack} {security-features} to support Kerberos V5
|
||
|
|
authentication, an industry standard protocol to authenticate users in {es}.
|
||
|
|
|
||
|
|
NOTE: You cannot use the Kerberos realm to authenticate on the transport network layer.
|
||
|
|
|
||
|
|
To authenticate users with Kerberos, you need to
|
||
|
|
{ref}/configuring-kerberos-realm.html[configure a Kerberos realm] and
|
||
|
|
<<mapping-roles, map users to roles>>.
|
||
|
|
For more information on realm settings, see
|
||
|
|
{ref}/security-settings.html#ref-kerberos-settings[Kerberos realm settings].
|
||
|
|
|
||
|
|
[[kerberos-terms]]
|
||
|
|
==== Key concepts
|
||
|
|
|
||
|
|
There are a few terms and concepts that you'll encounter when you're setting up
|
||
|
|
Kerberos realms:
|
||
|
|
|
||
|
|
_kdc_::
|
||
|
|
Key Distribution Center. A service that issues Kerberos tickets.
|
||
|
|
|
||
|
|
_principal_::
|
||
|
|
A Kerberos principal is a unique identity to which Kerberos can assign
|
||
|
|
tickets. It can be used to identify a user or a service provided by a
|
||
|
|
server.
|
||
|
|
+
|
||
|
|
--
|
||
|
|
Kerberos V5 principal names are of format `primary/instance@REALM`, where
|
||
|
|
`primary` is a user name.
|
||
|
|
|
||
|
|
`instance` is an optional string that qualifies the primary and is separated
|
||
|
|
by a slash(`/`) from the primary. For a user, usually it is not used; for
|
||
|
|
service hosts, it is the fully qualified domain name of the host.
|
||
|
|
|
||
|
|
`REALM` is the Kerberos realm. Usually it is is the domain name in upper case.
|
||
|
|
An example of a typical user principal is `user@ES.DOMAIN.LOCAL`. An example of
|
||
|
|
a typical service principal is `HTTP/es.domain.local@ES.DOMAIN.LOCAL`.
|
||
|
|
--
|
||
|
|
|
||
|
|
_realm_::
|
||
|
|
Realms define the administrative boundary within which the authentication server
|
||
|
|
has authority to authenticate users and services.
|
||
|
|
|
||
|
|
_keytab_::
|
||
|
|
A file that stores pairs of principals and encryption keys.
|
||
|
|
|
||
|
|
IMPORTANT: Anyone with read permissions to this file can use the
|
||
|
|
credentials in the network to access other services so it is important
|
||
|
|
to protect it with proper file permissions.
|
||
|
|
|
||
|
|
_krb5.conf_::
|
||
|
|
A file that contains Kerberos configuration information such as the default realm
|
||
|
|
name, the location of Key distribution centers (KDC), realms information,
|
||
|
|
mappings from domain names to Kerberos realms, and default configurations for
|
||
|
|
realm session key encryption types.
|
||
|
|
|
||
|
|
_ticket granting ticket (TGT)_::
|
||
|
|
A TGT is an authentication ticket generated by the Kerberos authentication
|
||
|
|
server. It contains an encrypted authenticator.
|