62 lines
3.0 KiB
Plaintext
62 lines
3.0 KiB
Plaintext
|
[[controlling-user-cache]]
|
||
|
|
=== Controlling the User Cache
|
||
|
|
|
||
|
|
User credentials are cached in memory on each node to avoid connecting to a remote authentication
|
||
|
|
server or hitting the disk for every incoming request. You can configure characteristics of the
|
||
|
|
user cache with the `cache.ttl`, `cache.max_users`, and ``cache.hash_algo` realm settings.
|
||
|
|
|
||
|
|
NOTE: PKI realms do not use the user cache.
|
||
|
|
|
||
|
|
The cached user credentials are hashed in memory. By default, Shield uses a salted `sha-256`
|
||
|
|
hash algorigthm. You can use a different algorithm by setting the `cache-hash_algo` setting
|
||
|
|
to any of the supported <<cache-hash-algo, Cache hash algorithms>>.
|
||
|
|
|
||
|
|
[[cache-hash-algo]]
|
||
|
|
.Cache hash algorithms
|
||
|
|
|=======================
|
||
|
|
| Algorithm | Description
|
||
|
|
| `ssha256` | Uses a salted `sha-256` algorithm (default).
|
||
|
|
| `md5` | Uses `MD5` algorithm.
|
||
|
|
| `sha1` | Uses `SHA1` algorithm.
|
||
|
|
| `bcrypt` | Uses `bcrypt` algorithm with salt generated in 10 rounds.
|
||
|
|
| `bcrypt4` | Uses `bcrypt` algorithm with salt generated in 4 rounds.
|
||
|
|
| `bcrypt5` | Uses `bcrypt` algorithm with salt generated in 5 rounds.
|
||
|
|
| `bcrypt6` | Uses `bcrypt` algorithm with salt generated in 6 rounds.
|
||
|
|
| `bcrypt7` | Uses `bcrypt` algorithm with salt generated in 7 rounds.
|
||
|
|
| `bcrypt8` | Uses `bcrypt` algorithm with salt generated in 8 rounds.
|
||
|
|
| `bcrypt9` | Uses `bcrypt` algorithm with salt generated in 9 rounds.
|
||
|
|
| `sha2` | Uses `SHA2` algorithm.
|
||
|
|
| `apr1` | Uses `apr1` algorithm (md5 crypt).
|
||
|
|
| `noop`,`clear_text` | Doesn't hash the credentials and keeps it in clear text in
|
||
|
|
memory. CAUTION: keeping clear text is considered insecure
|
||
|
|
and can be compromised at the OS level (for example through
|
||
|
|
memory dumps and using `ptrace`).
|
||
|
|
|=======================
|
||
|
|
|
||
|
|
[float]
|
||
|
|
==== Evicting Users from the Cache
|
||
|
|
|
||
|
|
Shield exposes an API to force the eviction of cached users. For example, the following request
|
||
|
|
evicts all users from the `ad1` realm:
|
||
|
|
|
||
|
|
[source, java]
|
||
|
|
------------------------------------------------------------
|
||
|
|
$ curl -XPOST 'http://localhost:9200/_shield/realm/ad1/_cache/clear'
|
||
|
|
------------------------------------------------------------
|
||
|
|
|
||
|
|
To clear the cache for multiple realms, specify the realms as a comma-separated list:
|
||
|
|
|
||
|
|
[source, java]
|
||
|
|
------------------------------------------------------------
|
||
|
|
$ curl -XPOST 'http://localhost:9200/_shield/realm/ad1,ad2/_cache/clear'
|
||
|
|
------------------------------------------------------------
|
||
|
|
|
||
|
|
You can also evict specific users:
|
||
|
|
|
||
|
|
[source, java]
|
||
|
|
------------------------------------------------------------
|
||
|
|
$ curl -XPOST 'http://localhost:9200/_shield/realm/ad1/_cache/clear?usernames=rdeniro,alpacino'
|
||
|
|
------------------------------------------------------------
|
||
|
|
|
||
|
|
|