mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-30 03:48:54 +00:00
[DOCS] Merges duplicate pages for Active Directory realms (#49205)
This commit is contained in:
parent
eed4cd25eb
commit
75f1f612c2
docs/reference
x-pack/docs/en/security
@ -996,3 +996,17 @@ See <<pki-realm>>.
|
|||||||
|
|
||||||
See <<ref-pki-settings>>.
|
See <<ref-pki-settings>>.
|
||||||
|
|
||||||
|
[role="exclude",id="configuring-ad-realm"]
|
||||||
|
=== Configuring an Active Directory realm
|
||||||
|
|
||||||
|
See <<ad-realm-configuration>>.
|
||||||
|
|
||||||
|
[role="exclude",id="ad-settings"]
|
||||||
|
=== Active Directory realm settings
|
||||||
|
|
||||||
|
See <<ref-ad-settings>>.
|
||||||
|
|
||||||
|
[role="exclude",id="mapping-roles-ad"]
|
||||||
|
=== Mapping Active Directory users and groups to roles
|
||||||
|
|
||||||
|
See <<ad-realm-configuration>>.
|
||||||
|
@ -3,11 +3,7 @@
|
|||||||
=== Active Directory user authentication
|
=== Active Directory user authentication
|
||||||
|
|
||||||
You can configure {stack} {security-features} to communicate with Active
|
You can configure {stack} {security-features} to communicate with Active
|
||||||
Directory to authenticate users. To integrate with Active Directory, you
|
Directory to authenticate users. See <<ad-realm-configuration>>.
|
||||||
configure an `active_directory` realm and map Active Directory users and groups
|
|
||||||
to roles in the <<mapping-roles, role mapping file>>.
|
|
||||||
|
|
||||||
See {ref}/configuring-ad-realm.html[Configuring an active directory realm].
|
|
||||||
|
|
||||||
The {security-features} use LDAP to communicate with Active Directory, so
|
The {security-features} use LDAP to communicate with Active Directory, so
|
||||||
`active_directory` realms are similar to <<ldap-realm, `ldap` realms>>. Like
|
`active_directory` realms are similar to <<ldap-realm, `ldap` realms>>. Like
|
||||||
@ -33,25 +29,10 @@ Active Directory. Once the user has been found, the Active Directory realm then
|
|||||||
retrieves the user's group memberships from the `tokenGroups` attribute on the
|
retrieves the user's group memberships from the `tokenGroups` attribute on the
|
||||||
user's entry in Active Directory.
|
user's entry in Active Directory.
|
||||||
|
|
||||||
[[ad-load-balancing]]
|
[[ad-realm-configuration]]
|
||||||
==== Load balancing and failover
|
==== Configuring an Active Directory realm
|
||||||
The `load_balance.type` setting can be used at the realm level to configure how
|
|
||||||
the {security-features} should interact with multiple Active Directory servers.
|
|
||||||
Two modes of operation are supported: failover and load balancing.
|
|
||||||
|
|
||||||
See
|
include::configuring-active-directory-realm.asciidoc[]
|
||||||
{ref}/security-settings.html#load-balancing[Load balancing and failover settings].
|
|
||||||
|
|
||||||
[[ad-settings]]
|
|
||||||
==== Active Directory realm settings
|
|
||||||
|
|
||||||
See
|
|
||||||
{ref}/security-settings.html#ref-ad-settings[Active Directory realm settings].
|
|
||||||
|
|
||||||
[[mapping-roles-ad]]
|
|
||||||
==== Mapping Active Directory users and groups to roles
|
|
||||||
|
|
||||||
See {ref}/configuring-ad-realm.html[Configuring an Active Directory realm].
|
|
||||||
|
|
||||||
[[ad-user-metadata]]
|
[[ad-user-metadata]]
|
||||||
==== User metadata in Active Directory realms
|
==== User metadata in Active Directory realms
|
||||||
@ -73,8 +54,16 @@ This metadata is returned in the
|
|||||||
Additional metadata can be extracted from the Active Directory server by configuring
|
Additional metadata can be extracted from the Active Directory server by configuring
|
||||||
the `metadata` setting on the Active Directory realm.
|
the `metadata` setting on the Active Directory realm.
|
||||||
|
|
||||||
|
[[ad-load-balancing]]
|
||||||
|
==== Load balancing and failover
|
||||||
|
The `load_balance.type` setting can be used at the realm level to configure how
|
||||||
|
the {security-features} should interact with multiple Active Directory servers.
|
||||||
|
Two modes of operation are supported: failover and load balancing.
|
||||||
|
|
||||||
|
See
|
||||||
|
<<load-balancing>>.
|
||||||
|
|
||||||
[[active-directory-ssl]]
|
[[active-directory-ssl]]
|
||||||
==== Setting up SSL between Elasticsearch and Active Directory
|
==== Setting up SSL between Elasticsearch and Active Directory
|
||||||
|
|
||||||
See
|
See <<tls-active-directory>>.
|
||||||
{ref}/configuring-tls.html#tls-active-directory[Encrypting communications between {es} and Active Directory].
|
|
||||||
|
@ -1,14 +1,6 @@
|
|||||||
[role="xpack"]
|
To integrate with Active Directory, you configure an `active_directory`
|
||||||
[[configuring-ad-realm]]
|
|
||||||
=== Configuring an Active Directory realm
|
|
||||||
|
|
||||||
You can configure {es} to communicate with Active Directory to authenticate
|
|
||||||
users. To integrate with Active Directory, you configure an `active_directory`
|
|
||||||
realm and map Active Directory users and groups to roles in the role mapping file.
|
realm and map Active Directory users and groups to roles in the role mapping file.
|
||||||
|
|
||||||
For more information about Active Directory realms, see
|
|
||||||
<<active-directory-realm>>.
|
|
||||||
|
|
||||||
. Add a realm configuration of type `active_directory` to `elasticsearch.yml`
|
. Add a realm configuration of type `active_directory` to `elasticsearch.yml`
|
||||||
under the `xpack.security.authc.realms.active_directory` namespace.
|
under the `xpack.security.authc.realms.active_directory` namespace.
|
||||||
At a minimum, you must specify the Active Directory `domain_name`.
|
At a minimum, you must specify the Active Directory `domain_name`.
|
||||||
|
@ -12,7 +12,7 @@ To "run as" (impersonate) another user, you must be able to retrieve the user fr
|
|||||||
the realm you use to authenticate. Both the internal `native` and `file` realms
|
the realm you use to authenticate. Both the internal `native` and `file` realms
|
||||||
support this out of the box. The LDAP realm must be configured to run in
|
support this out of the box. The LDAP realm must be configured to run in
|
||||||
<<ldap-realm-configuration,_user search_ mode>>. The Active Directory realm must be
|
<<ldap-realm-configuration,_user search_ mode>>. The Active Directory realm must be
|
||||||
<<ad-settings,configured with a `bind_dn` and `secure_bind_password`>> to support
|
<<ref-ad-settings,configured with a `bind_dn` and `secure_bind_password`>> to support
|
||||||
_run as_. The PKI, Kerberos, and SAML realms do not support _run as_.
|
_run as_. The PKI, Kerberos, and SAML realms do not support _run as_.
|
||||||
|
|
||||||
To submit requests on behalf of other users, you need to have the `run_as`
|
To submit requests on behalf of other users, you need to have the `run_as`
|
||||||
|
@ -72,7 +72,7 @@ TIP: The types of authentication realms that you can enable varies according to
|
|||||||
your subscription. For more information, see https://www.elastic.co/subscriptions.
|
your subscription. For more information, see https://www.elastic.co/subscriptions.
|
||||||
|
|
||||||
--
|
--
|
||||||
** <<configuring-ad-realm,Active Directory realms>>
|
** <<active-directory-realm,Active Directory realms>>
|
||||||
** <<file-realm,File realms>>
|
** <<file-realm,File realms>>
|
||||||
** <<kerberos-realm,Kerberos realms>>
|
** <<kerberos-realm,Kerberos realms>>
|
||||||
** <<ldap-realm,LDAP realms>>
|
** <<ldap-realm,LDAP realms>>
|
||||||
@ -138,8 +138,6 @@ Events are logged to a dedicated `<clustername>_audit.json` file in
|
|||||||
To walk through the configuration of {security-features} in {es}, {kib}, {ls}, and {metricbeat}, see <<security-getting-started>>.
|
To walk through the configuration of {security-features} in {es}, {kib}, {ls}, and {metricbeat}, see <<security-getting-started>>.
|
||||||
|
|
||||||
include::securing-communications/separating-node-client-traffic.asciidoc[]
|
include::securing-communications/separating-node-client-traffic.asciidoc[]
|
||||||
include::authentication/configuring-active-directory-realm.asciidoc[]
|
|
||||||
|
|
||||||
include::reference/files.asciidoc[]
|
include::reference/files.asciidoc[]
|
||||||
include::fips-140-compliance.asciidoc[]
|
include::fips-140-compliance.asciidoc[]
|
||||||
|
|
||||||
|
@ -13,7 +13,7 @@ to have the Active Directory server's certificate or the server's root CA
|
|||||||
certificate installed in their keystore or truststore.
|
certificate installed in their keystore or truststore.
|
||||||
|
|
||||||
. Create the realm configuration for the `xpack.security.authc.realms` namespace
|
. Create the realm configuration for the `xpack.security.authc.realms` namespace
|
||||||
in the `elasticsearch.yml` file. See <<configuring-ad-realm>>.
|
in the `elasticsearch.yml` file. See <<ad-realm-configuration>>.
|
||||||
|
|
||||||
. Set the `url` attribute in the realm configuration to specify the LDAPS protocol
|
. Set the `url` attribute in the realm configuration to specify the LDAPS protocol
|
||||||
and the secure port number. For example, `url: ldaps://ad.example.com:636`.
|
and the secure port number. For example, `url: ldaps://ad.example.com:636`.
|
||||||
|
Loading…
x
Reference in New Issue
Block a user