[DOCS] Merges duplicate pages for Active Directory realms ()

This commit is contained in:
Lisa Cawley 2019-11-19 13:05:11 -08:00 committed by lcawl
parent eed4cd25eb
commit 75f1f612c2
6 changed files with 32 additions and 39 deletions

@ -996,3 +996,17 @@ See <<pki-realm>>.
See <<ref-pki-settings>>. See <<ref-pki-settings>>.
[role="exclude",id="configuring-ad-realm"]
=== Configuring an Active Directory realm
See <<ad-realm-configuration>>.
[role="exclude",id="ad-settings"]
=== Active Directory realm settings
See <<ref-ad-settings>>.
[role="exclude",id="mapping-roles-ad"]
=== Mapping Active Directory users and groups to roles
See <<ad-realm-configuration>>.

@ -3,11 +3,7 @@
=== Active Directory user authentication === Active Directory user authentication
You can configure {stack} {security-features} to communicate with Active You can configure {stack} {security-features} to communicate with Active
Directory to authenticate users. To integrate with Active Directory, you Directory to authenticate users. See <<ad-realm-configuration>>.
configure an `active_directory` realm and map Active Directory users and groups
to roles in the <<mapping-roles, role mapping file>>.
See {ref}/configuring-ad-realm.html[Configuring an active directory realm].
The {security-features} use LDAP to communicate with Active Directory, so The {security-features} use LDAP to communicate with Active Directory, so
`active_directory` realms are similar to <<ldap-realm, `ldap` realms>>. Like `active_directory` realms are similar to <<ldap-realm, `ldap` realms>>. Like
@ -33,25 +29,10 @@ Active Directory. Once the user has been found, the Active Directory realm then
retrieves the user's group memberships from the `tokenGroups` attribute on the retrieves the user's group memberships from the `tokenGroups` attribute on the
user's entry in Active Directory. user's entry in Active Directory.
[[ad-load-balancing]] [[ad-realm-configuration]]
==== Load balancing and failover ==== Configuring an Active Directory realm
The `load_balance.type` setting can be used at the realm level to configure how
the {security-features} should interact with multiple Active Directory servers.
Two modes of operation are supported: failover and load balancing.
See include::configuring-active-directory-realm.asciidoc[]
{ref}/security-settings.html#load-balancing[Load balancing and failover settings].
[[ad-settings]]
==== Active Directory realm settings
See
{ref}/security-settings.html#ref-ad-settings[Active Directory realm settings].
[[mapping-roles-ad]]
==== Mapping Active Directory users and groups to roles
See {ref}/configuring-ad-realm.html[Configuring an Active Directory realm].
[[ad-user-metadata]] [[ad-user-metadata]]
==== User metadata in Active Directory realms ==== User metadata in Active Directory realms
@ -73,8 +54,16 @@ This metadata is returned in the
Additional metadata can be extracted from the Active Directory server by configuring Additional metadata can be extracted from the Active Directory server by configuring
the `metadata` setting on the Active Directory realm. the `metadata` setting on the Active Directory realm.
[[ad-load-balancing]]
==== Load balancing and failover
The `load_balance.type` setting can be used at the realm level to configure how
the {security-features} should interact with multiple Active Directory servers.
Two modes of operation are supported: failover and load balancing.
See
<<load-balancing>>.
[[active-directory-ssl]] [[active-directory-ssl]]
==== Setting up SSL between Elasticsearch and Active Directory ==== Setting up SSL between Elasticsearch and Active Directory
See See <<tls-active-directory>>.
{ref}/configuring-tls.html#tls-active-directory[Encrypting communications between {es} and Active Directory].

@ -1,14 +1,6 @@
[role="xpack"] To integrate with Active Directory, you configure an `active_directory`
[[configuring-ad-realm]]
=== Configuring an Active Directory realm
You can configure {es} to communicate with Active Directory to authenticate
users. To integrate with Active Directory, you configure an `active_directory`
realm and map Active Directory users and groups to roles in the role mapping file. realm and map Active Directory users and groups to roles in the role mapping file.
For more information about Active Directory realms, see
<<active-directory-realm>>.
. Add a realm configuration of type `active_directory` to `elasticsearch.yml` . Add a realm configuration of type `active_directory` to `elasticsearch.yml`
under the `xpack.security.authc.realms.active_directory` namespace. under the `xpack.security.authc.realms.active_directory` namespace.
At a minimum, you must specify the Active Directory `domain_name`. At a minimum, you must specify the Active Directory `domain_name`.

@ -12,7 +12,7 @@ To "run as" (impersonate) another user, you must be able to retrieve the user fr
the realm you use to authenticate. Both the internal `native` and `file` realms the realm you use to authenticate. Both the internal `native` and `file` realms
support this out of the box. The LDAP realm must be configured to run in support this out of the box. The LDAP realm must be configured to run in
<<ldap-realm-configuration,_user search_ mode>>. The Active Directory realm must be <<ldap-realm-configuration,_user search_ mode>>. The Active Directory realm must be
<<ad-settings,configured with a `bind_dn` and `secure_bind_password`>> to support <<ref-ad-settings,configured with a `bind_dn` and `secure_bind_password`>> to support
_run as_. The PKI, Kerberos, and SAML realms do not support _run as_. _run as_. The PKI, Kerberos, and SAML realms do not support _run as_.
To submit requests on behalf of other users, you need to have the `run_as` To submit requests on behalf of other users, you need to have the `run_as`

@ -72,7 +72,7 @@ TIP: The types of authentication realms that you can enable varies according to
your subscription. For more information, see https://www.elastic.co/subscriptions. your subscription. For more information, see https://www.elastic.co/subscriptions.
-- --
** <<configuring-ad-realm,Active Directory realms>> ** <<active-directory-realm,Active Directory realms>>
** <<file-realm,File realms>> ** <<file-realm,File realms>>
** <<kerberos-realm,Kerberos realms>> ** <<kerberos-realm,Kerberos realms>>
** <<ldap-realm,LDAP realms>> ** <<ldap-realm,LDAP realms>>
@ -138,8 +138,6 @@ Events are logged to a dedicated `<clustername>_audit.json` file in
To walk through the configuration of {security-features} in {es}, {kib}, {ls}, and {metricbeat}, see <<security-getting-started>>. To walk through the configuration of {security-features} in {es}, {kib}, {ls}, and {metricbeat}, see <<security-getting-started>>.
include::securing-communications/separating-node-client-traffic.asciidoc[] include::securing-communications/separating-node-client-traffic.asciidoc[]
include::authentication/configuring-active-directory-realm.asciidoc[]
include::reference/files.asciidoc[] include::reference/files.asciidoc[]
include::fips-140-compliance.asciidoc[] include::fips-140-compliance.asciidoc[]

@ -13,7 +13,7 @@ to have the Active Directory server's certificate or the server's root CA
certificate installed in their keystore or truststore. certificate installed in their keystore or truststore.
. Create the realm configuration for the `xpack.security.authc.realms` namespace . Create the realm configuration for the `xpack.security.authc.realms` namespace
in the `elasticsearch.yml` file. See <<configuring-ad-realm>>. in the `elasticsearch.yml` file. See <<ad-realm-configuration>>.
. Set the `url` attribute in the realm configuration to specify the LDAPS protocol . Set the `url` attribute in the realm configuration to specify the LDAPS protocol
and the secure port number. For example, `url: ldaps://ad.example.com:636`. and the secure port number. For example, `url: ldaps://ad.example.com:636`.