mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-06 13:08:29 +00:00
574ec6686e
This moves all Realm settings to an Affix definition.
However, because different realm types define different settings
(potentially conflicting settings) this requires that the realm type
become part of the setting key.
Thus, we now need to define realm settings as:
xpack.security.authc.realms:
file.file1:
order: 0
native.native1:
order: 1
- This is a breaking change to realm config
- This is also a breaking change to custom security realms (SecurityExtension)
56 lines
2.3 KiB
Plaintext
56 lines
2.3 KiB
Plaintext
[role="xpack"]
|
|
[[tls-ldap]]
|
|
==== Encrypting communications between {es} and LDAP
|
|
|
|
To protect the user credentials that are sent for authentication in an LDAP
|
|
realm, it's highly recommended to encrypt communications between {es} and your
|
|
LDAP server. Connecting via SSL/TLS ensures that the identity of the LDAP server
|
|
is authenticated before {security} transmits the user credentials and the
|
|
contents of the connection are encrypted. Clients and nodes that connect via
|
|
TLS to the LDAP server need to have the LDAP server's certificate or the
|
|
server's root CA certificate installed in their keystore or truststore.
|
|
|
|
For more information, see <<configuring-ldap-realm>>.
|
|
|
|
. Configure the realm's TLS settings on each node to trust certificates signed
|
|
by the CA that signed your LDAP server certificates. The following example
|
|
demonstrates how to trust a CA certificate, `cacert.pem`, located within the
|
|
{xpack} configuration directory:
|
|
+
|
|
--
|
|
[source,shell]
|
|
--------------------------------------------------
|
|
xpack:
|
|
security:
|
|
authc:
|
|
realms:
|
|
ldap:
|
|
ldap1:
|
|
order: 0
|
|
url: "ldaps://ldap.example.com:636"
|
|
ssl:
|
|
certificate_authorities: [ "ES_PATH_CONF/cacert.pem" ]
|
|
--------------------------------------------------
|
|
|
|
The CA certificate must be a PEM encoded.
|
|
|
|
NOTE: You can also specify the individual server certificates rather than the CA
|
|
certificate, but this is only recommended if you have a single LDAP server or
|
|
the certificates are self-signed.
|
|
|
|
--
|
|
|
|
. Set the `url` attribute in the realm configuration to specify the LDAPS
|
|
protocol and the secure port number. For example, `url: ldaps://ldap.example.com:636`.
|
|
|
|
. Restart {es}.
|
|
|
|
NOTE: By default, when you configure {security} to connect to an LDAP server
|
|
using SSL/TLS, {security} attempts to verify the hostname or IP address
|
|
specified with the `url` attribute in the realm configuration with the
|
|
values in the certificate. If the values in the certificate and realm
|
|
configuration do not match, {security} does not allow a connection to the
|
|
LDAP server. This is done to protect against man-in-the-middle attacks. If
|
|
necessary, you can disable this behavior by setting the
|
|
`ssl.verification_mode` property to `certificate`.
|