Body Required

• id string Required

  The identifier for the security realm

• name string Required

  The friendly name of the security realm

• urls array[string] Required

  The LDAP URLs used to authenticate against, in the format ldap[s]://server:port. Note that ldap and ldaps protocols cannot be mixed together.

• bind_anonymously boolean Required

  When true, bindDb credentials are ignored

• bind_type string Required

  The type of user binding to apply

  Values are user_search or user_templates.

• group_search object

  The LDAP group search configuration

  Additional properties are allowed.

  Hide group_search attributes Show group_search attributes object

  • base_dn string

    Specifies a container DN to search for groups in which the user has membership

  • scope string

    Specifies whether the group search should be sub_tree, one_level or base. one_level only searches objects directly contained within the base_dn. The default sub_tree searches all objects contained under base_dn. base specifies that the base_dn is a group object, and that it is the only group considered.

    Values are sub_tree, one_level, or base.

  • filter string

    Specifies a filter to search for a group. When unspecified, the security realm searches for group, groupOfNames, groupOfUniqueNames, or posixGroup with the attributes member, memberOf, or memberUid. Any instance of {0} in the filter is replaced by the user attribute defined in user_attribute.

  • user_attribute string

    Specifies the user attribute that is fetched and provided as a parameter to the filter. When unspecified, the user DN is passed to the filter.

• user_search object

  The LDAP user search configuration. Only used when bind_type is set to 'user_search'.

  Additional properties are allowed.

  Hide user_search attributes Show user_search attributes object

  • base_dn string

    Specifies a container DN to search for users

  • scope string

    The scope of the user search. Valid values are sub_tree, one_level, or base. one_level only searches objects directly contained in the base_dn. sub_tree searches all objects contained in base_dn. base specifies that the base_dn is the user object, and that it is the only user considered. Defaults to sub_tree.

    Values are sub_tree, one_level, or base.

  • filter string

    Specifies the filter to search the directory and match an entry with the username provided by the user. Defaults to (uid={0}). {0} is substituted with the username provided when searching.

• user_dn_templates array[string]

  The distinguished name template that replaces the user name with the string {0}. Only used when bind_type is set to 'user_templates'.

• bind_dn string

  The distinguished name of the user that is used to bind to the LDAP and perform searches. Only used when bind_type is set to 'user_search'.

• bind_password string

  The user password that is used to bind to the LDAP server. Only used when bind_type is set to 'user_search'.

• user_group_attribute string

  Specifies the attribute to examine on the user for group membership. If any 'group_search' settings are specified, this setting is ignored. Defaults to 'memberOf'.

• load_balance object

  The LDAP load balancing behavior

  Additional properties are allowed.

  Hide load_balance attributes Show load_balance attributes object

  • type string

    The behavior to use when there are multiple LDAP URLs defined

    Values are failover, dns_failover, round_robin, or dns_round_robin.

  • cache_ttl string

    When using dns_failover or dns_round_robin as the load balancing type, this setting controls the amount of time to cache DNS lookups. Defaults to 1h.

• certificate_url string

  The SSL trusted CA certificate bundle URL. The bundle should be a zip file containing a single keystore file 'keystore.ks' in the directory '/ldap/:id/truststore', where :id is the value of the [id] field.

• certificate_url_truststore_password string

  The password to the certificate bundle URL truststore

• certificate_url_truststore_type string

  The format of the truststore file. Should be jks to use the Java Keystore format or PKCS12 to use PKCS#12 files. The default is jks.

  Values are jks or PKCS12.

• role_mappings object

  The role mapping rules associated with the security realm

  Additional properties are allowed.

  Hide role_mappings attributes Show role_mappings attributes object

  • default_roles array[string] Required

    The default roles applied to all users

  • rules array[object] Required

    The role mapping rules to evaluate

    Hide rules attributes Show rules attributes object

    • type string Required

      The type of role mapping rule

      Values are user_dn or group_dn.

    • roles array[string] Required

      The roles that are applied when the mapping rule is successfully evaluated

    • value string Required

      The value to match when evaluating this rule

• enabled boolean

  When true, enables the security realm

• order integer(int32)

  The order that the security realm is evaluated

• override_yaml string

  Advanced configuration options in YAML format. Any settings defined here will override any configuration set via the API. Note that all keys should omit the 'xpack.security.authc.realms.ldap.{realm_id}' prefix. For example, when the realm ID is set to 'ldap1', the advanced configuration 'xpack.security.authc.realms.ldap.ldap1.ssl.verification_mode: full' should be added as 'ssl.verification_mode: full'.