New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Realms File-based user authentication »
Elastic Docs ›Elasticsearch Guide [6.3] ›Secure a cluster ›User authentication

Active Directory user authentication

edit

Active Directory user authentication

edit

You can configure X-Pack security to communicate with Active Directory to authenticate users. To integrate with Active Directory, you configure an active_directory realm and map Active Directory users and groups to X-Pack security roles in the role mapping file.

See Configuring an Active Directory Realm.

X-Pack security uses LDAP to communicate with Active Directory, so active_directory realms are similar to ldap realms. Like LDAP directories, Active Directory stores users and groups hierarchically. The directory’s hierarchy is built from containers such as the organizational unit (ou), organization (o), and domain controller (dc).

The path to an entry is a Distinguished Name (DN) that uniquely identifies a user or group. User and group names typically have attributes such as a common name (cn) or unique ID (uid). A DN is specified as a string, for example "cn=admin,dc=example,dc=com" (white spaces are ignored).

X-Pack security only supports Active Directory security groups. You cannot map distribution groups to roles.

When you use Active Directory for authentication, the username entered by the user is expected to match the sAMAccountName or userPrincipalName, not the common name.

The Active Directory realm authenticates users using an LDAP bind request. After authenticating the user, the realm then searches to find the user’s entry in Active Directory. Once the user has been found, the Active Directory realm then retrieves the user’s group memberships from the tokenGroups attribute on the user’s entry in Active Directory.

Load balancing and failover

edit

The load_balance.type setting can be used at the realm level to configure how X-Pack security should interact with multiple Active Directory servers. Two modes of operation are supported: failover and load balancing.

See Load Balancing and Failover Settings.

Active Directory realm settings

edit

See Active Directory Realm Settings.

Mapping Active Directory users and groups to roles

edit

See Configuring an Active Directory realm.

User metadata in Active Directory realms

edit

When a user is authenticated via an Active Directory realm, the following properties are populated in the user’s metadata:

Field

Description

ldap_dn

The distinguished name of the user.

ldap_groups

The distinguished name of each of the groups that were resolved for the user (regardless of whether those groups were mapped to a role).

This metadata is returned in the authenticate API and can be used with templated queries in roles.

Additional metadata can be extracted from the Active Directory server by configuring the metadata setting on the Active Directory realm.

Setting up SSL between Elasticsearch and Active Directory

edit

See Encrypting communications between Elasticsearch and Active Directory.

« Realms File-based user authentication »