NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
Configuring a native realm
editConfiguring a native realm
editThe easiest way to manage and authenticate users is with the internal native
realm.
The native realm is available by default when no other realms are
configured. If other realm settings have been configured in elasticsearch.yml
,
you must add the native realm to the realm chain.
You can configure options for the native
realm in the
xpack.security.authc.realms
namespace in elasticsearch.yml
. Explicitly
configuring a native realm enables you to set the order in which it appears in
the realm chain, temporarily disable the realm, and control its cache options.
-
Add a realm configuration of type
native
toelasticsearch.yml
under thexpack.security.authc.realms
namespace. At a minimum, you must set the realmtype
tonative
. If you are configuring multiple realms, you should also explicitly set theorder
attribute.See Native realm settings for all of the options you can set for the
native
realm. For example, the following snippet shows anative
realm configuration that sets theorder
to zero so the realm is checked first:xpack: security: authc: realms: native1: type: native order: 0
To limit exposure to credential theft and mitigate credential compromise, the native realm stores passwords and caches user credentials according to security best practices. By default, a hashed version of user credentials is stored in memory, using a salted
sha-256
hash algorithm and a hashed version of passwords is stored on disk salted and hashed with thebcrypt
hash algorithm. To use different hash algorithms, see User cache and password hash algorithms. - Restart Elasticsearch.
- Manage your users in Kibana on the Management / Security / Users page. Alternatively, use the User Management APIs.