IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« File-based user authentication Native user authentication »

› › ›

LDAP user authentication

edit

LDAP user authentication

edit

You can configure the Elastic Stack security features to communicate with a Lightweight Directory Access Protocol (LDAP) server to authenticate users. To integrate with LDAP, you configure an ldap realm and map LDAP groups to user roles in the role mapping file.

LDAP stores users and groups hierarchically, similar to the way folders are grouped in a file system. An LDAP directory’s hierarchy is built from containers such as the organizational unit (ou), organization (o), and domain controller (dc).

The path to an entry is a Distinguished Name (DN) that uniquely identifies a user or group. User and group names typically have attributes such as a common name (cn) or unique ID (uid). A DN is specified as a string, for example "cn=admin,dc=example,dc=com" (white spaces are ignored).

The ldap realm supports two modes of operation, a user search mode and a mode with specific templates for user DNs.

User search mode and user DN templates mode

edit

See Configuring an LDAP Realm.

Load balancing and failover

edit

The load_balance.type setting can be used at the realm level to configure how the security features should interact with multiple LDAP servers. The security features support both failover and load balancing modes of operation.

See Load balancing and failover settings.

LDAP realm settings

edit

See LDAP realm settings.

Mapping LDAP groups to roles

edit

An integral part of a realm authentication process is to resolve the roles associated with the authenticated user. Roles define the privileges a user has in the cluster.

Since with the ldap realm the users are managed externally in the LDAP server, the expectation is that their roles are managed there as well. In fact, LDAP supports the notion of groups, which often represent user roles for different systems in the organization.

The ldap realm enables you to map LDAP users to roles via their LDAP groups, or other metadata. This role mapping can be configured via the add role mapping API or by using a file stored on each node. When a user authenticates with LDAP, the privileges for that user are the union of all privileges defined by the roles to which the user is mapped. For more information, see Configuring an LDAP realm.

User metadata in LDAP realms

edit

When a user is authenticated via an LDAP realm, the following properties are populated in the user’s metadata:

Field	Description
`ldap_dn`	The distinguished name of the user.
`ldap_groups`	The distinguished name of each of the groups that were resolved for the user (regardless of whether those groups were mapped to a role).

This metadata is returned in the authenticate API, and can be used with templated queries in roles.

Additional fields can be included in the user’s metadata by configuring the metadata setting on the LDAP realm. This metadata is available for use with the role mapping API or in templated role queries.

Setting up SSL between Elasticsearch and LDAP

edit

See Encrypting communications between Elasticsearch and LDAP.

« File-based user authentication Native user authentication »