Security settings in Kibana
editSecurity settings in Kibana
editYou do not need to configure any additional settings to use the security features in Kibana. They are enabled by default.
General security settings
edit
|
By default, Kibana automatically detects whether to enable the
security features based on the license and whether Elasticsearch security features
are enabled. |
|
Set to |
Authentication security settings
editYou configure authentication settings in the xpack.security.authc
namespace in kibana.yml
.
For example:
xpack.security.authc: providers: basic.basic1: order: 0 ... saml.saml1: order: 1 ... saml.saml2: order: 2 ... pki.realm3: order: 3 ... ...
Specifies the type of authentication provider (for example, |
|
Specifies the order of the provider in the authentication chain and on the Login Selector UI. This setting is mandatory. |
|
Specifies the settings for the SAML authentication provider with a |
|
Specifies the settings for the SAML authentication provider with a |
The valid settings in the xpack.security.authc.providers
namespace vary depending on the authentication provider type. For more information, refer to Authentication.
Valid settings for all authentication providers
edit
|
Determines if the authentication provider should be enabled. By default, Kibana enables the provider as soon as you configure any of its properties. |
|
Order of the provider in the authentication chain and on the Login Selector UI. |
|
Custom description of the provider entry displayed on the Login Selector UI. |
|
Custom hint for the provider entry displayed on the Login Selector UI. |
|
Custom icon for the provider entry displayed on the Login Selector UI. |
|
Flag that indicates if the provider should have an entry on the Login Selector UI. Setting this to |
You are unable to set this setting to |
|
|
Access agreement text in Markdown format. For more information, refer to Access agreement. |
SAML authentication provider settings
editIn addition to the settings that are valid for all providers, you can specify the following settings:
OpenID Connect authentication provider settings
editIn addition to the settings that are valid for all providers, you can specify the following settings:
OpenID Connect realm in Elasticsearch that the provider should use. |
HTTP authentication settings
editThere is a very limited set of cases when you’d want to change these settings. For more information, refer to HTTP authentication.
|
Determines if HTTP authentication should be enabled. By default, this setting is set to |
|
Determines if HTTP authentication schemes used by the enabled authentication providers should be automatically supported during HTTP authentication. By default, this setting is set to |
|
List of HTTP authentication schemes that Kibana HTTP authentication should support. By default, this setting is set to |
Login user interface settings
editYou can configure the following settings in the kibana.yml
file.
Adds a message to the login UI. Useful for displaying information about maintenance windows, links to corporate sign up pages, and so on. |
|
Adds a message accessible at the login UI with additional help information for the login process. |
|
Determines if the login selector UI should be enabled. By default, this setting is set to |
Session and cookie security settings
editYou can configure the following settings in the kibana.yml
file.
|
Sets the name of the cookie used for the session. The default value is |
An arbitrary string of 32 characters or more that is used to encrypt session information. Do not expose this key to users of Kibana. By default, a value is automatically generated in memory. If you use that default behavior, all sessions are invalidated when Kibana restarts. In addition, high-availability deployments of Kibana will behave unexpectedly if this setting isn’t the same for all instances of Kibana. |
|
Sets the |
|
Sets the |
|
Ensures that user sessions will expire after a period of inactivity. This and |
|
The format is a string of |
|
Ensures that user sessions will expire after the defined time period. This behavior also known as an "absolute timeout". If
this is not set, user sessions could stay active indefinitely. This and |
|
The format is a string of |
|
|
Sets the interval at which Kibana tries to remove expired and invalid sessions from the session index. By default, this value is 1 hour. The minimum value is 10 seconds. |
The format is a string of |
Encrypted saved objects settings
editThese settings control the encryption of saved objects with sensitive data. For more details, refer to Secure saved objects.
In high-availability deployments, make sure you use the same encryption and decryption keys for all instances of Kibana. Although the keys can be specified in clear text in kibana.yml
, it’s recommended to store them securely in the Kibana Keystore.
An arbitrary string of at least 32 characters that is used to encrypt sensitive properties of saved objects before they’re stored in Elasticsearch. If not set, Kibana will generate a random key on startup, but certain features won’t be available until you set the encryption key explicitly. |
|
An optional list of previously used encryption keys. Like |