mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-24 23:27:25 -04:00
255c9a7f95
**Problem:** For historical reasons, source files for the Elasticsearch Guide's security, watcher, and Logstash API docs are housed in the `x-pack/docs` directory. This can confuse new contributors who expect Elasticsearch Guide docs to be located in `docs/reference`. **Solution:** - Move the security, watcher, and Logstash API doc source files to the `docs/reference` directory - Update doc snippet tests to use security Rel: https://github.com/elastic/platform-docs-team/issues/208
75 lines
3.3 KiB
Text
75 lines
3.3 KiB
Text
[role="xpack"]
|
|
[[realms]]
|
|
=== Realms
|
|
|
|
The {stack-security-features} authenticate users by using realms and one or more
|
|
<<token-authentication-services,token-based authentication services>>.
|
|
|
|
A _realm_ is used to resolve and authenticate users based on authentication
|
|
tokens. The {security-features} provide the following built-in realms:
|
|
|
|
_native_::
|
|
An internal realm where users are stored in a dedicated {es} index.
|
|
This realm supports an authentication token in the form of username and password,
|
|
and is available by default when no realms are explicitly configured. The users
|
|
are managed via the <<security-user-apis,user management APIs>>.
|
|
See <<native-realm>>.
|
|
|
|
_ldap_::
|
|
A realm that uses an external LDAP server to authenticate the
|
|
users. This realm supports an authentication token in the form of username and
|
|
password, and requires explicit configuration in order to be used. See
|
|
<<ldap-realm>>.
|
|
|
|
_active_directory_::
|
|
A realm that uses an external Active Directory Server to authenticate the
|
|
users. With this realm, users are authenticated by usernames and passwords.
|
|
See <<active-directory-realm>>.
|
|
|
|
_pki_::
|
|
A realm that authenticates users using Public Key Infrastructure (PKI). This
|
|
realm works in conjunction with SSL/TLS and identifies the users through the
|
|
Distinguished Name (DN) of the client's X.509 certificates. See <<pki-realm>>.
|
|
|
|
_file_::
|
|
An internal realm where users are defined in files stored on each node in the
|
|
{es} cluster. This realm supports an authentication token in the form
|
|
of username and password and is always available. See <<file-realm>>.
|
|
|
|
_saml_::
|
|
A realm that facilitates authentication using the SAML 2.0 Web SSO protocol.
|
|
This realm is designed to support authentication through {kib} and is not
|
|
intended for use in the REST API. See <<saml-realm>>.
|
|
|
|
_kerberos_::
|
|
A realm that authenticates a user using Kerberos authentication. Users are
|
|
authenticated on the basis of Kerberos tickets. See <<kerberos-realm>>.
|
|
|
|
_oidc_::
|
|
A realm that facilitates authentication using OpenID Connect. It enables {es} to serve as an OpenID Connect Relying Party (RP) and provide single sign-on (SSO) support in {kib}. See <<oidc-guide>>.
|
|
|
|
_jwt_::
|
|
A realm that facilitates using JWT identity tokens as authentication bearer tokens.
|
|
Compatible tokens are OpenID Connect ID Tokens, or custom JWTs containing the same claims.
|
|
See <<jwt-auth-realm>>.
|
|
|
|
The {security-features} also support custom realms. If you need to integrate
|
|
with another authentication system, you can build a custom realm plugin. For
|
|
more information, see <<custom-realms>>.
|
|
|
|
==== Internal and external realms
|
|
|
|
Realm types can roughly be classified in two categories:
|
|
|
|
Internal:: Realms that are internal to Elasticsearch and don't require any
|
|
communication with external parties. They are fully managed by the {stack}
|
|
{security-features}. There can only be a maximum of one configured realm per
|
|
internal realm type. The {security-features} provide two internal realm
|
|
types: `native` and `file`.
|
|
|
|
External:: Realms that require interaction with parties/components external to
|
|
{es}, typically, with enterprise grade identity management systems. Unlike
|
|
internal realms, there can be as many external realms as one would like - each
|
|
with its own unique name and configuration. The {security-features} provide the
|
|
following external realm types: `ldap`, `active_directory`, `saml`, `kerberos`,
|
|
and `pki`.
|