github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

[DOCS] Adds principal associated to keytab file (#96498) (#96653)

Browse source 
* [DOCS] Adds principal associated to keytab file

* Update docs/user/security/authentication/index.asciidoc

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

* Review comments

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
This commit is contained in:
Kaarina Tungseth 2021-04-08 16:48:01 -05:00 • committed by GitHub
parent 839ab6c1ba
commit a24e5174e9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/user/security/authentication/index.asciidoc
View file

@ -292,7 +292,11 @@ xpack.security.authc.providers:
order: 1
-----------------------------------------------
Kibana uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. At the end of the Kerberos handshake, Kibana will forward the service ticket to Elasticsearch. Elasticsearch will unpack it and it will respond with an access and refresh token which are then used for subsequent authentication.
IMPORTANT: {kib} uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications.
At the end of the Kerberos handshake, {kib} forwards the service ticket to {es}, then {es} unpacks the service ticket and responds with an access and refresh token, which are used for subsequent authentication.
On every {es} node that {kib} connects to, the keytab file should always contain the HTTP service principal for the {kib} host.
The HTTP service principal name must have the `HTTP/kibana.domain.local@KIBANA.DOMAIN.LOCAL` format.
[[anonymous-authentication]]
==== Anonymous authentication