mirror of
https://github.com/elastic/kibana.git
synced 2025-04-25 02:09:32 -04:00
0b0110a2dd
## Summary Linking the "[Reporting and Sharing](https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#reporting-advanced-settings)" and the "[Configure reporting](https://www.elastic.co/guide/en/kibana/current/secure-reporting.html)" documentation pages to each other as they contain information that relate to each page. Also contains a small formatting fix to a NOTE on the Configure reporting page. Closes: #169065
233 lines
9.6 KiB
Text
233 lines
9.6 KiB
Text
[role="xpack"]
|
|
[[secure-reporting]]
|
|
== Configure reporting in {kib}
|
|
|
|
++++
|
|
<titleabbrev>Configure reporting</titleabbrev>
|
|
++++
|
|
|
|
For security, you grant users access to the {report-features} and secure the reporting endpoints
|
|
with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system
|
|
to enable the {kib} server to have screenshotting capabilities.
|
|
|
|
* <<install-reporting-packages>>
|
|
* <<grant-user-access>>
|
|
* <<reporting-roles-user-api>>
|
|
* <<grant-user-access-basic>>
|
|
* <<grant-user-access-external-provider>>
|
|
* <<securing-reporting>>
|
|
|
|
[float]
|
|
[[install-reporting-packages]]
|
|
=== Install the reporting packages
|
|
|
|
Make sure the {kib} server operating system has the appropriate packages installed for the distribution.
|
|
|
|
If you are using RHEL operating systems, install the following packages:
|
|
|
|
* `ipa-gothic-fonts`
|
|
* `xorg-x11-fonts-100dpi`
|
|
* `xorg-x11-fonts-75dpi`
|
|
* `xorg-x11-utils`
|
|
* `xorg-x11-fonts-cyrillic`
|
|
* `xorg-x11-fonts-Type1`
|
|
* `xorg-x11-fonts-misc`
|
|
* `fontconfig`
|
|
* `freetype`
|
|
|
|
If you are using Ubuntu/Debian systems, install the following packages:
|
|
|
|
* `fonts-liberation`
|
|
* `libfontconfig1`
|
|
* `libnss3`
|
|
|
|
The reporting plugin has a built-in utility to check for common issues, such as missing dependencies. See
|
|
<<reporting-diagnostics>> for more information.
|
|
|
|
[float]
|
|
[[grant-user-access]]
|
|
=== Grant users access to reporting
|
|
When security is enabled, you grant users access to {report-features} with <<kibana-privileges, {kib} application privileges>>, which allow you to create custom roles that control the spaces and applications where users generate reports.
|
|
|
|
. Enable application privileges in Reporting. To enable, turn off the default user access control features in `kibana.yml`:
|
|
+
|
|
[source,yaml]
|
|
------------------------------------
|
|
xpack.reporting.roles.enabled: false
|
|
------------------------------------
|
|
+
|
|
NOTE: If you use the default settings, you can still create a custom role that grants reporting privileges. The default role is `reporting_user`. This behavior is being deprecated and does not allow application-level access controls for {report-features}, and does not allow API keys or authentication tokens to authorize report generation. Refer to <<reporting-advanced-settings, reporting security settings>> for information and caveats about the deprecated access control features.
|
|
|
|
. Create the reporting role.
|
|
|
|
.. Open the main menu, then click *Stack Management*.
|
|
|
|
.. Click *Roles > Create role*.
|
|
|
|
. Specify the role settings.
|
|
|
|
.. Enter the *Role name*. For example, `custom_reporting_user`.
|
|
|
|
.. Specify the *Indices* and *Privileges*.
|
|
+
|
|
Access to data is an index-level privilege. For each index that contains the data you want to include in reports, add a line, then give each index `read` and `view_index_metadata` privileges.
|
|
+
|
|
NOTE: If you use index aliases, you must also grant `read` and `view_index_metadata` privileges to underlying indices to generate CSV reports.
|
|
+
|
|
For more information, refer to {ref}/security-privileges.html[Security privileges].
|
|
|
|
. Add the {kib} privileges.
|
|
|
|
.. Click *Add Kibana privilege*.
|
|
|
|
.. Select one or more *Spaces*.
|
|
|
|
.. Click *Customize*, then click *Analytics*.
|
|
|
|
.. For each application, select *All*, or to customize the privileges, select *Read* and *Customize sub-feature privileges*.
|
|
+
|
|
NOTE: If you have a Basic license, sub-feature privileges are unavailable. For details, check out <<grant-user-access-basic>>.
|
|
[role="screenshot"]
|
|
image::user/reporting/images/kibana-privileges-with-reporting.png["Kibana privileges with Reporting options, Gold or higher license"]
|
|
+
|
|
NOTE: If the *Reporting* options for application features are unavailable, and the cluster license is higher than Basic, contact your administrator, or <<reporting-advanced-settings,check that `xpack.reporting.roles.enabled` is set to `false` in kibana.yml>>.
|
|
|
|
.. Click *Add {kib} privilege*.
|
|
|
|
. Click *Create role*.
|
|
|
|
. Assign the reporting role to a user.
|
|
|
|
.. Open the main menu, then click *Stack Management*.
|
|
|
|
.. Click *Users*, then click the user you want to assign the reporting role to.
|
|
|
|
.. From the *Roles* dropdown, select *custom_reporting_user*.
|
|
|
|
.. Click *Update user*.
|
|
|
|
Granting the privilege to generate reports also grants the user the privilege to view their reports in *Stack Management > Reporting*. Users can only access their own reports.
|
|
|
|
[float]
|
|
[[reporting-roles-user-api]]
|
|
==== Grant access with the role API
|
|
With <<grant-user-access, {kib} application privileges>> enabled in Reporting, you can also use the {ref}/security-api-put-role.html[role API] to grant access to the {report-features}, using *All* privileges, or sub-feature privileges.
|
|
|
|
NOTE: This link:https://www.elastic.co/guide/en/kibana/current/role-management-api-put.html[API request] needs to be executed against the link:https://www.elastic.co/guide/en/kibana/current/api.html[Kibana API endpoint].
|
|
[source, sh]
|
|
---------------------------------------------------------------
|
|
POST <kibana host>:<port>/api/_security/role/custom_reporting_user
|
|
{
|
|
"elasticsearch": {
|
|
"cluster": [],
|
|
"indices": [],
|
|
"run_as": []
|
|
},
|
|
"kibana": [{
|
|
"spaces": ["*"],
|
|
"base": [],
|
|
"feature": {
|
|
"dashboard": ["generate_report", <1>
|
|
"download_csv_report"], <2>
|
|
"discover": ["generate_report"], <3>
|
|
"canvas": ["generate_report"], <4>
|
|
"visualize": ["generate_report"] <5>
|
|
}
|
|
}]
|
|
}
|
|
---------------------------------------------------------------
|
|
// CONSOLE
|
|
|
|
<1> Grants access to generate PNG and PDF reports in *Dashboard*.
|
|
<2> Grants access to download CSV files from saved search panels in *Dashboard*.
|
|
<3> Grants access to generate CSV reports from saved searches in *Discover*.
|
|
<4> Grants access to generate PDF reports in *Canvas*.
|
|
<5> Grants access to generate PNG and PDF reports in *Visualize Library*.
|
|
|
|
[float]
|
|
[[grant-user-access-basic]]
|
|
=== Grant users access with a Basic license
|
|
|
|
With a Basic license, you can grant users access with custom roles to {report-features} with <<kibana-privileges, {kib} application privileges>>. However, with a Basic license, sub-feature privileges are unavailable. <<grant-user-access,Create a role>>, then select *All* privileges for the applications where users can create reports.
|
|
|
|
[role="screenshot"]
|
|
image::user/reporting/images/kibana-privileges-with-reporting-basic.png["Kibana privileges with Reporting options, Basic license"]
|
|
|
|
With a Basic license, sub-feature application privileges are unavailable, but you can use the {ref}/security-api-put-role.html[role API] to grant access to CSV {report-features}:
|
|
|
|
[source, sh]
|
|
---------------------------------------------------------------
|
|
PUT localhost:5601/api/security/role/custom_reporting_user
|
|
{
|
|
"elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
|
|
"kibana": [
|
|
{
|
|
"base": [],
|
|
"feature": {
|
|
"dashboard": [ "all" ], <1>
|
|
"discover": [ "all" ], <2>
|
|
},
|
|
"spaces": [ "*" ]
|
|
}
|
|
],
|
|
"metadata": {} // optional
|
|
}
|
|
---------------------------------------------------------------
|
|
// CONSOLE
|
|
|
|
<1> Grants access to generate CSV reports from saved searches in *Discover*.
|
|
<2> Grants access to download CSV reports from saved search panels in *Dashboard*.
|
|
|
|
[float]
|
|
[[grant-user-access-external-provider]]
|
|
==== Grant access using an external provider
|
|
|
|
If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in {ref}/mapping-roles.html[`config/role_mapping.yml`].
|
|
|
|
For example, assign the `kibana_admin` and `reporting_user` roles to the Bill Murray user:
|
|
|
|
[source,yaml]
|
|
--------------------------------------------------------------------------------
|
|
kibana_admin:
|
|
- "cn=Bill Murray,dc=example,dc=com"
|
|
reporting_user:
|
|
- "cn=Bill Murray,dc=example,dc=com"
|
|
--------------------------------------------------------------------------------
|
|
|
|
[float]
|
|
[[securing-reporting]]
|
|
=== Secure the reporting endpoints
|
|
|
|
To automatically generate reports with {watcher}, you must configure {watcher} to trust the {kib} server certificate.
|
|
|
|
. Enable {stack-security-features} on your {es} cluster. For more information, see {ref}/security-getting-started.html[Getting started with security].
|
|
|
|
. Configure TLS/SSL encryption for the {kib} server. For more information, see <<configuring-tls>>.
|
|
|
|
. Specify the {kib} server CA certificate chain in `elasticsearch.yml`:
|
|
+
|
|
--
|
|
If you are using your own CA to sign the {kib} server certificate, then you need to specify the CA certificate chain in {es} to properly establish trust in TLS connections between {watcher} and {kib}. If your CA certificate chain is contained in a PKCS #12 trust store, specify it like so:
|
|
|
|
[source,yaml]
|
|
--------------------------------------------------------------------------------
|
|
xpack.http.ssl.truststore.path: "/path/to/your/truststore.p12"
|
|
xpack.http.ssl.truststore.type: "PKCS12"
|
|
xpack.http.ssl.truststore.password: "optional decryption password"
|
|
--------------------------------------------------------------------------------
|
|
|
|
Otherwise, if your CA certificate chain is in PEM format, specify it like so:
|
|
|
|
[source,yaml]
|
|
--------------------------------------------------------------------------------
|
|
xpack.http.ssl.certificate_authorities: ["/path/to/your/cacert1.pem", "/path/to/your/cacert2.pem"]
|
|
--------------------------------------------------------------------------------
|
|
|
|
For more information, see {ref}/notification-settings.html#ssl-notification-settings[the {watcher} HTTP TLS/SSL Settings].
|
|
--
|
|
|
|
. Add one or more users who have access to the {report-features}.
|
|
+
|
|
Once you've enabled SSL for {kib}, all requests to the reporting endpoints must include valid credentials.
|
|
|
|
For more information on sharing reports, direct links, and more, refer to <<reporting-getting-started, Reporting and sharing>>.
|