- Elastic Cloud Enterprise - Elastic Cloud on your Infrastructure: other versions:
- Introducing Elastic Cloud Enterprise
- Preparing your installation
- Installing Elastic Cloud Enterprise
- Identify the deployment scenario
- Install ECE on a public cloud
- Install ECE on your own premises
- Alternative: Install ECE with Ansible
- Log into the Cloud UI
- Install ECE on additional hosts
- Migrate ECE to Podman hosts
- Post-installation steps
- Configuring your installation
- System clusters configuration
- Configure deployment templates
- Tag your allocators
- Edit instance configurations
- Create instance configurations
- Create deployment templates
- Configure system deployment templates
- Configure index management for templates
- Updating custom templates to support
node_roles
and autoscaling - Updating custom templates to support Integrations Server
- Default instance configurations
- Include additional Kibana plugins
- Manage snapshot repositories
- Snapshotting to Google Cloud Storage (GCS) for Elasticsearch 6.4 - 6.8
- Snapshotting to Google Cloud Storage (GCS) for Elasticsearch 7.0 and later
- Snapshotting to Azure Storage for Elasticsearch 5.x and 6.4 - 6.8
- Snapshotting to Azure Storage for Elasticsearch 7.0 and later
- Snapshotting to Minio on-premise storage
- Manage licenses
- Change the ECE API URL
- Change endpoint URLs
- Enable custom endpoint aliases
- Configure allocator affinity
- Securing your installation
- Monitoring your installation
- Administering your installation
- Working with deployments
- Create a deployment
- Access Kibana
- Indexing data into Elasticsearch
- Migrating data
- Ingestion methods
- Ingest data with Node.js on Elastic Cloud Enterprise
- Ingest data with Python on Elastic Cloud Enterprise
- Ingest data from Beats to Elastic Cloud Enterprise with Logstash as a proxy
- Ingest data from a relational database into Elastic Cloud Enterprise
- Ingest logs from a Python application using Filebeat
- Ingest logs from a Node.js web application using Filebeat
- Configure the Java transport client (deprecated)
- Manage data from the command line
- Administering deployments
- Change your deployment configuration
- Stop routing requests or pause nodes
- Terminate a deployment
- Restart a deployment
- Restore a deployment
- Delete a deployment
- Migrate to index lifecycle management
- Disable an Elasticsearch data tier
- Access the Elasticsearch API console
- Work with snapshots
- Upgrade versions
- Editing your user settings
- Deployment autoscaling
- Configure Beats and Logstash with Cloud ID
- Keep your clusters healthy
- Secure your clusters
- Reset the password for the
elastic
user - Secure your settings
- Secure your 7.x clusters with LDAP
- Secure your 7.x clusters with Active Directory
- Secure your 5.x and 6.x clusters with LDAP
- Secure your 5.x and 6.x clusters with Active Directory
- Secure your clusters with SAML
- Secure your clusters with OpenID Connect
- Secure your clusters with Kerberos
- Reset the password for the
- Trust management
- Deployment heap dumps
- Deployment thread dumps
- Traffic Filtering
- Connect to your cluster
- Manage your Kibana instance
- Manage your APM & Fleet Server (7.13+)
- Manage your APM Server (versions before 7.13)
- Manage your Integrations Server
- Switch from APM to Integrations Server payload
- Enable logging and monitoring
- Enable cross-cluster search and cross-cluster replication
- Enable App Search
- Enable Enterprise Search
- Enable Graph (versions before 5.0)
- Troubleshooting
- RESTful API
- Authentication
- API calls
- How to access the API
- API examples
- Setting up your environment
- A first API call: What deployments are there?
- Create a first Deployment: Elasticsearch and Kibana
- Applying a new plan: Resize and add high availability
- Updating a deployment: Checking on progress
- Applying a new deployment configuration: Upgrade
- Enable more stack features: Add Enterprise Search to a deployment
- Dipping a toe into platform automation: Generate a roles token
- Customize your deployment
- Remove unwanted deployment templates and instance configurations
- Secure your settings
- API reference
- API - Base Url
- APM routes
- Accounts
- App Search - Read-only
- Authentication
- User authentication information
- Disable elevated permissions
- Enable elevated permissions
- Login to ECE
- Logout from ECE
- Refresh authentication token
- Delete API keys
- Get all API keys
- Create API key
- Delete API keys of multiple users
- Get all API keys for all users
- Delete API key
- Get API key
- Available authentication methods
- SAML callback
- Initiate SAML protocol
- Delete API keys for a user
- Get API key metadata for all keys created by the user
- Delete an API key for a user
- Get a user API key
- Billing Costs Analysis
- Get costs overview for the organization. Currently unavailable in self-hosted ECE.
- Get charts for the organization. Currently unavailable in self-hosted ECE.
- Get deployments costs for the organization. Currently unavailable in self-hosted ECE.
- Get charts by deployment. Currently unavailable in self-hosted ECE.
- Get itemized costs by deployments. Currently unavailable in self-hosted ECE.
- Get itemized costs for the organization. Currently unavailable in self-hosted ECE.
- Comments
- Deployment - CRUD
- Deployment - Commands
- Search Deployments
- Migrate Elasticsearch and associated Kibana resources to enable CCR
- Migrate Elasticsearch resource to use ILM
- Migrate Elasticsearch resource to use SLM
- Reset elastic user password
- Restart Deployment Elasticsearch Resource
- Shutdown Deployment Elasticsearch Resource
- Move Elasticsearch resource instances
- Get details about heap dumps for a Deployment
- Start all instances
- Stop all instances
- Start maintenance mode (all instances)
- Stop maintenance mode (all instances)
- Set size overrides
- Start instances
- Stop instances
- Start maintenance mode
- Stop maintenance mode
- Set size overrides
- Capture a new on-demand heap dump for the given instance
- Download the given instance’s heap dump
- Capture a new thread dump for the given instance
- Restart Deployment Stateless Resource
- Shutdown Deployment Stateless Resource
- Upgrade Kibana, APM, Integrations Server, AppSearch, Enterprise Search inside Deployment
- Deployment - Diagnostics
- Deployment - Info
- Deployment - Remote Clusters
- Deployment - Trust
- Deployment - Upgrade Assistant
- Deployment - resync
- Deployment Plan - Activity
- Deployment Resources - CRUD
- Deployment Resources - Proxy
- Deployments - Extensions
- Deployments - Notes
- Deployments - Templates
- Deployments - Traffic Filter - Associations
- Deployments - Traffic Filter - CRUD
- Networking - Deployment Domain Names
- Organizations
- Platform
- Platform - Adminconsoles
- Platform - Allocators
- Get allocators
- Resynchronize allocators
- Search allocators
- Delete allocator
- Get allocator
- Resynchronize allocator
- Move clusters
- Move clusters by type
- Delete allocator logging settings
- Get allocator logging settings
- Update allocator logging settings
- Set allocator logging settings
- Start maintenance mode
- Stop maintenance mode
- Get allocator metadata
- Set allocator metadata
- Delete allocator metadata item
- Set allocator metadata item
- Get allocator settings
- Update allocator settings
- Set allocator settings
- Platform - Configuration - Instances - CRUD
- Platform - Configuration - Security
- Platform - Configuration - Security - Extra Certificates - CRUD
- Platform - Configuration - Security Deployment
- Platform - Configuration - Security Realms
- List security realm configurations
- Reorder security realms
- Create Active Directory configuration
- Delete Active Directory configuration
- Get Active Directory configuration
- Update Active Directory configuration
- Create LDAP configuration
- Delete LDAP configuration
- Get LDAP configuration
- Update LDAP configuration
- Create SAML configuration
- Delete SAML configuration
- Get SAML configuration
- Update SAML configuration
- Platform - Configuration - TLS
- Platform - Configuration - Trust relationships
- Platform - Constructors
- Platform - License
- Platform - Repository - CRUD
- Platform - Runners
- Platform - configuration - Store
- Platform - proxies
- Roles
- Stack - Instance Types - CRUD
- Stack - Versions - CRUD
- Telemetry
- Templates - Deployments - Global
- Users
- Definitions
AbsoluteRefId
AccountResponse
AccountTrustRelationship
AccountTrustSettings
AccountUpdateRequest
ActiveDirectoryGroupSearch
ActiveDirectorySecurityRealmLoadBalance
ActiveDirectorySecurityRealmRoleMappingRule
ActiveDirectorySecurityRealmRoleMappingRules
ActiveDirectorySettings
ActiveDirectoryUserSearch
AdminconsoleInfo
AdminconsolesOverview
AllocatedInstancePlansInfo
AllocatedInstanceStatus
AllocatorBuildInfo
AllocatorCapacity
AllocatorCapacityMemory
AllocatorHealthStatus
AllocatorInfo
AllocatorMoveRequest
AllocatorOverview
AllocatorSettings
AllocatorZoneInfo
AllocatorsSummary
AllocatorsZoneSummary
ApiBaseUrlData
ApiKeyResponse
ApiKeysResponse
Apm
ApmConfiguration
ApmCrudResponse
ApmInfo
ApmPayload
ApmPlan
ApmPlanControlConfiguration
ApmPlanInfo
ApmPlansInfo
ApmResourceInfo
ApmSettings
ApmSubInfo
ApmSystemSettings
ApmTopologyElement
AppSearch
AppSearchConfiguration
AppSearchInfo
AppSearchNodeTypes
AppSearchPayload
AppSearchPlan
AppSearchPlanControlConfiguration
AppSearchPlanInfo
AppSearchPlansInfo
AppSearchResourceInfo
AppSearchSettings
AppSearchSubInfo
AppSearchSystemSettings
AppSearchTopologyElement
AuthenticationInfo
AutodetectStrategyConfig
AvailableAuthenticationMethods
Balance
BasicFailedReply
BasicFailedReplyElement
Blessing
Blessings
BlessingsWithMeta
BoolQuery
CapacityConstraintsResource
CertificateAuthority
CertificateMetaData
ChainStatus
ChangeSourceInfo
ChartItem
ChartItemValue
ChartItems
ClusterCredentials
ClusterCurationSettings
ClusterCurationSpec
ClusterInstanceConfigurationInfo
ClusterInstanceDiskInfo
ClusterInstanceInfo
ClusterInstanceMemoryInfo
ClusterLicenseInfo
ClusterMetadataCpuResourcesSettings
ClusterMetadataInfo
ClusterMetadataPortInfo
ClusterMetadataResourcesSettings
ClusterMetadataSettings
ClusterPlanAttemptError
ClusterPlanStepInfo
ClusterPlanStepLogMessageInfo
ClusterPlanWarning
ClusterSnapshotRepositoryDefault
ClusterSnapshotRepositoryInfo
ClusterSnapshotRepositoryReference
ClusterSnapshotRepositoryStatic
ClusterSnapshotRetention
ClusterSnapshotSettings
ClusterSystemAlert
ClusterTopologyInfo
Comment
CommentCreateRequest
CommentUpdateRequest
CommentWithMeta
CommentsWithMetas
CommonClusterPlanInfo
CompatibleNodeTypesResource
CompatibleVersionResource
ConfigStoreOption
ConfigStoreOptionData
ConfigStoreOptionList
ConstructorHealthStatus
ConstructorInfo
ConstructorOverview
ContainerConfigHostConfig
ContainerSetSummary
ContainerSetsSummary
ContainersEntry
ContainersEntryOptions
ContainersEntryOptionsACL
ContainersEntryOptionsAuth
ContainersEntryOptionsContainerConfig
ContainersEntryOptionsOverrides
CoordinatorSummary
CoordinatorsSummary
Costs
CostsOverview
CreateApiKeyRequest
CreateExtensionRequest
Creates
DeleteApiKeysRequest
DeleteUsersApiKeysRequest
DeploymentCosts
DeploymentCreateMetadata
DeploymentCreateRequest
DeploymentCreateResources
DeploymentCreateResponse
DeploymentCreateSettings
DeploymentDeleteResponse
DeploymentDiagnostics
DeploymentDomainName
DeploymentGetResponse
DeploymentHeapDumps
DeploymentLogging
DeploymentLoggingSettings
DeploymentMetadata
DeploymentMetrics
DeploymentMetricsSettings
DeploymentObservability
DeploymentObservabilitySettings
DeploymentResource
DeploymentResourceCommandResponse
DeploymentResourceCrudResponse
DeploymentResourceUpgradeResponse
DeploymentResources
DeploymentRestoreResponse
DeploymentSearchResponse
DeploymentSettings
DeploymentShutdownResponse
DeploymentTemplateInfoV2
DeploymentTemplateReference
DeploymentTemplateRequestBody
DeploymentUpdateMetadata
DeploymentUpdateRequest
DeploymentUpdateResources
DeploymentUpdateResponse
DeploymentUpdateSettings
DeploymentUpgradeAssistantStatusResponse
DeploymentsCosts
DeploymentsListResponse
DeploymentsListingData
DeploymentsSearchResponse
Dimension
DirectTrustRelationship
DiscreteSizes
DtsDimensionCosts
DtsQuantity
DtsRate
Elasticsearch
ElasticsearchBlockingIssueElement
ElasticsearchBlockingIssues
ElasticsearchClusterBlockingIssueElement
ElasticsearchClusterBlockingIssues
ElasticsearchClusterInfo
ElasticsearchClusterPlan
ElasticsearchClusterPlanInfo
ElasticsearchClusterPlansInfo
ElasticsearchClusterRole
ElasticsearchClusterSecurityInfo
ElasticsearchClusterSettings
ElasticsearchClusterTopologyElement
ElasticsearchClusterTrustSettings
ElasticsearchClusterUser
ElasticsearchConfiguration
ElasticsearchCuration
ElasticsearchDependant
ElasticsearchElasticUserPasswordResetResponse
ElasticsearchInfo
ElasticsearchMasterElement
ElasticsearchMasterInfo
ElasticsearchMonitoringInfo
ElasticsearchNodeType
ElasticsearchPayload
ElasticsearchPlanControlConfiguration
ElasticsearchReplicaElement
ElasticsearchResourceInfo
ElasticsearchScriptTypeSettings
ElasticsearchScriptingUserSettings
ElasticsearchShardElement
ElasticsearchShardsInfo
ElasticsearchShardsStatus
ElasticsearchSystemSettings
ElasticsearchUserBundle
ElasticsearchUserPlugin
ElevatePermissionsRequest
ElevatedPermissions
EmptyResponse
EnableIlmRequest
EnrollmentTokenRequest
EnterpriseSearch
EnterpriseSearchConfiguration
EnterpriseSearchInfo
EnterpriseSearchNodeTypes
EnterpriseSearchPayload
EnterpriseSearchPlan
EnterpriseSearchPlanControlConfiguration
EnterpriseSearchPlanInfo
EnterpriseSearchPlansInfo
EnterpriseSearchResourceInfo
EnterpriseSearchSettings
EnterpriseSearchSubInfo
EnterpriseSearchSystemSettings
EnterpriseSearchTopologyElement
ExistsQuery
Extension
ExtensionFileMetadata
Extensions
ExternalHyperlink
ExternalTrustRelationship
FilterAssociation
GenericResponse
GlobalDeploymentTemplateInfo
GlobalDeploymentTemplateRegion
GrowShrinkStrategyConfig
HeapDump
Hyperlink
IdResponse
IndexPattern
IndexSynchronizationResults
InstanceConfiguration
InstanceConfigurationInfo
InstanceMoveRequest
InstanceOverrides
InstanceTypeResource
IntegrationsServer
IntegrationsServerConfiguration
IntegrationsServerInfo
IntegrationsServerPayload
IntegrationsServerPlan
IntegrationsServerPlanControlConfiguration
IntegrationsServerPlanInfo
IntegrationsServerPlansInfo
IntegrationsServerResourceInfo
IntegrationsServerSettings
IntegrationsServerSystemSettings
IntegrationsServerTopologyElement
ItemCosts
ItemsCosts
KeystoreContents
KeystoreSecret
Kibana
KibanaClusterInfo
KibanaClusterPlan
KibanaClusterPlanInfo
KibanaClusterPlansInfo
KibanaClusterSettings
KibanaClusterTopologyElement
KibanaConfiguration
KibanaDeeplink
KibanaPayload
KibanaPlanControlConfiguration
KibanaResourceInfo
KibanaSubClusterInfo
KibanaSystemSettings
LdapGroupSearch
LdapSecurityRealmLoadBalance
LdapSecurityRealmRoleMappingRule
LdapSecurityRealmRoleMappingRules
LdapSettings
LdapUserSearch
LicenseInfo
LicenseObject
ListEnrollmentTokenElement
ListEnrollmentTokenReply
LoggingSettings
LoginRequest
LoginState
ManagedMonitoringSettings
MatchAllQuery
MatchNoneQuery
MatchQuery
Metadata
MetadataItem
MetadataItemValue
MetadataItems
ModelVersionIndexSynchronizationResults
MoveApmClusterConfiguration
MoveApmClusterDetails
MoveAppSearchConfiguration
MoveAppSearchDetails
MoveClustersCommandResponse
MoveClustersDetails
MoveClustersRequest
MoveElasticsearchClusterConfiguration
MoveElasticsearchClusterDetails
MoveEnterpriseSearchConfiguration
MoveEnterpriseSearchDetails
MoveKibanaClusterConfiguration
MoveKibanaClusterDetails
NestedQuery
NodeTypeResource
Note
Notes
ObservabilityIssue
Organization
OrganizationInvitation
OrganizationInvitationRequest
OrganizationInvitations
OrganizationList
OrganizationMembership
OrganizationMemberships
OrganizationRequest
Orphaned
OrphanedElasticsearch
PendingState
PendingStates
PendingStatesWithMeta
Period
PlanStrategy
PlatformInfo
PlatformResourcesSummary
PlatformServiceImageInfo
PlatformServiceInfo
PortBinding
PrefixQuery
ProxiesAllocationsInfo
ProxiesFilter
ProxiesFilteredGroup
ProxiesFilteredGroupHealth
ProxiesHealth
ProxiesHttpSettings
ProxiesSSOSettings
ProxiesSettings
ProxiesSummary
ProxyAllocationCounts
ProxyAllocationInfo
ProxyInfo
ProxyOverview
ProxySummary
PublicCertChain
PublicCertChainCollection
PublicCertificate
QueryContainer
QueryStringQuery
RangeQuery
ReadOnlyRequest
ReadOnlyResponse
RegionInfo
RemoteResourceInfo
RemoteResourceRef
RemoteResources
ReplyWarning
RepositoryConfig
RepositoryConfigs
RequestEnrollmentTokenReply
ResourceHeapDumps
RestartPolicy
RestoreSnapshotApiConfiguration
RestoreSnapshotConfiguration
RestoreSnapshotRepoConfiguration
Role
RoleAggregate
RoleAggregateCreateData
RoleAggregates
RoleWithMeta
RollingGrowShrinkStrategyConfig
RollingStrategyConfig
RulesetAssociations
RunnerBuildInfo
RunnerContainerInfo
RunnerInfo
RunnerOverview
RunnerRoleInfo
RunnerRolesInfo
RunnersSummary
SamlAttributeSettings
SamlIdpSettings
SamlSecurityRealmRoleMappingRule
SamlSecurityRealmRoleMappingRules
SamlSettings
SamlSpSettings
SearchRequest
SecurityDeployment
SecurityDeploymentCreateRequest
SecurityDeploymentTopology
SecurityDeploymentUpdateRequest
SecurityRealmInfo
SecurityRealmInfoList
SecurityRealmsReorderRequest
ServiceUrl
SimplifiedLineItem
SnapshotRepositoryConfiguration
SnapshotStatusInfo
SsoAuthenticationMethodInfo
StackVersionApmConfig
StackVersionAppSearchConfig
StackVersionArchiveProcessingError
StackVersionArchiveProcessingResult
StackVersionConfig
StackVersionConfigPost
StackVersionConfigs
StackVersionElasticsearchConfig
StackVersionEnterpriseSearchConfig
StackVersionInstanceCapacityConstraint
StackVersionIntegrationsServerConfig
StackVersionKibanaConfig
StackVersionMetadata
StackVersionNodeType
StackVersionTemplateFileHash
StackVersionTemplateInfo
TargetElasticsearchCluster
TelemetryConfig
TelemetryConfigRequest
TermQuery
TlsPublicCertChain
TokenResponse
TopologyElementControl
TopologySize
TrafficFilterEgressRule
TrafficFilterRule
TrafficFilterRulesetInfo
TrafficFilterRulesetRequest
TrafficFilterRulesetResponse
TrafficFilterRulesets
TrafficFilterSettings
TransientApmPlanConfiguration
TransientAppSearchPlanConfiguration
TransientElasticsearchPlanConfiguration
TransientEnterpriseSearchPlanConfiguration
TransientIntegrationsServerPlanConfiguration
TransientKibanaPlanConfiguration
TrustRelationshipCreateRequest
TrustRelationshipCreateResponse
TrustRelationshipGetResponse
TrustRelationshipUpdateRequest
TrustRelationshipUpdateResponse
TrustRelationshipsListResponse
TrustedCertificate
UnreachableRegionInfo
UpdateExtensionRequest
UpdatedTlsChain
Updates
UsageStats
User
UserApiKey
UserList
UserMetadata
UserSecurity
UserSecurityRealm
ZookeeperNodeInfo
ZookeeperSummary
- Changes to index allocation and API
- Script reference
- Glossary
- Release notes
- Elastic Cloud Enterprise 3.3.0
- Elastic Cloud Enterprise 3.2.1
- Elastic Cloud Enterprise 3.2.0
- Elastic Cloud Enterprise 3.1.1
- Elastic Cloud Enterprise 3.1.0
- Elastic Cloud Enterprise 3.0.0
- Elastic Cloud Enterprise 2.13.4
- Elastic Cloud Enterprise 2.13.3
- Elastic Cloud Enterprise 2.13.2
- Elastic Cloud Enterprise 2.13.1
- Elastic Cloud Enterprise 2.13.0
- Elastic Cloud Enterprise 2.12.4
- Elastic Cloud Enterprise 2.12.3
- Elastic Cloud Enterprise 2.12.2
- Elastic Cloud Enterprise 2.12.1
- Elastic Cloud Enterprise 2.12.0
- Elastic Cloud Enterprise 2.11.2
- Elastic Cloud Enterprise 2.11.1
- Elastic Cloud Enterprise 2.11.0
- Elastic Cloud Enterprise 2.10.1
- Elastic Cloud Enterprise 2.10.0
- Elastic Cloud Enterprise 2.9.2
- Elastic Cloud Enterprise 2.9.1
- Elastic Cloud Enterprise 2.9.0
- Elastic Cloud Enterprise 2.8.1
- Elastic Cloud Enterprise 2.8.0
- Elastic Cloud Enterprise 2.7.2
- Elastic Cloud Enterprise 2.7.1
- Elastic Cloud Enterprise 2.7.0
- Elastic Cloud Enterprise 2.6.2
- Elastic Cloud Enterprise 2.6.1
- Elastic Cloud Enterprise 2.6.0
- Elastic Cloud Enterprise 2.5.1
- Elastic Cloud Enterprise 2.5.0
- Elastic Cloud Enterprise 2.4.3
- Elastic Cloud Enterprise 2.4.2
- Elastic Cloud Enterprise 2.4.1
- Elastic Cloud Enterprise 2.4.0
- Elastic Cloud Enterprise 2.3.2
- Elastic Cloud Enterprise 2.3.1
- Elastic Cloud Enterprise 2.3.0
- Elastic Cloud Enterprise 2.2.3
- Elastic Cloud Enterprise 2.2.2
- Elastic Cloud Enterprise 2.2.1
- Elastic Cloud Enterprise 2.2.0
- Elastic Cloud Enterprise 2.1.1
- Elastic Cloud Enterprise 2.1.0
- Elastic Cloud Enterprise 2.0.1
- Elastic Cloud Enterprise 2.0.0
- Elastic Cloud Enterprise 1.1.5
- Elastic Cloud Enterprise 1.1.4
- Elastic Cloud Enterprise 1.1.3
- Elastic Cloud Enterprise 1.1.2
- Elastic Cloud Enterprise 1.1.1
- Elastic Cloud Enterprise 1.1.0
- Elastic Cloud Enterprise 1.0.2
- Elastic Cloud Enterprise 1.0.1
- Elastic Cloud Enterprise 1.0.0
- What’s new with the Elastic Stack
- About this product
Secure your clusters with SAML
editSecure your clusters with SAML
editThese steps show how you can secure your Elasticsearch clusters, Kibana, and Enterprise Search instances in a deployment by using a Security Assertion Markup Language (SAML) identity provider (IdP) for cross-domain, single sign-on authentication.
The SAML credentials are valid against the deployment, not the ECE platform. You can configure role-based access control for the platform separately.
Before you begin
editElastic Cloud Enterprise supports SAML with Elastic Stack version 6.4 and later.
Configure your 8.0 or above cluster to use SAML
editYou must edit your cluster configuration, sometimes also referred to as the deployment plan, to point to the SAML IdP before you can complete the configuration in Kibana. If you are using machine learning or a deployment with hot-warm architecture, you must include this SAML IdP configuration in the user settings section for each node type.
- Create or use an existing deployment that includes a Kibana instance version 6.4 or later.
- Copy the Kibana endpoint URL.
-
Update your Elasticsearch user settings for the
saml
realm and specify your IdP provider configuration:xpack: security: authc: realms: saml: saml-realm-name: order: 2 attributes.principal: "nameid:persistent" attributes.groups: "groups" idp.metadata.path: "<check with your identity provider>" idp.entity_id: "<check with your identity provider>" sp.entity_id: "KIBANA_ENDPOINT_URL/" sp.acs: "KIBANA_ENDPOINT_URL/api/security/saml/callback" sp.logout: "KIBANA_ENDPOINT_URL/logout"
Specifies the authentication realm service.
Defines the SAML realm name. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.
The order of the SAML realm in your authentication chain. Allowed values are between
2
and100
. Set to2
unless you plan on configuring multiple SSO realms for this cluster.Defines the SAML attribute that is going to be mapped to the principal (username) of the authenticated user in Kibana. In this non-normative example,
nameid:persistent
maps theNameID
with theurn:oasis:names:tc:SAML:2.0:nameid-format:persistent
format from the Subject of the SAML Assertion. You can use any SAML attribute that carries the necessary value for your use case in this setting, such asuid
ormail
. Refer to the attribute mapping documentation for details and available options.Defines the SAML attribute used for role mapping when configured in Kibana. Common choices are
groups
orroles
. The values for bothattributes.principal
andattributes.groups
depend on the IdP provider, so be sure to review their documentation. Refer to the attribute mapping documentation for details and available options.The file path or the HTTPS URL where your IdP metadata is available, such as
https://idpurl.com/sso/saml/metadata
. If you configure a URL you need to make ensure that your Elasticsearch cluster can access it.The SAML EntityID of your IdP. This can be read from the configuration page of the IdP, or its SAML metadata, such as
https://idpurl.com/entity_id
.Replace
KIBANA_ENDPOINT_URL
with the one noted in the previous step, such assp.entity_id: https://eddac6b924f5450c91e6ecc6d247b514.us-east-1.aws.found.io:9243/
including the slash at the end. -
By default, users authenticating through SAML have no roles assigned to them. For example, if you want all your users authenticating with SAML to get access to Kibana, issue the following request to Elasticsearch:
-
Alternatively, if you want the users that belong to the group
elasticadmins
in your identity provider to be assigned thesuperuser
role in your Elasticsearch cluster, issue the following request to Elasticsearch:POST /_security/role_mapping/CLOUD_SAML_ELASTICADMIN_TO_SUPERUSER { "enabled": true, "roles": [ "superuser" ], "rules": { "all" : [ { "field": { "realm.name": "saml-realm-name" } }, { "field": { "groups": "elasticadmins" } } ]}, "metadata": { "version": 1 } }
The mapping name.
The Elastic Stack role to map to.
A rule specifying the SAML role to map from.
realm.name
can be any string containing only alphanumeric characters, underscores, and hyphens.In order to use the field
groups
in the mapping rule, you need to have mapped the SAML Attribute that conveys the group membership toattributes.groups
in the previous step. -
Update Kibana in the user settings configuration to use SAML as the authentication provider:
-
If you are using a Kibana instance of version 7.7 or later:
The name of the SAML realm that you have configured earlier, for instance
saml-realm-name
. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the
basic
provider
like this:xpack.security.authc.providers: saml.saml1: order: 0 realm: saml-realm-name description: "Log in with my SAML" basic.basic1: order: 1
This arbitrary string defines how SAML login is titled in the Login Selector UI that is shown when you enable multiple authentication providers in Kibana. If you have a Kibana instance of version 7.8 or later, you can also configure the optional
icon
andhint
settings for any authentication provider. -
If you are using a Kibana instance of version 7.3 - 7.6:
xpack.security.authc.providers: [saml] server.xsrf.whitelist: [/api/security/v1/saml] xpack.security.authc.saml.realm: saml-realm-name
The name of the SAML realm that you have configured earlier, for instance
saml-realm-name
. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens.This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the
basic
provider
by settingxpack.security.authc.providers: [saml, basic]
in the configuration of Kibana. -
If you are using a Kibana instance of version 7.2 or earlier:
xpack.security.authProviders: [saml] server.xsrf.whitelist: [/api/security/v1/saml] xpack.security.public: protocol: https hostname: d1a45bf330b74c248d7cc2e0ead8e159.192.168.44.10.ip.es.io port: 9243
This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the
basic
authProvider
by settingxpack.security.authProviders: [saml, basic]
in the configuration of Kibana.
-
-
Recommended: If you are using Enterprise Search, we recommend you set up SAML 2.0 single sign-on (SSO) for the solution. This allows you to manage access to App Search and Workplace Search for your existing SAML users.
Configure your Enterprise Search user settings with the following parameters:
-
If you are using an Enterprise Search deployment of version 7.14.0 or later:
Check Set up Enterprise Search with SAML 2.0 single sign-on (SSO) in the Enterprise Search documentation. This document covers the Elastic Cloud user settings for Elasticsearch, Kibana, and Enterprise Search. It also explains how to manage access to App Search and Workplace Search for your existing SAML users.
-
If you are using an Enterprise Search deployment of version 7.9.2 or later:
ent_search.auth.saml1.source: elasticsearch-saml ent_search.auth.saml1.order: 1 ent_search.auth.saml1.description: "SAML login" ent_search.auth.saml1.icon: "https://my-company.org/company-logo.png"
The name of the SAML realm that you have configured earlier, for instance
saml-realm-name
. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference anent_search.auth.<auth_name>.source
, you must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for Enterprise Search. To learn more, check Elasticsearch SAML in the App Search documentation.The order in which to display this provider on the login screen.
The name to be displayed on the login screen associated with this provider.
The URL to an icon to be displayed on the login screen associated with this provider.
-
If you are using an Enterprise Search deployment of version 7.9.1 or earlier:
The name of the SAML realm that you have configured earlier, for instance
saml-realm-name
. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference anent_search.auth.name
, you generally must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for Enterprise Search. To learn more, check Elasticsearch SAML in the App Search documentation.
-
-
Optional: If you have an App Search deployment (App Search 7.6 and earlier), you can set it to also use SAML single sign-on authentication. Configure your App Search user settings with the following parameters:
The name of the SAML realm that you have configured earlier, for instance
saml-realm-name
. The SAML realm name can only contain alphanumeric characters, underscores, and hyphens. To reference anapp_search.auth.name
, you generally must create a separate application in your third-party SAML provider first and then set up a new SAML realm in Elasticsearch for App Search. To learn more, check Elasticsearch SAML in the App Search documentation. -
Optional: Generate SAML metadata for the Service Provider.
This endpoint is only available for deployments on version 7.11 or later.
The SAML 2.0 specification provides a mechanism for Service Providers to describe their capabilities and configuration using a metadata file. If your SAML Identity Provider requires or allows you to configure it to trust the Elastic Stack Service Provider through the use of a metadata file, you can generate the SAML metadata by issuing the following request to Elasticsearch:
You can generate the SAML metadata by issuing the API request to Elasticsearch and storing metadata as an XML file using tools like
jq
.The following command, for example, generates the metadata for the SAML realm
saml1
and saves it tometadata.xml
file: -
Optional: If your Identity Provider doesn’t publish its SAML metadata at an HTTP URL, or if your Elasticsearch cluster cannot reach that URL, you can upload the SAML metadata as a file.
-
Prepare a ZIP file with a custom bundle that contains your Identity Provider’s metadata (
metadata.xml
) inside of asaml
folder.This bundle allows all Elasticsearch containers to access the metadata file.
-
Update your Elasticsearch cluster configuration using the advanced configuration editor to use the bundle you prepared in the previous step. You need to modify the
user_bundles
JSON attribute similar to the following example snippet:{ "cluster_name": "REPLACE_WITH_YOUR_CLUSTER_NAME", "plan": { ... "elasticsearch": { "version": "6.4.1", "user_bundles": [ { "name": "saml-metadata", "url": "https://www.MYURL.com/saml-metadata.zip", "elasticsearch_version": "6.4.1" } ] } }
The URLs that point to the ZIP file containing the bundle must be accessible to the deployment. Custom bundles are unzipped under the path
/app/config/BUNDLE_DIRECTORY_STRUCTURE
, whereBUNDLE_DIRECTORY_STRUCTURE
is the directory structure in the ZIP file. Make sure to save the file location where custom bundles get unzipped, as you will need it in the next step.In our example, the SAML metadata file will be located in the path
/app/config/saml/metadata.xml
:$ tree . . └── saml └── metadata.xml
-
Adjust your
saml
realm configuration accordingly:
-
- Use the Kibana endpoint URL to log in.
Configure your 7.x cluster to use SAML
editFor 7.x deployments, the instructions are similar to those for 8.x, but your Elasticsearch request should use POST /_xpack/security/role_mapping/CLOUD_SAML_TO_KIBANA_ADMIN
(for Step 4) or POST /_xpack/xsecurity/role_mapping/CLOUD_SAML_ELASTICADMIN_TO_SUPERUSER
(for Step 5).
All of the other steps are the same.
Configure your 6.x cluster to use SAML
editFor 6.x deployments the configuration is slightly different. For step 3, you must specify the realm name, then define the realm type
using the following example:
For 6.x clusters you must use |
|
For 6.x clusters, you must set the |
All of the other steps are the same.
On this page