IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« SAML authentication Integrating with other authentication systems »
Elastic Docs ›Elasticsearch Guide [7.3] ›Secure a cluster ›User authentication

Kerberos authentication

edit

Kerberos authentication

edit

You can configure the Elastic Stack security features to support Kerberos V5 authentication, an industry standard protocol to authenticate users in Elasticsearch.

You cannot use the Kerberos realm to authenticate on the transport network layer.

To authenticate users with Kerberos, you need to configure a Kerberos realm and map users to roles. For more information on realm settings, see Kerberos realm settings.

Key concepts

edit

There are a few terms and concepts that you’ll encounter when you’re setting up Kerberos realms:

kdc
Key Distribution Center. A service that issues Kerberos tickets.
principal

A Kerberos principal is a unique identity to which Kerberos can assign tickets. It can be used to identify a user or a service provided by a server.

Kerberos V5 principal names are of format primary/instance@REALM, where primary is a user name.

instance is an optional string that qualifies the primary and is separated by a slash(/) from the primary. For a user, usually it is not used; for service hosts, it is the fully qualified domain name of the host.

REALM is the Kerberos realm. Usually it is is the domain name in upper case. An example of a typical user principal is [email protected]. An example of a typical service principal is HTTP/[email protected].

realm
Realms define the administrative boundary within which the authentication server has authority to authenticate users and services.
keytab
A file that stores pairs of principals and encryption keys.

Anyone with read permissions to this file can use the credentials in the network to access other services so it is important to protect it with proper file permissions.

krb5.conf
A file that contains Kerberos configuration information such as the default realm name, the location of Key distribution centers (KDC), realms information, mappings from domain names to Kerberos realms, and default configurations for realm session key encryption types.
ticket granting ticket (TGT)
A TGT is an authentication ticket generated by the Kerberos authentication server. It contains an encrypted authenticator.
« SAML authentication Integrating with other authentication systems »