HTTP/REST clients and security

edit

X-Pack security works with standard HTTP basic authentication headers to authenticate users. Since Elasticsearch is stateless, this header must be sent with every request:

Authorization: Basic <TOKEN> 

The <TOKEN> is computed as base64(USERNAME:PASSWORD)

Client examples

edit

This example uses curl without basic auth to create an index:

curl -XPUT 'localhost:9200/idx'
{
  "error":  "AuthenticationException[Missing authentication token]",
  "status": 401
}

Since no user is associated with the request above, an authentication error is returned. Now we’ll use curl with basic auth to create an index as the rdeniro user:

curl --user rdeniro:taxidriver -XPUT 'localhost:9200/idx'
{
  "acknowledged": true
}

Client Libraries over HTTP

edit

For more information about how to use X-Pack security with the language specific clients please refer to Ruby, Python, Perl, PHP, .NET, Javascript