- Enterprise Search Guide: other versions:
- Getting started
- Prerequisites
- Ingestion
- Web crawler
- Connectors
- Native connectors
- Connector clients and frameworks
- Workplace Search connectors
- Usage
- Known issues
- Troubleshooting
- Logs
- Security
- Sync rules
- Content extraction
- Reference: Azure Blob Storage
- Reference: Confluence
- Reference: Google Cloud Storage
- Reference: Jira
- Reference: Microsoft SQL
- Reference: MongoDB
- Reference: MySQL
- Reference: Network drive
- Reference: Oracle
- Reference: PostgreSQL
- Reference: S3
- Reference: SharePoint
- Ingestion APIs
- Ingest pipelines
- Document enrichment with ML
- ELSER text expansion
- Indices, engines, content sources
- Programming language clients
- Behavioral analytics
- Search UI
- App Search and Workplace Search
- Search Applications
- Enterprise Search server
- Run using Docker images
- Run using downloads (packages)
- Enterprise Search server known issues
- Troubleshooting
- Troubleshooting setup
- Monitoring
- Read-only mode
- Management APIs
- Monitoring APIs
- Read-only mode API
- Storage API
- Configuration
- Configuring encryption keys
- Configuring a mail service
- Configuring SSL/TLS
- Upgrading and migrating
- Upgrading self-managed deployments
- Upgrading from Enterprise Search 7.x
- Upgrading from Enterprise Search 7.11 and earlier
- Migrating from App Search on Elastic Cloud
- Migrating from App Search on Swiftype.com
- Migrating from self-managed App Search
- Logs and logging
- Known issues
- Troubleshooting
- Help, support, and feedback
- Release notes
- 8.8.2 release notes
- 8.8.1 release notes
- 8.8.0 release notes
- 8.7.1 release notes
- 8.7.0 release notes
- 8.6.2 release notes
- 8.6.1 release notes
- 8.6.0 release notes
- 8.5.3 release notes
- 8.5.2 release notes
- 8.5.1 release notes
- 8.5.0 release notes
- 8.4.3 release notes
- 8.4.2 release notes
- 8.4.1 release notes
- 8.4.0 release notes
- 8.3.3 release notes
- 8.3.2 release notes
- 8.3.1 release notes
- 8.3.0 release notes
- 8.2.3 release notes
- 8.2.2 release notes
- 8.2.1 release notes
- 8.2.0 release notes
- 8.1.3 release notes
- 8.1.2 release notes
- 8.1.1 release notes
- 8.1.0 release notes
- 8.0.1 release notes
- 8.0.0 release notes
- 8.0.0-rc2 release notes
- 8.0.0-rc1 release notes
- 8.0.0-beta1 release notes
- 8.0.0-alpha2 release notes
- 8.0.0-alpha1 release notes
Set up Enterprise Search with LDAP user authentication
editSet up Enterprise Search with LDAP user authentication
edit
This feature is not available for all Elastic subscription levels. Refer to the subscriptions pages for Elastic Cloud and Elastic Stack. To change your subscription level or start a trial, see Elastic subscription.
The following documentation describes the process of configuring Elasticsearch and Kibana:
Within your Enterprise Search configuration settings, make sure that:
-
kibana.host
is set -
kibana.external_url
is set -
any
auth.source
configurations are removed.
Configure Enterprise Search role mappings for LDAP users
editWhen a user is logged in to Enterprise Search in Kibana via LDAP, the following metadata properties would be populated:
-
ldap_dn
: user’s distinguished name -
ldap_groups
: the distinguished name of each of the groups that were resolved for the user.
Based on those metadata fields, it is possible to create role mappings that apply to groups of users. For example, members of the group called Admins might get admin
permissions to Workplace Search:
PUT _security/role_mapping/workplace_search_admin_ldap { "roles": ["enterprise-search-workplace-search-admin"], "rules" : { "field" : { "groups" : "cn=Admins,ou=Groups,dc=example,dc=org" } }, "enabled": true }
While members of the group called Users would get user
permissions:
PUT _security/role_mapping/workplace_search_user_ldap { "roles": ["enterprise-search-workplace-search-user"], "rules" : { "field" : { "groups" : "cn=Users,ou=Groups,dc=example,dc=org" } }, "enabled": true }
Users can also be mapped in Users and Roles in Enterprise Search UI in Kibana:

Mapping can use common Elasticsearch user attributes, such as username
and email
, but also anything provided in metadata
that is returned by a LDAP provider. Here is an example of metadata:
{ "ldap_dn" : "cn=adminuser,dc=example,dc=org", "mail" : "admin.user@example.org", "displayName" : "Enterprise Search Admin User", "ldap_groups" : [ "cn=Admins,ou=Groups,dc=example,dc=org" ], "cn" : "adminuser" }
In Elasticsearch, the LDAP realm that provided this metadata would be configured as follows:
xpack: security: authc: realms: ldap: ldap1: order: 1 url: "ldap://ldap-server.example.org" bind_dn: "cn=admin,dc=example,dc=org" user_search: base_dn: "dc=example,dc=org" filter: "(cn={0})" group_search: base_dn: "ou=Groups,dc=example,dc=org" unmapped_groups_as_roles: false metadata: - cn - mail - displayName
For more information about configuring metadata returned by an LDAP realm, see User metadata in LDAP realms.