Security settings in Kibana
editSecurity settings in Kibana
editYou do not need to configure any additional settings to use the security features in Kibana. They are enabled by default.
General security settings
edit-
xpack.security.enabled -
By default, Kibana automatically detects whether to enable the security features based on the license and whether Elasticsearch security features are enabled.
Do not set this to
false; it disables the login form, user and role management screens, and authorization using Kibana privileges. To disable security features entirely, see Elasticsearch security settings. -
xpack.security.audit.enabled -
Set to
trueto enable audit logging for security events. By default, it is set tofalse. For more details see Audit Logging.
Authentication security settings
editYou configure the authentication settings in the xpack.security.authc.providers namespace. For more information, refer to Authentication.
-
xpack.security.authc.providers -
Specifies the types of authentication providers.
For example:
xpack.security.authc.providers: [saml, basic, oidc]
-
xpack.security.authc.saml.realm -
When specified in
xpack.security.authc.providers, the SAML realm in Elasticsearch that thesamlprovider should use. -
xpack.security.authc.oidc.realm -
When specified in
xpack.security.authc.providers, the OpenID Connect realm in Elasticsearch that theoidcprovider should use.
User interface security settings
editYou can configure the following settings in the kibana.yml file:
-
xpack.security.cookieName -
Sets the name of the cookie used for the session. The default value is
"sid". -
xpack.security.encryptionKey - An arbitrary string of 32 characters or more that is used to encrypt credentials in a cookie. It is crucial that this key is not exposed to users of Kibana. By default, a value is automatically generated in memory. If you use that default behavior, all sessions are invalidated when Kibana restarts. In addition, high-availability deployments of Kibana will behave unexpectedly if this setting isn’t the same for all instances of Kibana.
-
xpack.security.secureCookies -
Sets the
secureflag of the session cookie. The default value isfalse. It is set totrueifserver.ssl.certificateandserver.ssl.keyare set. Set this totrueif SSL is configured outside of Kibana (for example, you are routing requests through a load balancer or proxy). -
xpack.security.sessionTimeout - Sets the session duration (in milliseconds). By default, sessions stay active until the browser is closed. When this is set to an explicit timeout, closing the browser still requires the user to log back in to Kibana.