Integrating with other authentication systems
editIntegrating with other authentication systems
editIf you are using an authentication system that is not supported out-of-the-box by the Elasticsearch security features, you can create a custom realm to interact with it to authenticate users. You implement a custom realm as an SPI loaded security extension as part of an ordinary elasticsearch plugin.
Implementing a custom realm
editSample code that illustrates the structure and implementation of a custom realm is provided in the custom-realm-example repository on GitHub. You can use this code as a starting point for creating your own realm.
To create a custom realm, you need to:
-
Extend
org.elasticsearch.xpack.security.authc.Realm
to communicate with your authentication system to authenticate users. -
Implement the
org.elasticsearch.xpack.security.authc.Realm.Factory
interface in a class that will be used to create the custom realm. -
Extend
org.elasticsearch.xpack.security.authc.DefaultAuthenticationFailureHandler
to handle authentication failures when using your custom realm.
To package your custom realm as a plugin:
-
Implement an extension class for your realm that extends
org.elasticsearch.xpack.core.security.SecurityExtension
. There you need to override one or more of the following methods:@Override public Map<String, Factory> getRealms() { ... }
The
getRealms
method is used to provide a map of type names to theFactory
that will be used to create the realm.@Override public AuthenticationFailureHandler getAuthenticationFailureHandler() { ... }
The
getAuthenticationFailureHandler
method is used to optionally provide a customAuthenticationFailureHandler
, which will control how the Elasticsearch security features respond in certain authentication failure events.@Override public List<String> getSettingsFilter() { ... }
The
Plugin#getSettingsFilter
method returns a list of setting names that should be filtered from the settings APIs as they may contain sensitive credentials. Note this method is not part of theSecurityExtension
interface, it’s available as part of the elasticsearch plugin main class. - Create a build configuration file for the plugin; Gradle is our recommendation.
-
Create a
META-INF/services/org.elasticsearch.xpack.core.security.SecurityExtension
descriptor file for the extension that contains the fully qualified class name of yourorg.elasticsearch.xpack.core.security.SecurityExtension
implementation - Bundle all in a single zip file.
Using a custom realm to authenticate users
editTo use a custom realm:
-
Install the realm extension on each node in the cluster. You run
bin/elasticsearch-plugin
with theinstall
sub-command and specify the URL pointing to the zip file that contains the extension. For example:bin/elasticsearch-plugin install file:///<path>/my-realm-1.0.zip
-
Add a realm configuration of the appropriate realm type to
elasticsearch.yml
under thexpack.security.authc.realms
namespace. You must define your realm within the namespace that matchesto the type defined by the extension. The options you can set depend on the settings exposed by the custom realm. If you are configuring multiple realms, you should also explicitly set theorder
attribute to control the order in which the realms are consulted during authentication. You should make sure each configured realm has a distinctorder
setting. In the event that two or more realms have the sameorder
, they will be processed in realmname
order.When you configure realms in
elasticsearch.yml
, only the realms you specify are used for authentication. If you also want to use thenative
orfile
realms, you must include them in the realm chain. - Restart Elasticsearch.