You can configure Elastic Stack security features to communicate with Active Directory to authenticate users. To integrate with Active Directory, you configure an active_directory realm and map Active Directory users and groups to roles in the role mapping file.

See Configuring an active directory realm.

The security features use LDAP to communicate with Active Directory, so active_directory realms are similar to ldap realms. Like LDAP directories, Active Directory stores users and groups hierarchically. The directory’s hierarchy is built from containers such as the organizational unit (ou), organization (o), and domain controller (dc).

The path to an entry is a Distinguished Name (DN) that uniquely identifies a user or group. User and group names typically have attributes such as a common name (cn) or unique ID (uid). A DN is specified as a string, for example "cn=admin,dc=example,dc=com" (white spaces are ignored).

The security features supports only Active Directory security groups. You cannot map distribution groups to roles.

When you use Active Directory for authentication, the username entered by the user is expected to match the sAMAccountName or userPrincipalName, not the common name.

The Active Directory realm authenticates users using an LDAP bind request. After authenticating the user, the realm then searches to find the user’s entry in Active Directory. Once the user has been found, the Active Directory realm then retrieves the user’s group memberships from the tokenGroups attribute on the user’s entry in Active Directory.