Docs
Elastic Stack Overview [7.0] » Securing the Elastic Stack » User authentication » Kerberos authentication
«  SAML authentication     Integrating with other authentication systems  »

Kerberos authenticationedit

You can configure the Elastic Stack security features to support Kerberos V5 authentication, an industry standard protocol to authenticate users in Elasticsearch.

Note

You cannot use the Kerberos realm to authenticate users in Kibana and on the transport network layer.

To authenticate users with Kerberos, you need to configure a Kerberos realm and map users to roles. For more information on realm settings, see Kerberos realm settings.

Key conceptsedit

There are a few terms and concepts that you’ll encounter when you’re setting up Kerberos realms:

kdc
Key Distribution Center. A service that issues Kerberos tickets.
principal

A Kerberos principal is a unique identity to which Kerberos can assign tickets. It can be used to identify a user or a service provided by a server.

Kerberos V5 principal names are of format primary/instance@REALM, where primary is a user name.

instance is an optional string that qualifies the primary and is separated by a slash(/) from the primary. For a user, usually it is not used; for service hosts, it is the fully qualified domain name of the host.

REALM is the Kerberos realm. Usually it is is the domain name in upper case. An example of a typical user principal is user@ES.DOMAIN.LOCAL. An example of a typical service principal is HTTP/es.domain.local@ES.DOMAIN.LOCAL.

realm
Realms define the administrative boundary within which the authentication server has authority to authenticate users and services.
keytab
A file that stores pairs of principals and encryption keys.
Important

Anyone with read permissions to this file can use the credentials in the network to access other services so it is important to protect it with proper file permissions.

krb5.conf
A file that contains Kerberos configuration information such as the default realm name, the location of Key distribution centers (KDC), realms information, mappings from domain names to Kerberos realms, and default configurations for realm session key encryption types.
ticket granting ticket (TGT)
A TGT is an authentication ticket generated by the Kerberos authentication server. It contains an encrypted authenticator.
«  SAML authentication     Integrating with other authentication systems  »