NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
You can configure Elastic Stack security features to communicate with Active
Directory to authenticate users. To integrate with Active Directory, you
active_directory realm and map Active Directory users and groups
to roles in the role mapping file.
The security features use LDAP to communicate with Active Directory, so
active_directory realms are similar to
ldap realms. Like
LDAP directories, Active Directory stores users and groups hierarchically. The
directory’s hierarchy is built from containers such as the organizational unit
ou), organization (
o), and domain controller (
The path to an entry is a Distinguished Name (DN) that uniquely identifies a
user or group. User and group names typically have attributes such as a
common name (
cn) or unique ID (
uid). A DN is specified as a string, for
"cn=admin,dc=example,dc=com" (white spaces are ignored).
The security features supports only Active Directory security groups. You cannot map distribution groups to roles.
When you use Active Directory for authentication, the username entered by
the user is expected to match the
not the common name.
The Active Directory realm authenticates users using an LDAP bind request. After
authenticating the user, the realm then searches to find the user’s entry in
Active Directory. Once the user has been found, the Active Directory realm then
retrieves the user’s group memberships from the
tokenGroups attribute on the
user’s entry in Active Directory.
load_balance.type setting can be used at the realm level to configure how
the security features should interact with multiple Active Directory servers.
Two modes of operation are supported: failover and load balancing.
When a user is authenticated via an Active Directory realm, the following properties are populated in the user’s metadata:
The distinguished name of the user.
The distinguished name of each of the groups that were resolved for the user (regardless of whether those groups were mapped to a role).
Additional metadata can be extracted from the Active Directory server by configuring
metadata setting on the Active Directory realm.