The easiest way to manage and authenticate users is with the internal
realm. You can use the REST APIs or Kibana to add and remove users, assign user
roles, and manage user passwords.
The native realm is available by default when no other realms are
configured. If other realm settings have been configured in
you must add the native realm to the realm chain.
You can configure a
native realm in the
Explicitly configuring a native realm enables you to set the order in which it
appears in the realm chain, temporarily disable the realm, and control its
Add a realm configuration to
xpack.security.authc.realms.nativenamespace. It is recommended that you explicitly set the
orderattribute for the realm.
You can configure only one native realm on Elasticsearch nodes.
See Native realm settings for all of the options you can set for the
nativerealm. For example, the following snippet shows a
nativerealm configuration that sets the
orderto zero so the realm is checked first:
xpack: security: authc: realms: native: native1: order: 0
To limit exposure to credential theft and mitigate credential compromise, the native realm stores passwords and caches user credentials according to security best practices. By default, a hashed version of user credentials is stored in memory, using a salted
sha-256hash algorithm and a hashed version of passwords is stored on disk salted and hashed with the
bcrypthash algorithm. To use different hash algorithms, see User cache and password hash algorithms.
- Restart Elasticsearch.
The Elastic Stack security features enable you to easily manage users in Kibana on the Management / Security / Users page.
Alternatively, you can manage users through the
user API. For more
information and examples, see
user management APIs.
To migrate file-based users to the
native realm, use the
Intro to Kibana
ELK for Logs & Metrics