Elasticsearch realms exist primarily to support
Some realms authenticate users with a password (such as the
ldap realms), and other realms use
more complex authentication protocols (such as the
In each case, the primary purpose of the realm is to establish the identity of
the user who has made a request to the Elasticsearch API.
However, some Elasticsearch features need to look up a user without using their credentials.
run_asfeature executes requests on behalf of another user. An authenticated user with
run_asprivileges can perform requests on behalf of another unauthenticated user.
- The delegated authorization feature links two realms together so that a user who authenticates against one realm can have the roles and metadata associated with a user from a different realm.
In each of these cases, a user must first authenticate to one realm and then Elasticsearch will query the second realm to find another user. The authenticated user credentials are used to authenticate in the first realm only, The user in the second realm is retrieved by username, without needing credentials.
When Elasticsearch resolves a user using their credentials (as performed in the first realm), it is known as user authentication.
When Elasticsearch resolves a user using the username only (as performed in the second realm), it is known as user lookup.
See the run_as and delegated authorization
documentation to learn more about these features, including which realms and authentication
run_as or delegated authorization.
In both cases, only the following realms can be used for the user lookup:
filerealms always support user lookup.
ldaprealm supports user lookup when the realm is configured in user search mode. User lookup is not support when the realm is configured with
User lookup support in the
active_directoryrealm requires that the realm be configured with a
bind_dnand a bind password.
jwt realms do not support user
If you want to use a realm only for user lookup and prevent users from
authenticating against that realm, you can configure the realm
The user lookup feature is an internal capability that is used to implement the
run-as and delegated authorization features - there are no APIs for user lookup.
If you wish to test your user lookup configuration, then you can do this with
run_as. Use the Authenticate API, authenticate as a
superuser (e.g. the builtin
elastic user) and specify the
es-security-runas-user request header.