Users' access to App Search is determined by App Search roles and engine assignments.

You can manage users and their access together within App Search. Or you can manage users outside of App Search and control access through App Search role mappings. App Search provides default mappings, and you can define your own custom mappings.

See Manage users and access to App Search in the App Search documentation.

Users' access to Workplace Search is determined by Workplace Search roles and group assignments.

You can manage users and their access together within Workplace Search. Or you can manage users outside of Workplace Search and control access through Workplace Search role mappings. Workplace Search provides default mappings, and you can define your own custom mappings.

See Manage users and access to Workplace Search in the Workplace Search documentation.

Enterprise Search has management APIs for health, status, and other functions useful to operators.

You manage access to these APIs differently than access to App Search or Workplace Search. Refer to the API reference for each API operation.

See Management APIs.

You can enable RBAC from either App Search or Workplace Search, but once enabled, the setting applies to both products.

If this button is not present, RBAC is already enabled.

Enable RBAC in App Search:

Enable RBAC in Workplace Search:

There are two ways to disable Enterprise Search RBAC:

You can create, invite, list, and modify users directly within App Search. Within App Search, you create users and give them access to App Search at the same time.

See Manage users within App Search in the App Search documentation.

To manage users within App Search, you must enable Enterprise Search role-based access control (RBAC). Enabling this setting also affects the default mappings for App Search and Workplace Search. See Enterprise Search role-based access control (RBAC).

The users you create within App Search are native Elastic users and can be granted access to Elastic features outside of App Search. See Native user authentication in the Elasticsearch documentation.

You can create, invite, list, and modify users directly within Workplace Search. Within Workplace Search, you create users and give them access to Workplace Search at the same time.

See Manage users within Workplace Search in the Workplace Search documentation.

To manage users within Workplace Search, you must enable Enterprise Search role-based access control (RBAC). Enabling this setting also affects the default mappings for Workplace Search and Workplace Search. See Enterprise Search role-based access control (RBAC).

The users you create within Workplace Search are native Elastic users and can be granted access to Elastic features outside of Workplace Search. See Native user authentication in the Elasticsearch documentation.

You may want to manage users outside of App Search and Workplace Search, particularly if you want to permit broad access to Elastic features. This may include access to other Elastic solutions, apps, and features.

Elasticsearch and Kibana provide UI, API, CLI, and file interfaces to manage users for your Elastic deployment. To manage users within these interfaces, refer to the following information in the Elasticsearch documentation:

To give these users access to App Search and Enterprise Search, you must map their Elastic Stack roles or other user attributes to App Search or Workplace Search roles. See the following guides in the App Search and Workplace Search documentation:

You may want to manage users within an external identify provider, particularly if you want to re-use the same users across Elastic deployments or other web applications.

You can configure your Elastic deployment to use any SAML 2.0 Identity Provider service (IdP). The following are examples of these services:

Elastic Cloud is a SAML 2.0 IdP managed by Elastic. Elastic Cloud users can invite additional users to the same organization. All Elastic Cloud users within an organization have the same administrative privileges.

For details, see Inviting members to your organization within the Elastic Cloud documentation.

The Elastic Cloud user is the user who created your Elastic deployment through the Elastic Cloud service.

This user has the Elastic Stack superuser role and therefore has full access to Enterprise Search. See superuser in the Elasticsearch documentation.

To recover this user, see Recover the Elastic Cloud user.

The elastic user is one of the built-in users for the Elastic Stack. See Built-in users in the Elasticsearch documentation.

This user has the Elastic Stack superuser role and therefore has full access to Enterprise Search. See superuser in the Elasticsearch documentation.

To recover this user, see Recover the elastic user.

The enterprise_search user is created when Enterprise Search starts for the first time.

This user is a native Elastic Stack user that you can manage like any other native user. For example, you can delete this user if you prefer to use one of the other default users. See Native user authentication in the Elasticsearch documentation.

The enterprise_search user has the Elastic Stack roles enterprise-search-app-search-owner and enterprise-search-workplace-search-admin. The user therefore has full access to Enterprise Search due to the default role mappings in each product.

The first time Enterprise Search starts, it generates and prints to the screen a random password for this user. Alternatively, you can set the environment variable ENT_SEARCH_DEFAULT_PASSWORD to set an explicit password for this user. You must do this the first time you start Enterprise Search.

For example, to set the password to u7f#o#FY&l4vv?-M^86+8GY?, start Enterprise Search for the first time with this command:

ENT_SEARCH_DEFAULT_PASSWORD='u7f#o#FY&l4vv?-M^86+8GY?' bin/enterprise-search

To recover this user, see Recover the enterprise_search user.

To recover your own user account, use the help text and links provided with the login form. You may need to contact an administrator or operator for your deployment.

As a superuser, you can change the passwords of other users.

Within Kibana, choose Stack Management, then Users. Select a user to change their password.

You can also use the change passwords API endpoint. See Change passwords API in the Elasticsearch documentation.

You must access this API as a superuser or other user with the necessary privileges.

If necessary, create a new superuser using the file-based user realm. See File-based user authentication in the Elasticsearch documentation.

As the Elastic Cloud user, you can recover your own user account. Use the help text and links provided with the Elastic Cloud login form.

The process to recover the elastic user varies by deployment type.

For Elastic Cloud deployments, see Reset the elastic user password in the Elastic Cloud documentation.

For self-managed deployments, recover the user as a superuser.

The process to recover the enterprise_search user varies by deployment type.

For production deployments, recover the user as a superuser.

Within local development environments, you can also reset access to Enterprise Search. See Reset access to Enterprise Search.

You can manage Enterprise Search users using external identity provider services (IdPs), as long as they implement the SAML 2.0 standard for authentication.

For each SAML identity provider you’d like to use, you must complete a one-time setup process. To complete this process, see Using SAML.

You can also configure OpenID Connect providers with Enterprise Search.

See Using OpenID Connect for additional information and examples.

It is possible to configure LDAP authentication with Enterprise Search.

See Using LDAP for additional information and examples.

Configuring Active Directory authentication in Enterprise Search is very similar to LDAP.

See Using Active Directory for additional information and examples.

You can also configure PKI user authentication with Enterprise Search.

See Using PKI for additional information and examples.

Enterprise Search redirects users to Kibana to log in.

Enterprise Search considers Kibana to be the primary management interface when the following configuration is present in enterprise-search.yml:

Kibana may be configured with multiple authentication providers. In this case, you can set a preferred provider for Enterprise Search within the Enterprise Search configuration. Kibana will then prefer this provider when redirecting users to Kibana. Kibana will present the preferred login option rather than ask users to choose from all available providers when logging in.

Configure the preferred provider within enterprise-search.yml by setting kibana.preferred_auth_provider to the name of the authentication provider of your choice from your Kibana configuration.

For example, given the following kibana.yml:

xpack.security.authc.providers:
  basic.basic1:
    order: 0
    icon: "logoElasticsearch"
    hint: "Typically for administrators"
  saml.saml1:
    order: 1
    realm: saml1
    description: "Log in with SSO"
    icon: "https://my-company.xyz/saml-logo.svg"

Set the preferred auth provider to saml1 within enterprise-search.yml:

kibana.preferred_auth_provider: saml1