You do not need to configure any additional settings to use the security features in Kibana. They are enabled by default.
General security settingsedit
true(default) to enable security features.
Do not set this to
false. To disable security features entirely, see Elasticsearch security settings.
If set to
kibana.yml, the login form, user and role management screens, and authorization using Kibana privileges are disabled.
trueto enable audit logging for security events. This is set to
falseby default. For more details see Audit Logging.
User interface security settingsedit
You can configure the following settings in the
Sets the name of the cookie used for the session. The default value is
- An arbitrary string of 32 characters or more that is used to encrypt credentials in a cookie. It is crucial that this key is not exposed to users of Kibana. By default, a value is automatically generated in memory. If you use that default behavior, all sessions are invalidated when Kibana restarts.
secureflag of the session cookie. The default value is
false. It is set to
server.ssl.keyare set. Set this to
trueif SSL is configured outside of Kibana (for example, you are routing requests through a load balancer or proxy).
- Sets the session duration (in milliseconds). By default, sessions stay active until the browser is closed. When this is set to an explicit timeout, closing the browser still requires the user to log back in to Kibana.