検索に必要なフィールドを念のために顧客にインデックスしてもらうことはよくあります。コストを削減し、クラスターの強化に専念するための手法をご紹介します。

blog-thumb-website-search.png

Too many fields! 3 ways to prevent mapping explosion in Elasticsearch

フィールドが多すぎる！Elasticsearchのマッピング爆発現象を防止する3つの方法

Learn how easy it is to configure single sign-on for Elastic Cloud Enterprise using Azure AD.

At <a href="https://www.strabag.com/">STRABAG</a>, we are using <a href="/ece">Elastic Cloud Enterprise (ECE)</a> for two main use cases within our on-premises web applications. One to power different kinds of search and a second for operations where we ship more than 25,000 log entries per minute to Elastic from our load balancers. The ECE platform runs in an air-gapped environment, and we would still like to be able to use our corporate logins for the ECE platform.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltc0916d28c71518f4/5ed81483bfd91c2c81be7c1d/blog-strabag-discover.png" data-sys-asset-uid="bltc0916d28c71518f4" alt="Viewing Elasticsearch time series data from Discover in Kibana" style="width: 400;display: block;margin: auto;" width="400"/>Therefore it was a very important task for us to implement a highly secure and identity management-aware authentication for the ECE platform based on Azure AD’s SAML protocol. Read on to see how we did it and how you can do it too in 1-2-3!<h2>Authenticating ECE with Azure AD</h2>Azure AD is commonly used as an identity provider for businesses who use Microsoft Office 365. It enables the customer to create a so called enterprise applications that can provide single sign-on (SSO) functionalities based on SAML or OAuth2.&nbsp;<h3>Step 1: Creating an enterprise application</h3>To get up and running, it is mandatory to create an enterprise application inside the Azure cloud at first. This can be done through the Azure portal. Just head over to the Azure Active Directory management and then use Enterprise applications to create a new application which will be used as an authentication entity for ECE later.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd949b80772718d58/5ed814ebff1cb239b9500ae7/blog-strabag-azure-ad.png" data-sys-asset-uid="bltd949b80772718d58" alt="Azure Active Directory settings" style="display: block;margin: auto;width: 500;" width="500"/> <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt095e39af580624e2/5ed81519c4dd88332f2655af/blog-strabag-enterprise-app.png" data-sys-asset-uid="blt095e39af580624e2" alt="Click on " style="display: block;margin: auto;width: 200;" width="200"/>With a click on New application, a new enterprise application will be created.&nbsp;<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltb763b945697bf55e/5ed8155c08d08473f007a8c5/blog-strabag-new-app.png" data-sys-asset-uid="bltb763b945697bf55e" alt="Create a new application" style="display: block;margin: auto;width: 500;" width="500"/>As we will just use the authentication features of Azure AD enterprise applications, we will create a Non-gallery application. Type in a name for the new application, eg ECE Authentication Application, and press the Add button afterwards. As shown in the screenshot, the application will provide the SAML-based single sign-on feature. This is what we want to achieve.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6d199bc412da720c/5ed81596bf4ae52c761ec8be/blog-strabag-ece-auth-app.png" data-sys-asset-uid="blt6d199bc412da720c" alt="Add your own application" style="display: block;margin: auto;width: 600;" width="600"/>After some seconds, the configuration screen of your application will appear and you can continue to configure the SAML based authentication. Just click Set up single sign on.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blta29f11be57f3b591/5ed815bc97379739c0765f8c/blog-strabag-ece-setup.png" data-sys-asset-uid="blta29f11be57f3b591" alt="Set up single sign-on" style="display: block;margin: auto;width: 600;" width="600"/>You have to configure the SAML authentication properties accordingly to the given defaults and your needs as follows:<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt0a153cd063240aed/5ed815f298e62f38ec84c7eb/blog-strabag-config-user.png" data-sys-asset-uid="blt0a153cd063240aed" alt="Configure single sign-on" style="display: block;margin: auto;width: 600;" width="600"/>After the enterprise application is created, some users need to be assigned. In this configuration, it is assumed that every assigned user is permitted to have administrator access to the ECE platform. The user management can be done with the Users and groups configuration option of the enterprise application. Users can be added with the Add users button.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltec80a0d292db2517/5ed8161e97379739c0765f90/blog-strabag-add-user.png" data-sys-asset-uid="bltec80a0d292db2517" alt="Go to " style="display: block;margin: auto;width: 500;" width="500"/><h3>Step 2: Adding a SAML provider</h3>Next, head over to the ECE platform administration page and navigate to Authentication providers and click the Add provider button.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blteb479fadebb85336/5ed8165dbf4ae52c761ec8c4/blog-strabag-add-provider.png" data-sys-asset-uid="blteb479fadebb85336" alt="Add a provider" style="display: block;margin: auto;"/>Configure the SAML provider to match the settings from the Azure AD enterprise application. It is very important here, that you specify the correct XML schema for the Attribute mapping of the principal and the groups.The schemas you have to use are:<ul><li>Principal attribute: <a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"></a><a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</a></li><li>Group attribute:&nbsp;<a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"></a><a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</a></li></ul>Note: The above schema information is currently undocumented.The SAML attributes are provided by the Azure AD User and Attributes &amp; Claims configuration section (in the screenshot above).<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt8318812a3932d0c8/5ed816b2bf4ae52c761ec8c8/blog-strabag-edit-provider.jpg" data-sys-asset-uid="blt8318812a3932d0c8" alt="Update the SAML provider information" style="display: block;margin: auto;width: 700;" width="700"/><h3>Step 3: Testing the configuration</h3>After you have configured everything you can head over to test the configuration. Microsoft provides an application portal which you can reach via <a href="https://myapps.microsoft.com">https://myapps.microsoft.com</a>.&nbsp;The application will be there as ECE Authentication Application. If you click on it, you will be redirected to the on-premises ECE platform and you will be logged in as the Azure AD authenticated user.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt34db25008b1f1657/5ed816c9bf4ae52c761ec8cc/blog-strabag-azure-apps.png" data-sys-asset-uid="blt34db25008b1f1657" alt="ECE Authentication App in Azure" style="display: block;margin: auto;width: 600;" width="600"/><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt93c7d662821db4db/5ed816f5b275f97304667ddb/blog-strabag-login.png" data-sys-asset-uid="blt93c7d662821db4db" alt="ECE login" style="display: block;margin: auto;width: 500;" width="500"/><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6415a94550246cd0/5ed8170fbfd91c2c81be7c2d/blog-strabag-ece-deployments.png" data-sys-asset-uid="blt6415a94550246cd0" alt="ECE deployments" style="display: block;margin: auto;width: 500;" width="500"/><h2>Conclusion</h2>This configuration allows us to use corporate identities which are managed by Azure AD to log in via single sign-on in a secure and reliable way. As a fallback, you can login into the ECE platform administration anytime by using your admin account and your secret key which was generated during the setup. We hope you find this post helpful.<hr/><h2>About the Authors</h2>Mario Kleinsasser — Cloud Solution Architect Team Leader, STRABAG Manuel Moser — Software Development Department Team Leader, STRABAG Ahil PonArul — Consulting Architect, Elastic Bernhard Rausch — Cloud Solution Architect, STRABAG Stefan Ringhofer — Cloud Solution Architect, STRABAG Ugo Sangiorgi — Principal Consulting Architect, Elastic

blog-banner-generic-blue.png

blog-strabag-thumb-1440x840.png

Integrating Azure single sign-on with ECE in 1-2-3 at STRABAG

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

headshot-ugo-sangiorgi-300x300.png

Principal Competitive Intelligence Manager

Ugo Sangiorgi

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

送信することにより、Elasticの<a href="/jp/legal/elastic-cloud-account-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、上記で提供された連絡先に<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">特定の通知</a>が送信されることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシーポリシー</a>をご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.

GDPR Text + Google Cloud

送信することにより、Elasticの<a href="/jp/legal/elastic-cloud-account-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。このフォームを送信することにより、Elasticが私の連絡先情報をGoogle Cloudに共有することに同意します。また、Elasticが私に食材パッケージを発送する目的で私の情報をベンダーに提供することにも同意します。

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

送信することにより、Elasticの<a href="/jp/legal/serverless-preview-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

送信することにより、<a href="/jp/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud利用規約</a>に同意したものとみなされます。個人情報は<a href="/jp/legal/privacy-statement">Elasticのプライバシーポリシー</a>に基づいて取り扱われます。

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

送信することにより、Elasticの<a href="/jp/legal/terms-of-use" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

このページのコンテンツは、選択された言語ではご利用いただけません。Elasticでは現在、コンテンツをさまざまな言語でご利用いただけるよう取り組んでいます。お使いの言語が準備されるまでお待ちくださるようお願いいたします。

Author

Articles by

Watch now (no PT)

Watch now

See all top stories

すべてのトップストーリーを見る

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Search Integrations

All Solutions

Video for

See when this webinar starts in my time zone

現在のタイムゾーンでこのウェビナー開始時間を見る

Register to Watch

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

他の予定と重なってしまった…という場合も、問題ありません。参加登録されると、録画配信をご利用いただけます。関連コンテンツのご案内もメールでお届けします。

Author

Articles by Ugo Sangiorgi

Principal Competitive Intelligence Manager, Elastic

フィールドが多すぎる！Elasticsearchのマッピング爆発現象を防止する3つの方法

Integrating Azure single sign-on with ECE in 1-2-3 at STRABAG