1 # This is the main Search Guard configuration file where authentication
2 # and authorization is defined.
4 # You need to configure at least one authentication domain in the authc of this file.
5 # An authentication domain is responsible for extracting the user credentials from
6 # the request and for validating them against an authentication backend like Active Directory for example.
8 # If more than one authentication domain is configured the first one which succeeds wins.
9 # If all authentication domains fail then the request is unauthenticated.
10 # In this case an exception is thrown and/or the HTTP status is set to 401.
12 # After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
13 # the roles from a given backend for the authenticated user.
15 # Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both.
17 # transport_enabled: true
19 # 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility.
21 # For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to
22 # find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated.
23 # If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous"
24 # and one role named "sg_anonymous_backendrole".
25 # If you enable anonymous authentication all HTTP authenticators will not challenge.
28 # Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert"
29 # first and the challenging one last.
30 # Because it's not possible to challenge a client with two different authentication methods (for example
31 # Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation
32 # by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request.
34 # Default value of the challenge flag is true.
39 # proxy (not challenging, needs xff)
40 # kerberos (challenging)
41 # clientcert (not challenging, needs https)
42 # jwt (not challenging)
43 # host (not challenging) #DEPRECATED, will be removed in a future version.
44 # host based authentication is configurable in sg_roles_mapping
57 # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
58 # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
59 # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
60 #filtered_alias_mode: warn
63 # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md
64 # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki
65 #multitenancy_enabled: true
66 #server_username: kibanaserver
68 #do_not_fail_on_forbidden: false
70 anonymous_auth_enabled: false
73 internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
74 #internalProxies: '.*' # trust all internal proxies, regex pattern
75 remoteIpHeader: 'x-forwarded-for'
76 proxiesHeader: 'x-forwarded-by'
77 #trustedProxies: '.*' # trust all external proxies, regex pattern
78 ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
79 ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
80 ###### and here https://tools.ietf.org/html/rfc7239
81 ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
85 transport_enabled: false
91 # If true a lot of kerberos/security related debugging output will be logged to standard out
93 # If true then the realm will be stripped from the user name
94 strip_realm_from_principal: true
95 authentication_backend:
97 basic_internal_auth_domain:
99 transport_enabled: true
104 authentication_backend:
108 transport_enabled: false
114 user_header: "x-proxy-user"
115 roles_header: "x-proxy-roles"
116 authentication_backend:
120 transport_enabled: false
126 signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
127 jwt_header: "Authorization"
128 jwt_url_parameter: null
131 authentication_backend:
133 clientcert_auth_domain:
135 transport_enabled: true
140 username_attribute: cn #optional, if omitted DN becomes username
142 authentication_backend:
146 transport_enabled: false
151 authentication_backend:
152 # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
157 # enable start tls, enable_ssl should be false
158 enable_start_tls: false
159 # send client certificate
160 enable_ssl_client_auth: false
161 # verify ldap hostname
162 verify_hostnames: true
167 userbase: 'ou=people,dc=example,dc=com'
168 # Filter to search for users (currently in the whole subtree beneath userbase)
169 # {0} is substituted with the username
170 usersearch: '(sAMAccountName={0})'
171 # Use this attribute from the user as username (if not set then DN is used)
172 username_attribute: null
176 transport_enabled: false
177 authorization_backend:
178 # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
183 # enable start tls, enable_ssl should be false
184 enable_start_tls: false
185 # send client certificate
186 enable_ssl_client_auth: false
187 # verify ldap hostname
188 verify_hostnames: true
193 rolebase: 'ou=groups,dc=example,dc=com'
194 # Filter to search for roles (currently in the whole subtree beneath rolebase)
195 # {0} is substituted with the DN of the user
196 # {1} is substituted with the username
197 # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
198 rolesearch: '(member={0})'
199 # Specify the name of the attribute which value should be substituted with {2} above
200 userroleattribute: null
201 # Roles as an attribute of the user entry
202 userrolename: disabled
203 #userrolename: memberOf
204 # The attribute in a role entry containing the name of that role, Default is "name".
205 # Can also be "dn" to use the full DN as rolename.
207 # Resolve nested roles transitive (roles which are members of other roles and so on ...)
208 resolve_nested_roles: true
209 userbase: 'ou=people,dc=example,dc=com'
210 # Filter to search for users (currently in the whole subtree beneath userbase)
211 # {0} is substituted with the username
212 usersearch: '(uid={0})'
213 # Skip users matching a user name, a wildcard or a regex pattern
215 # - 'cn=Michael Jackson,ou*people,o=TEST'
217 roles_from_another_ldap:
219 authorization_backend:
221 #config goes here ...