|
|
@@ -2,6 +2,10 @@
|
|
|
navigation_title: "Security settings"
|
|
|
mapped_pages:
|
|
|
- https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html
|
|
|
+applies_to:
|
|
|
+ deployment:
|
|
|
+ ess:
|
|
|
+ self:
|
|
|
---
|
|
|
|
|
|
# Security settings in {{es}} [security-settings]
|
|
|
@@ -52,13 +56,13 @@ All of these settings can be added to the `elasticsearch.yml` configuration file
|
|
|
|
|
|
You can configure the following anonymous access settings in `elasticsearch.yml`. For more information, see [Enabling anonymous access](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/anonymous-access.md).
|
|
|
|
|
|
-`xpack.security.authc.anonymous.username`
|
|
|
+`xpack.security.authc.anonymous.username` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The username (principal) of the anonymous user. Defaults to `_es_anonymous_user`.
|
|
|
|
|
|
-`xpack.security.authc.anonymous.roles`
|
|
|
+`xpack.security.authc.anonymous.roles` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The roles to associate with the anonymous user. Required.
|
|
|
|
|
|
-`xpack.security.authc.anonymous.authz_exception`
|
|
|
+`xpack.security.authc.anonymous.authz_exception` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) When `true`, an HTTP 403 response is returned if the anonymous user does not have the appropriate permissions for the requested action. The user is not prompted to provide credentials to access the requested resource. When set to `false`, an HTTP 401 response is returned and the user can provide credentials with the appropriate permissions to gain access. Defaults to `true`.
|
|
|
|
|
|
|
|
|
@@ -167,6 +171,22 @@ xpack:
|
|
|
|
|
|
### Realm settings [realm-settings]
|
|
|
|
|
|
+`xpack.security.authc.realms.saml.*` 
|
|
|
+: To learn more on how to enable SAML and related user settings, check [secure your clusters with SAML](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md).
|
|
|
+
|
|
|
+`xpack.security.authc.realms.oidc.*` 
|
|
|
+: To learn more on how to enable OpenID Connect and related user settings, check [secure your clusters with OpenID Connect](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/openid-connect.md).
|
|
|
+
|
|
|
+`xpack.security.authc.realms.kerberos.*` 
|
|
|
+: To learn more on how to enable Kerberos and relate user settings, check [secure your clusters with Kerberos](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/kerberos.md).
|
|
|
+
|
|
|
+`xpack.security.authc.realms.jwt.*` 
|
|
|
+: To learn more on how to enable JWT and related user settings, check [secure your clusters with JWT](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md).
|
|
|
+
|
|
|
+::::{note}
|
|
|
+All SAML, OpenID Connect, Kerberos, and JWT settings are allowlisted.
|
|
|
+::::
|
|
|
+
|
|
|
You configure realm settings in the `xpack.security.authc.realms` namespace in `elasticsearch.yml`.
|
|
|
|
|
|
For example:
|
|
|
@@ -757,10 +777,10 @@ If `truststore.path` is set, this setting is required.
|
|
|
|
|
|
In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings.
|
|
|
|
|
|
-`idp.entity_id` 
|
|
|
+`idp.entity_id` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Entity ID of the SAML Identity Provider. An Entity ID is a URI with a maximum length of 1024 characters. It can be a URL ([https://idp.example.com/](https://idp.example.com/)) or a URN (`urn:example.com:idp`) and can be found in the configuration or the SAML metadata of the Identity Provider.
|
|
|
|
|
|
-`idp.metadata.path` 
|
|
|
+`idp.metadata.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path *(recommended)* or URL to a SAML 2.0 metadata file describing the capabilities and configuration of the Identity Provider. If a path is provided, then it is resolved relative to the {{es}} config directory. If a URL is provided, then it must be either a `file` URL or a `https` URL.
|
|
|
|
|
|
{{es}} automatically polls this metadata resource and reloads the IdP configuration when changes are detected. File based resources are polled at a frequency determined by the global {{es}} `resource.reload.interval.high` setting, which defaults to 5 seconds. HTTPS resources are polled at a frequency determined by the realm’s `idp.metadata.http.refresh` and `idp.metadata.http.minimum_refresh` settings.
|
|
|
@@ -771,7 +791,7 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings)
|
|
|
`idp.metadata.http.fail_on_error`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) If set to `true`, the realm will fail on startup (and prevent the node from starting) if it attempts to load metadata over HTTPS and that metadata is not available. If set to `false` (the default), the node will start but the affected SAML realm will not support user authentication until the metadata can be successfully loaded. This setting is ignored if metadata is loaded from a file.
|
|
|
|
|
|
-`idp.metadata.http.refresh` 
|
|
|
+`idp.metadata.http.refresh` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the frequency with which `https` metadata is checked for changes. Defaults to `1h` (1 hour).
|
|
|
|
|
|
Under some circumstances {{es}} may determine that the metadata needs to be checked more frequently. This may occur if previous attempts to load the metadata encountered an error, or if the metadata indicates that it is due to expire in less than the configured refresh interval. In these cases {{es}} will poll more often, but never more frequently than `idp.metadata.http.minimum_refresh`. If there is an attempt to authenticate against a realm that has not yet loaded metadata successfully, that realm may attempt to load metadata outside of the configured polling frequency.
|
|
|
@@ -780,73 +800,73 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings)
|
|
|
`idp.metadata.http.minimum_refresh`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the minimum frequency with which `https` metadata is checked for changes. In regular operation {{es}} will use the value of `idp.metadata.http.refresh` as the polling interval. However, under some circumstances {{es}} may determine that it needs to poll more frequently. In these cases, the `minimum_refresh` will set the minimum frequency at which the metdata will be checked. Defaults to `5m` (5 minutes) and must not be set to a value greater than `idp.metadata.http.refresh`
|
|
|
|
|
|
-`idp.use_single_logout` 
|
|
|
+`idp.use_single_logout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Indicates whether to utilise the Identity Provider’s Single Logout service (if one exists in the IdP metadata file). Defaults to `true`.
|
|
|
|
|
|
-`sp.entity_id` 
|
|
|
+`sp.entity_id` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Entity ID to use for this SAML Service Provider. This should be entered as a URI. We recommend that you use the base URL of your Kibana instance. For example, `https://kibana.example.com/`.
|
|
|
|
|
|
-`sp.acs` 
|
|
|
+`sp.acs` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL of the Assertion Consumer Service within {{kib}}. Typically this is the "api/security/saml/callback" endpoint of your Kibana server. For example, `https://kibana.example.com/api/security/saml/callback`.
|
|
|
|
|
|
-`sp.logout` 
|
|
|
+`sp.logout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL of the Single Logout service within {{kib}}. Typically this is the "logout" endpoint of your Kibana server. For example, `https://kibana.example.com/logout`.
|
|
|
|
|
|
-`attributes.principal` 
|
|
|
+`attributes.principal` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s principal (username).
|
|
|
|
|
|
-`attributes.groups` 
|
|
|
+`attributes.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s groups.
|
|
|
|
|
|
-`attributes.name` 
|
|
|
+`attributes.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s full name.
|
|
|
|
|
|
-`attributes.mail` 
|
|
|
+`attributes.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s email address.
|
|
|
|
|
|
-`attributes.dn` 
|
|
|
+`attributes.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Name of the SAML attribute that contains the user’s X.50 *Distinguished Name*.
|
|
|
|
|
|
-`attribute_patterns.principal` 
|
|
|
+`attribute_patterns.principal` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A Java regular expression that is matched against the SAML attribute specified by `attributes.principal` before it is applied to the user’s *principal* property. The attribute value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the "example.com" domain and uses the local-part as the principal.
|
|
|
|
|
|
-`attribute_patterns.groups` 
|
|
|
+`attribute_patterns.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *group* property.
|
|
|
|
|
|
-`attribute_patterns.name` 
|
|
|
+`attribute_patterns.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *name* property.
|
|
|
|
|
|
-`attribute_patterns.mail` 
|
|
|
+`attribute_patterns.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *mail* property.
|
|
|
|
|
|
-`attribute_patterns.dn` 
|
|
|
+`attribute_patterns.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `attribute_patterns.principal`, but for the *dn* property.
|
|
|
|
|
|
-`attribute_delimiters.groups` 
|
|
|
+`attribute_delimiters.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A plain string that is used as a delimiter to split a single-valued SAML attribute specified by `attributes.groups` before it is applied to the user’s *groups* property. For example, splitting the SAML attribute value `engineering,elasticsearch-admins,employees` on a delimiter value of `,` will result in `engineering`, `elasticsearch-admins`, and `employees` as the list of groups for the user. The delimiter will always be split on, regardless of escaping in the input string. This setting does not support multi-valued SAML attributes. It cannot be used together with the `attribute_patterns` setting. You can only configure this setting for the groups attribute.
|
|
|
|
|
|
-`nameid_format` 
|
|
|
+`nameid_format` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The NameID format that should be requested when asking the IdP to authenticate the current user. The default is to not include the `nameid_format` attribute.
|
|
|
|
|
|
-`nameid.allow_create` 
|
|
|
+`nameid.allow_create` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The value of the `AllowCreate` attribute of the `NameIdPolicy` element in an authentication request. The default value is false.
|
|
|
|
|
|
-`nameid.sp_qualifier` 
|
|
|
+`nameid.sp_qualifier` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The value of the `SPNameQualifier` attribute of the `NameIdPolicy` element in an authentication request. The default is to not include the `SPNameQualifier` attribute.
|
|
|
|
|
|
-`force_authn` 
|
|
|
+`force_authn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to set the `ForceAuthn` attribute when requesting that the IdP authenticate the current user. If set to `true`, the IdP is required to verify the user’s identity, irrespective of any existing sessions they might have. Defaults to `false`.
|
|
|
|
|
|
-`populate_user_metadata` 
|
|
|
+`populate_user_metadata` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the SAML attributes. Defaults to `true`.
|
|
|
|
|
|
`authorization_realms`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the SAML realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms).
|
|
|
|
|
|
-`allowed_clock_skew` 
|
|
|
+`allowed_clock_skew` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum amount of skew that can be tolerated between the IdP’s clock and the {{es}} node’s clock. Defaults to `3m` (3 minutes).
|
|
|
|
|
|
-`req_authn_context_class_ref` 
|
|
|
+`req_authn_context_class_ref` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A comma separated list of Authentication Context Class Reference values to be included in the Requested Authentication Context when requesting the IdP to authenticate the current user. The Authentication Context of the corresponding authentication response should contain at least one of the requested values.
|
|
|
|
|
|
For more information, see [Requesting specific authentication methods](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/saml.md#req-authn-context).
|
|
|
@@ -857,31 +877,31 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings)
|
|
|
|
|
|
If a signing key is configured (that is, either `signing.key` or `signing.keystore.path` is set), then {{es}} signs outgoing SAML messages. Signing can be configured using the following settings:
|
|
|
|
|
|
-`signing.saml_messages` 
|
|
|
+`signing.saml_messages` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of SAML message types that should be signed or `*` to sign all messages. Each element in the list should be the local name of a SAML XML Element. Supported element types are `AuthnRequest`, `LogoutRequest` and `LogoutResponse`. Only valid if `signing.key` or `signing.keystore.path` is also specified. Defaults to `*`.
|
|
|
|
|
|
-`signing.key` 
|
|
|
+`signing.key` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded private key to use for SAML message signing. `signing.key` and `signing.keystore.path` cannot be used at the same time.
|
|
|
|
|
|
-`signing.secure_key_passphrase` 
|
|
|
+`signing.secure_key_passphrase` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Specifies the passphrase to decrypt the PEM encoded private key (`signing.key`) if it is encrypted.
|
|
|
|
|
|
-`signing.certificate` 
|
|
|
+`signing.certificate` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded certificate (or certificate chain) that corresponds to the `signing.key`. This certificate must also be included in the Service Provider metadata or manually configured within the IdP to allow for signature validation. This setting can only be used if `signing.key` is set.
|
|
|
|
|
|
-`signing.keystore.path` 
|
|
|
+`signing.keystore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path to the keystore that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `signing.key` at the same time.
|
|
|
|
|
|
-`signing.keystore.type` 
|
|
|
+`signing.keystore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The type of the keystore in `signing.keystore.path`. Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`signing.keystore.alias` 
|
|
|
+`signing.keystore.alias` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the alias of the key within the keystore that should be used for SAML message signing. If the keystore contains more than one private key, this setting must be specified.
|
|
|
|
|
|
-`signing.keystore.secure_password` 
|
|
|
+`signing.keystore.secure_password` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The password to the keystore in `signing.keystore.path`.
|
|
|
|
|
|
-`signing.keystore.secure_key_password` 
|
|
|
+`signing.keystore.secure_key_password` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The password for the key in the keystore (`signing.keystore.path`). Defaults to the keystore password.
|
|
|
|
|
|
|
|
|
@@ -889,22 +909,22 @@ If a signing key is configured (that is, either `signing.key` or `signing.keysto
|
|
|
|
|
|
If an encryption key is configured (that is, either `encryption.key` or `encryption.keystore.path` is set), then {{es}} publishes an encryption certificate when generating metadata and attempts to decrypt incoming SAML content. Encryption can be configured using the following settings:
|
|
|
|
|
|
-`encryption.key` 
|
|
|
+`encryption.key` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded private key to use for SAML message decryption. `encryption.key` and `encryption.keystore.path` cannot be used at the same time.
|
|
|
|
|
|
`encryption.secure_key_passphrase`
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Specifies the passphrase to decrypt the PEM encoded private key (`encryption.key`) if it is encrypted.
|
|
|
|
|
|
-`encryption.certificate` 
|
|
|
+`encryption.certificate` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the PEM encoded certificate (or certificate chain) that is associated with the `encryption.key`. This certificate must also be included in the Service Provider metadata or manually configured within the IdP to enable message encryption. This setting can be used only if `encryption.key` is set.
|
|
|
|
|
|
-`encryption.keystore.path` 
|
|
|
+`encryption.keystore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path to the keystore that contains a private key and certificate. It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `encryption.key` at the same time.
|
|
|
|
|
|
-`encryption.keystore.type` 
|
|
|
+`encryption.keystore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The type of the keystore (`encryption.keystore.path`). Must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or "pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`encryption.keystore.alias` 
|
|
|
+`encryption.keystore.alias` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the alias of the key within the keystore (`encryption.keystore.path`) that should be used for SAML message decryption. If not specified, all compatible key pairs from the keystore are considered as candidate keys for decryption.
|
|
|
|
|
|
`encryption.keystore.secure_password`
|
|
|
@@ -923,13 +943,13 @@ These settings are not used for any purpose other than loading metadata over htt
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.key` 
|
|
|
+`ssl.key` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key.
|
|
|
|
|
|
If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.key_passphrase` 
|
|
|
+`ssl.key_passphrase` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.secure_key_passphrase` at the same time.
|
|
|
@@ -941,28 +961,28 @@ These settings are not used for any purpose other than loading metadata over htt
|
|
|
You cannot use this setting and `ssl.key_passphrase` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.certificate` 
|
|
|
+`ssl.certificate` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key.
|
|
|
|
|
|
This setting can be used only if `ssl.key` is set.
|
|
|
|
|
|
|
|
|
-`ssl.certificate_authorities` 
|
|
|
+`ssl.certificate_authorities` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted.
|
|
|
|
|
|
This setting and `ssl.truststore.path` cannot be used at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.path` 
|
|
|
+`ssl.keystore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate.
|
|
|
|
|
|
It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.type` 
|
|
|
+`ssl.keystore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.keystore.password` 
|
|
|
+`ssl.keystore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead.
|
|
|
|
|
|
`ssl.keystore.secure_password`
|
|
|
@@ -984,16 +1004,16 @@ These settings are not used for any purpose other than loading metadata over htt
|
|
|
|
|
|
You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
|
|
|
-`ssl.truststore.path` 
|
|
|
+`ssl.truststore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file.
|
|
|
|
|
|
You cannot use this setting and `ssl.certificate_authorities` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.truststore.type` 
|
|
|
+`ssl.truststore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.truststore.password` 
|
|
|
+`ssl.truststore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.truststore.secure_password` at the same time.
|
|
|
@@ -1005,7 +1025,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
This setting cannot be used with `ssl.truststore.password`.
|
|
|
|
|
|
|
|
|
-`ssl.verification_mode` 
|
|
|
+`ssl.verification_mode` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates.
|
|
|
|
|
|
::::{dropdown} Valid values
|
|
|
@@ -1029,7 +1049,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
Defaults to `full`.
|
|
|
|
|
|
|
|
|
-`ssl.supported_protocols` 
|
|
|
+`ssl.supported_protocols` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`.
|
|
|
|
|
|
{{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information.
|
|
|
@@ -1039,7 +1059,7 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.cipher_suites` 
|
|
|
+`ssl.cipher_suites` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`.
|
|
|
|
|
|
For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2).
|
|
|
@@ -1050,22 +1070,22 @@ You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
|
|
|
In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings:
|
|
|
|
|
|
-`keytab.path` 
|
|
|
+`keytab.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path to the Kerberos keytab file that contains the service principal used by this {{es}} node. This must be a location within the {{es}} configuration directory and the file must have read permissions. Required.
|
|
|
|
|
|
-`remove_realm_name` 
|
|
|
+`remove_realm_name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to remove the realm part of principal names. Principal names in Kerberos have the form `user/instance@REALM`. If this option is `true`, the realm part (`@REALM`) will not be included in the username. Defaults to `false`.
|
|
|
|
|
|
`krb.debug`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to enable debug logs for the Java login module that provides support for Kerberos authentication. Defaults to `false`.
|
|
|
|
|
|
-`cache.ttl` 
|
|
|
+`cache.ttl` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The time-to-live for cached user entries. A user is cached for this period of time. Specify the time period using the standard {{es}} [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). Defaults to `20m`.
|
|
|
|
|
|
-`cache.max_users` 
|
|
|
+`cache.max_users` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum number of user entries that can live in the cache at any given time. Defaults to 100,000.
|
|
|
|
|
|
-`authorization_realms` 
|
|
|
+`authorization_realms` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the Kerberos realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms).
|
|
|
|
|
|
|
|
|
@@ -1073,22 +1093,22 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings)
|
|
|
|
|
|
In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings.
|
|
|
|
|
|
-`op.issuer` 
|
|
|
+`op.issuer` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A verifiable Identifier for your OpenID Connect Provider. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. The value for this setting should be provided by your OpenID Connect Provider.
|
|
|
|
|
|
-`op.authorization_endpoint` 
|
|
|
+`op.authorization_endpoint` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the Authorization Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider.
|
|
|
|
|
|
-`op.token_endpoint` 
|
|
|
+`op.token_endpoint` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the Token Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider.
|
|
|
|
|
|
-`op.userinfo_endpoint` 
|
|
|
+`op.userinfo_endpoint` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the User Info Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider.
|
|
|
|
|
|
-`op.endsession_endpoint` 
|
|
|
+`op.endsession_endpoint` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The URL for the End Session Endpoint at the OpenID Connect Provider. The value for this setting should be provided by your OpenID Connect Provider.
|
|
|
|
|
|
-`op.jwkset_path` 
|
|
|
+`op.jwkset_path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting))
|
|
|
|
|
|
The file name or URL to a JSON Web Key Set (JWKS) with the public key material used to verify tokens and claims responses signed by the OpenID Connect Provider. A value is considered a file name if it does not begin with `https` or `http`. The file name is resolved relative to the {{es}} configuration directory. Changes to the file are polled at a frequency determined by the global {{es}} `resource.reload.interval.high` setting, which defaults to 5 seconds.
|
|
|
@@ -1098,67 +1118,67 @@ The file name or URL to a JSON Web Key Set (JWKS) with the public key material u
|
|
|
`authorization_realms`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the OpenID Connect realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms).
|
|
|
|
|
|
-`rp.client_id` 
|
|
|
+`rp.client_id` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The OAuth 2.0 Client Identifier that was assigned to {{es}} during registration at the OpenID Connect Provider.
|
|
|
|
|
|
`rp.client_secret`
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The OAuth 2.0 Client Secret that was assigned to {{es}} during registration at the OpenID Connect Provider.
|
|
|
|
|
|
-`rp.client_auth_method` 
|
|
|
+`rp.client_auth_method` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The client authentication method used by {{es}} to authenticate to the OpenID Connect Provider. Can be `client_secret_basic`, `client_secret_post`, or `client_secret_jwt`. Defaults to `client_secret_basic`.
|
|
|
|
|
|
-`rp.client_auth_jwt_signature_algorithm` 
|
|
|
+`rp.client_auth_jwt_signature_algorithm` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The signature algorithm that {{es}} uses to sign the JWT with which it authenticates as a client to the OpenID Connect Provider when `client_secret_jwt` is selected for `rp.client_auth_method`. Can be either `HS256`, `HS384`, or `HS512`. Defaults to `HS384`.
|
|
|
|
|
|
-`rp.redirect_uri` 
|
|
|
+`rp.redirect_uri` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Redirect URI within {{kib}}. If you want to use the authorization code flow, this is the `api/security/oidc/callback` endpoint of your {{kib}} server. If you want to use the implicit flow, it is the `api/security/oidc/implicit` endpoint. For example, `https://kibana.example.com/api/security/oidc/callback`.
|
|
|
|
|
|
-`rp.response_type` 
|
|
|
+`rp.response_type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) OAuth 2.0 Response Type value that determines the authorization processing flow to be used. Can be `code` for authorization code grant flow, or one of `id_token`, `id_token token` for the implicit flow.
|
|
|
|
|
|
-`rp.signature_algorithm` 
|
|
|
+`rp.signature_algorithm` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The signature algorithm that will be used by {{es}} in order to verify the signature of the id tokens it will receive from the OpenID Connect Provider. Allowed values are `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `ES512`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`. Defaults to `RS256`.
|
|
|
|
|
|
-`rp.requested_scopes` 
|
|
|
+`rp.requested_scopes` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The scope values that will be requested by the OpenID Connect Provider as part of the Authentication Request. Optional, defaults to `openid`
|
|
|
|
|
|
-`rp.post_logout_redirect_uri` 
|
|
|
+`rp.post_logout_redirect_uri` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The Redirect URI (usually within {{kib}}) that the OpenID Connect Provider should redirect the browser to after a successful Single Logout.
|
|
|
|
|
|
`claims.principal`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s principal (username).
|
|
|
|
|
|
-`claims.groups` 
|
|
|
+`claims.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s groups.
|
|
|
|
|
|
-`claims.name` 
|
|
|
+`claims.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s full name.
|
|
|
|
|
|
-`claims.mail` 
|
|
|
+`claims.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s email address.
|
|
|
|
|
|
-`claims.dn` 
|
|
|
+`claims.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the OpenID Connect claim that contains the user’s X.509 *Distinguished Name*.
|
|
|
|
|
|
-`claim_patterns.principal` 
|
|
|
+`claim_patterns.principal` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A Java regular expression that is matched against the OpenID Connect claim specified by `claims.principal` before it is applied to the user’s *principal* property. The attribute value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the "example.com" domain and uses the local-part as the principal.
|
|
|
|
|
|
-`claim_patterns.groups` 
|
|
|
+`claim_patterns.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *group* property.
|
|
|
|
|
|
-`claim_patterns.name` 
|
|
|
+`claim_patterns.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *name* property.
|
|
|
|
|
|
-`claim_patterns.mail` 
|
|
|
+`claim_patterns.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *mail* property.
|
|
|
|
|
|
-`claim_patterns.dn` 
|
|
|
+`claim_patterns.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) As per `claim_patterns.principal`, but for the *dn* property.
|
|
|
|
|
|
-`allowed_clock_skew` 
|
|
|
+`allowed_clock_skew` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum allowed clock skew to be taken into consideration when validating id tokens with regards to their creation and expiration times. Defaults to `60s`.
|
|
|
|
|
|
-`populate_user_metadata` 
|
|
|
+`populate_user_metadata` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the OpenID Connect claims. Defaults to `true`.
|
|
|
|
|
|
`http.proxy.host`
|
|
|
@@ -1170,25 +1190,25 @@ The file name or URL to a JSON Web Key Set (JWKS) with the public key material u
|
|
|
`http.proxy.port`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the port of the proxy server that will be used by the http client for all backchannel communication to the OpenID Connect Provider endpoints. Defaults to `80`.
|
|
|
|
|
|
-`http.connect_timeout` 
|
|
|
+`http.connect_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the timeout until a connection is established. A value of zero means the timeout is not used. Defaults to `5s`.
|
|
|
|
|
|
-`http.connection_read_timeout` 
|
|
|
+`http.connection_read_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the timeout used when requesting a connection from the connection manager. Defaults to `5s`
|
|
|
|
|
|
-`http.socket_timeout` 
|
|
|
+`http.socket_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the socket timeout (SO_TIMEOUT) in milliseconds, which is the timeout for waiting for data or, put differently, a maximum period inactivity between two consecutive data packets). Defaults to `5s`.
|
|
|
|
|
|
-`http.max_connections` 
|
|
|
+`http.max_connections` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the maximum number of connections allowed across all endpoints. Defaults to `200`.
|
|
|
|
|
|
-`http.max_endpoint_connections` 
|
|
|
+`http.max_endpoint_connections` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the maximum number of connections allowed per endpoint. Defaults to `200`.
|
|
|
|
|
|
-`http.tcp.keep_alive` 
|
|
|
+`http.tcp.keep_alive` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Whether to enable TCP keepalives on HTTP connections used for back-channel communication to the OpenID Connect Provider endpoints. Defaults to `true`.
|
|
|
|
|
|
-`http.connection_pool_ttl` 
|
|
|
+`http.connection_pool_ttl` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the behavior of the http client used for back-channel communication to the OpenID Connect Provider endpoints. Specifies the time-to-live of connections in the connection pool (default to 3 minutes). A connection is closed if it is idle for more than the specified timeout.
|
|
|
|
|
|
The server can also set the `Keep-Alive` HTTP response header. The effective time-to-live value is the smaller value between this setting and the `Keep-Alive` response header. Configure this setting to `-1` to let the server dictate the value. If the header is not set by the server and the setting has value of `-1`, the time-to-live is infinite and connections never expire.
|
|
|
@@ -1203,13 +1223,13 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.key` 
|
|
|
+`ssl.key` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key.
|
|
|
|
|
|
If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.key_passphrase` 
|
|
|
+`ssl.key_passphrase` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.secure_key_passphrase` at the same time.
|
|
|
@@ -1221,28 +1241,28 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.key_passphrase` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.certificate` 
|
|
|
+`ssl.certificate` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key.
|
|
|
|
|
|
This setting can be used only if `ssl.key` is set.
|
|
|
|
|
|
|
|
|
-`ssl.certificate_authorities` 
|
|
|
+`ssl.certificate_authorities` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted.
|
|
|
|
|
|
This setting and `ssl.truststore.path` cannot be used at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.path` 
|
|
|
+`ssl.keystore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate.
|
|
|
|
|
|
It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.type` 
|
|
|
+`ssl.keystore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.keystore.password` 
|
|
|
+`ssl.keystore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead.
|
|
|
|
|
|
`ssl.keystore.secure_password`
|
|
|
@@ -1265,16 +1285,16 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.truststore.path` 
|
|
|
+`ssl.truststore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file.
|
|
|
|
|
|
You cannot use this setting and `ssl.certificate_authorities` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.truststore.type` 
|
|
|
+`ssl.truststore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.truststore.password` 
|
|
|
+`ssl.truststore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.truststore.secure_password` at the same time.
|
|
|
@@ -1286,7 +1306,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.truststore.password` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.verification_mode` 
|
|
|
+`ssl.verification_mode` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates.
|
|
|
|
|
|
::::{dropdown} Valid values
|
|
|
@@ -1310,7 +1330,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
Defaults to `full`.
|
|
|
|
|
|
|
|
|
-`ssl.supported_protocols` 
|
|
|
+`ssl.supported_protocols` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`.
|
|
|
|
|
|
{{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information.
|
|
|
@@ -1320,7 +1340,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.cipher_suites` 
|
|
|
+`ssl.cipher_suites` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`.
|
|
|
|
|
|
For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2).
|
|
|
@@ -1331,32 +1351,32 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
|
|
|
In addition to the [settings that are valid for all realms](#ref-realm-settings), you can specify the following settings.
|
|
|
|
|
|
-`token_type` 
|
|
|
+`token_type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The token type, `id_token` or `access_token`, that the JWT realm uses to verify incoming JWTs. Defaults to `id_token`.
|
|
|
|
|
|
-`allowed_audiences` 
|
|
|
+`allowed_audiences` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of allowed JWT audiences that {{es}} should verify. {{es}} will only consume JWTs that were intended for any of these audiences, as denoted by the `aud` claim in the JWT). The audiences are compared with exact string matches and do not support wildcards or regex. Examples of `aud` claim are `https://example.com/client1` and `other_service,elasticsearch`. When `token_type` is `access_token`, the audiences can be optionally denoted by a different claim in the JWT if `aud` does not exist. See also [`fallback_claims.aud`](#security-settings-jwt-fallback-claims-aud).
|
|
|
|
|
|
-`allowed_clock_skew` 
|
|
|
+`allowed_clock_skew` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The maximum allowed clock skew to be taken into consideration when validating JWTs with regards to their creation, not before, and expiration times.
|
|
|
|
|
|
-`allowed_issuer` 
|
|
|
+`allowed_issuer` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A verifiable Identifier for your JWT Issuer. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. However, it can be any string. The value for this setting should be provided by your JWT Issuer. The issuer is compared with exact string matches and do not support wildcards or regex. Examples of `iss` claim are `https://example.com:8443/jwt` and `issuer123`.
|
|
|
|
|
|
-`allowed_subjects` 
|
|
|
+`allowed_subjects` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of allowed JWT subjects that {{es}} should verify. {{es}} will only consume JWTs that were issued for any of these subjects, as denoted by the `sub` claim in the JWT. The subjects are compared with exact string matches and do not support wildcards or regex. Examples of `sub` claim are `https://example.com/user1` and `user_1,user2`. When `token_type` is `access_token`, this setting is mandatory and the subject can be optionally denoted by a different claim in the JWT if `sub` does not exist. See also [`fallback_claims.sub`](#security-settings-jwt-fallback-claims-sub).
|
|
|
|
|
|
$$$security-settings-jwt-fallback-claims-sub$$$
|
|
|
|
|
|
-`fallback_claims.sub` 
|
|
|
+`fallback_claims.sub` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The alternative claim to look for the subject information if the `sub` claim does not exist. It is configurable only when the `token_type` is `access_token`. The fallback is applied everywhere the `sub` claim is used.
|
|
|
|
|
|
$$$security-settings-jwt-fallback-claims-aud$$$
|
|
|
|
|
|
-`fallback_claims.aud` 
|
|
|
+`fallback_claims.aud` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The alternative claim to look for the audiences information if the `aud` claim does not exist. It is configurable only when the `token_type` is `access_token`. The fallback is applied everywhere the `aud` claim is used.
|
|
|
|
|
|
-`required_claims` 
|
|
|
+`required_claims` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Additional claims and associated values that {{es}} should verify. This is a group setting that takes key/value pairs, where the key is a string and the value must be either a string or an array of strings. The values are compared with exact string matches and do not support wildcards or regex.
|
|
|
|
|
|
For example:
|
|
|
@@ -1368,34 +1388,34 @@ xpack.security.authc.realms.jwt.jwt1:
|
|
|
versions: ["1.0", "2.0"]
|
|
|
```
|
|
|
|
|
|
-`allowed_signature_algorithms` 
|
|
|
+`allowed_signature_algorithms` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) A list of signature algorithms that will be used by {{es}} in order to verify the signature of the JWT it will receive from the JWT Issuer. Defaults to `RS256`. Examples are `HS512,RS512,ES512` and `ES384`. Allowed values are `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `ES512`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`.
|
|
|
|
|
|
`authorization_realms`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The names of the realms that should be consulted for delegated authorization. If this setting is used, then the JWT realm does not perform role mapping and instead loads the user from the listed realms. See [Delegating authorization to another realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/realm-chains.md#authorization_realms).
|
|
|
|
|
|
-`claims.dn` 
|
|
|
+`claims.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s Distinguished Name (DN), which uniquely identifies a user or group.
|
|
|
|
|
|
-`claim_patterns.dn` 
|
|
|
+`claim_patterns.dn` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `dn` property.
|
|
|
|
|
|
-`claims.groups` 
|
|
|
+`claims.groups` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s groups, such as `groups` and `roles`.
|
|
|
|
|
|
-`claim_patterns.group` 
|
|
|
+`claim_patterns.group` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `group` property.
|
|
|
|
|
|
-`claims.mail` 
|
|
|
+`claims.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s e-mail address.
|
|
|
|
|
|
-`claim_patterns.mail` 
|
|
|
+`claim_patterns.mail` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `mail` property.
|
|
|
|
|
|
-`claims.name` 
|
|
|
+`claims.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The name of the JWT claim that contains the user’s username.
|
|
|
|
|
|
-`claim_patterns.name` 
|
|
|
+`claim_patterns.name` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Accepts the same Java regular expression as [`claim_patterns.principal`](#jwt-claim-pattern-principal), but for the `name` property.
|
|
|
|
|
|
`claims.principal`
|
|
|
@@ -1403,34 +1423,34 @@ xpack.security.authc.realms.jwt.jwt1:
|
|
|
|
|
|
$$$jwt-claim-pattern-principal$$$
|
|
|
|
|
|
-`claim_patterns.principal` 
|
|
|
+`claim_patterns.principal` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) An optional Java regular expression that is matched against the JWT claim specified by `claims.principal` before it is applied to the user’s `principal` property. The value must match the pattern and the value of the first *capturing group* is used as the principal. For example, `^([^@]+)@example\\.com$` matches email addresses from the `example.com` domain and uses the local-part as the principal. Another example is `sub` which may not need a pattern setting.
|
|
|
|
|
|
-`client_authentication.type` 
|
|
|
+`client_authentication.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to use `shared_secret` or `none` to authenticate incoming client requests. If this value is `shared_secret`, the client is authenticated using an HTTP request header that must match a pre-configured secret value. The client must provide this shared secret with every request in the `ES-Client-Authentication` header. If this value is `none`, then the request header `ES-Client-Authentication` is ignored. Defaults to `shared_secret`.
|
|
|
|
|
|
Enabling client authentication is recommended. If JWT bearer tokens are shared with other clients or services, client authentication restricts which ones are allowed to submit those JWTs to {{es}}.
|
|
|
|
|
|
|
|
|
-`client_authentication.shared_secret` 
|
|
|
+`client_authentication.shared_secret` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md), [reloadable](docs-content://deploy-manage/security/secure-settings.md#reloadable-secure-settings)) Secret value string for client authentication. Required if `client_authentication.type` is `shared_secret`.
|
|
|
|
|
|
`client_authentication.rotation_grace_period`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Sets the grace period for how long after rotating the `client_authentication.shared_secret` is valid. `client_authentication.shared_secret` can be rotated by updating the keystore then calling the [reload API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-reload-secure-settings). Defaults to `1m`.
|
|
|
|
|
|
-`http.connect_timeout` 
|
|
|
+`http.connect_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Sets the timeout for the HTTP client that is used for fetching the JSON Web Key Set from a remote URL. A value of zero means the timeout is not used. Defaults to `5s`.
|
|
|
|
|
|
-`http.connection_read_timeout` 
|
|
|
+`http.connection_read_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the HTTP timeout used when requesting a connection from the connection manager. Defaults to `5s`.
|
|
|
|
|
|
-`http.socket_timeout` 
|
|
|
+`http.socket_timeout` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum socket timeout (SO_TIMEOUT) for the HTTP client to wait for inactivity between two consecutive data packets. Defaults to `5s`.
|
|
|
|
|
|
-`http.max_connections` 
|
|
|
+`http.max_connections` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum number of connections allowed across all endpoints.
|
|
|
|
|
|
-`http.max_endpoint_connections` 
|
|
|
+`http.max_endpoint_connections` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the maximum number of connections allowed per endpoint.
|
|
|
|
|
|
`jwt.cache.size`
|
|
|
@@ -1439,16 +1459,16 @@ $$$jwt-claim-pattern-principal$$$
|
|
|
`jwt.cache.ttl`
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the time-to-live for the period of time to cache JWT entries. JWTs can only be cached if client authentication is successful (or disabled). Uses the standard {{es}} [time units](/reference/elasticsearch/rest-apis/api-conventions.md#time-units). If clients use a different JWT for every request, set to `0` to disable the JWT cache. Defaults to `20m`.
|
|
|
|
|
|
-`pkc_jwkset_path` 
|
|
|
+`pkc_jwkset_path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The file name or URL to a JSON Web Key Set (JWKS) with the public key material that the JWT Realm uses for verifying token signatures. A value is considered a file name if it does not begin with `https`. The file name is resolved relative to the {{es}} configuration directory. If a URL is provided, then it must begin with `https://` (`http://` is not supported). {{es}} automatically caches the JWK set and will attempt to refresh the JWK set upon signature verification failure, as this might indicate that the JWT Provider has rotated the signing keys.
|
|
|
|
|
|
-`hmac_jwkset` 
|
|
|
+`hmac_jwkset` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Contents of a JSON Web Key Set (JWKS), including the secret key that the JWT realm uses to verify token signatures. This format supports multiple keys and optional attributes, and is preferred over the `hmac_key` setting. Cannot be used in conjunction with the `hmac_key` setting. Refer to [Configure {{es}} to use a JWT realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md).
|
|
|
|
|
|
-`hmac_key` 
|
|
|
+`hmac_key` 
|
|
|
: ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Contents of a single JSON Web Key (JWK), including the secret key that the JWT realm uses to verify token signatures. This format only supports a single key without attributes, and cannot be used with the `hmac_jwkset` setting. This format is compatible with OIDC. The HMAC key must be a UNICODE string, where the key bytes are the UTF-8 encoding of the UNICODE string. The `hmac_jwkset` setting is preferred. Refer to [Configure {{es}} to use a JWT realm](docs-content://deploy-manage/users-roles/cluster-or-deployment-auth/jwt.md).
|
|
|
|
|
|
-`populate_user_metadata` 
|
|
|
+`populate_user_metadata` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies whether to populate the {{es}} user’s metadata with the values that are provided by the JWT claims. Defaults to `true`.
|
|
|
|
|
|
|
|
|
@@ -1461,13 +1481,13 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.key` 
|
|
|
+`ssl.key` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Path to a PEM encoded file containing the private key.
|
|
|
|
|
|
If HTTP client authentication is required, it uses this file. You cannot use this setting and `ssl.keystore.path` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.key_passphrase` 
|
|
|
+`ssl.key_passphrase` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The passphrase that is used to decrypt the private key. Since the key might not be encrypted, this value is optional. [7.17.0] Prefer `ssl.secure_key_passphrase` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.secure_key_passphrase` at the same time.
|
|
|
@@ -1479,28 +1499,28 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.key_passphrase` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.certificate` 
|
|
|
+`ssl.certificate` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the key.
|
|
|
|
|
|
This setting can be used only if `ssl.key` is set.
|
|
|
|
|
|
|
|
|
-`ssl.certificate_authorities` 
|
|
|
+`ssl.certificate_authorities` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted.
|
|
|
|
|
|
This setting and `ssl.truststore.path` cannot be used at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.path` 
|
|
|
+`ssl.keystore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore file that contains a private key and certificate.
|
|
|
|
|
|
It must be either a Java keystore (jks) or a PKCS#12 file. You cannot use this setting and `ssl.key` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.keystore.type` 
|
|
|
+`ssl.keystore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the keystore file. It must be either `jks` or `PKCS12`. If the keystore path ends in ".p12", ".pfx", or ".pkcs12", this setting defaults to `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.keystore.password` 
|
|
|
+`ssl.keystore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the keystore. [7.17.0] Prefer `ssl.keystore.secure_password` instead.
|
|
|
|
|
|
`ssl.keystore.secure_password`
|
|
|
@@ -1523,16 +1543,16 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.keystore.key_password` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.truststore.path` 
|
|
|
+`ssl.truststore.path` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The path for the keystore that contains the certificates to trust. It must be either a Java keystore (jks) or a PKCS#12 file.
|
|
|
|
|
|
You cannot use this setting and `ssl.certificate_authorities` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.truststore.type` 
|
|
|
+`ssl.truststore.type` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The format of the truststore file. It must be either `jks` or `PKCS12`. If the file name ends in ".p12", ".pfx" or "pkcs12", the default is `PKCS12`. Otherwise, it defaults to `jks`.
|
|
|
|
|
|
-`ssl.truststore.password` 
|
|
|
+`ssl.truststore.password` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) The password for the truststore. [7.17.0] Prefer `ssl.truststore.secure_password` instead.
|
|
|
|
|
|
You cannot use this setting and `ssl.truststore.secure_password` at the same time.
|
|
|
@@ -1544,7 +1564,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
You cannot use this setting and `ssl.truststore.password` at the same time.
|
|
|
|
|
|
|
|
|
-`ssl.verification_mode` 
|
|
|
+`ssl.verification_mode` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Controls the verification of certificates.
|
|
|
|
|
|
::::{dropdown} Valid values
|
|
|
@@ -1568,7 +1588,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
Defaults to `full`.
|
|
|
|
|
|
|
|
|
-`ssl.supported_protocols` 
|
|
|
+`ssl.supported_protocols` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported protocols with versions. Valid protocols: `SSLv2Hello`, `SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. If the JVM’s SSL provider supports TLSv1.3, the default is `TLSv1.3,TLSv1.2,TLSv1.1`. Otherwise, the default is `TLSv1.2,TLSv1.1`.
|
|
|
|
|
|
{{es}} relies on your JDK’s implementation of SSL and TLS. View [Supported SSL/TLS versions by JDK version](docs-content://deploy-manage/security/supported-ssltls-versions-by-jdk-version.md) for more information.
|
|
|
@@ -1578,7 +1598,7 @@ These settings are *only* used for the back-channel communication between {{es}}
|
|
|
::::
|
|
|
|
|
|
|
|
|
-`ssl.cipher_suites` 
|
|
|
+`ssl.cipher_suites` 
|
|
|
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Supported cipher suites vary depending on which version of Java you use. For example, for version 12 the default value is `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`, `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`.
|
|
|
|
|
|
For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2).
|
|
|
@@ -1839,6 +1859,9 @@ You can configure the following TLS/SSL settings.
|
|
|
|
|
|
For more information, see Oracle’s [Java Cryptography Architecture documentation](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.md#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2).
|
|
|
|
|
|
+`xpack.security.transport.ssl.trust_restrictions.x509_fields` 
|
|
|
+: Specifies which field(s) from the TLS certificate is used to match for the restricted trust management that is used for remote clusters connections. This should only be set when a self managed cluster can not create certificates that follow the Elastic Cloud pattern. The default value is ["subjectAltName.otherName.commonName"], the Elastic Cloud pattern. "subjectAltName.dnsName" is also supported and can be configured in addition to or in replacement of the default.
|
|
|
+
|
|
|
|
|
|
### Transport TLS/SSL key and trusted certificate settings [security-transport-tls-ssl-key-trusted-certificate-settings]
|
|
|
|
|
|
@@ -1875,6 +1898,8 @@ When using PEM encoded files, use the following settings:
|
|
|
|
|
|
This setting and `ssl.truststore.path` cannot be used at the same time.
|
|
|
|
|
|
+`xpack.security.loginAssistanceMessage` 
|
|
|
+: Adds a message to the login screen. Useful for displaying corporate messages.
|
|
|
|
|
|
|
|
|
### Java keystore files [_java_keystore_files_3]
|
Charlotte Hoblik