Wondering how to configure ElasticSearch LDAP Authentication on the Active Directory? We can help you.

As part of our Server Management Services, we assist our customers with several Windows queries.

Today, let’s see how to authenticate ElasticSearch users using the Active Directory.

Microsoft Windows and LDAP protocol

In this article, let’s see how to authenticate ElasticSearch users using the Active Directory from Microsoft Windows and the LDAP protocol.

To begin, our Support Engineers suggest having:

• Ubuntu 18
• Ubuntu 19
• ElasticSearch 7.6.2
• Windows 2012 R2

In our example, The ElastiSearch server IP address is 192.168.100.7, and the domain controller IP address is 192.168.100.10.

Windows – Domain Controller Firewall

IP – 192.168.100.10
Operacional System – WINDOWS 2012 R2
Hostname – TECH-DC01

• First, we need to create a Firewall rule on the Windows domain controller.
• This firewall rule will allow the ElasticSearch server to query the Active directory.
• On the domain controller, open the application named Windows Firewall with Advanced Security.
• Here, we create a new Inbound firewall rule.
• Select the PORT option.
• Then select the TCP option.
• Select the Specific local ports option.
• Then enter the TCP port 389.
• After that, we select the Allow the connection option.
• Subsequently, check the DOMAIN option.
• Then check the PRIVATE option.
• Similarly, check the PUBLIC option.
• Enter a description of the firewall rule.
• We have created the required firewall rule.
• This rule will allow the ElasticSearch server to query the Active Directory database.

Windows – Domain Account Creation

• Next, we need to create at least 2 accounts on the Active Directory database.
• The ADMIN account will be used to login to the ElasticSearch server as Superuser.
• On the other hand, the BIND account will be to query the Active Directory database.
• On the domain controller, open Active Directory Users and Computers
• Create a new account inside the Users container.
• Then create a new account, admin
• Set the password configured to the ADMIN user as 123qwe..
• This account will be to authenticate on the ElasticSearch.
• Then create a new account, bind
• Set password configured to the BIND user as kamisama123..
• This account will be used by Elasticsearch to query the Active Directory.
• We have created the required Active Directory accounts.

Windows – Domain Group Creation

• Finally, we need to create at least 2 groups on the Active Directory database.
• On the domain controller, we open the application, Active Directory Users, and Computers.
• First, create a new group inside the Users container.
• Then, create a new group, ElasticSearch-Superuser.
• Members of this group will have administrative permission on the ElasticSearch.
• Subsequently, add the admin user as a member of the ElasticSearch-Superuser group.
• Then create a new group named: ElasticSearch-User.
• Members of this group will have user permission on the ElasticSearch server.
• We have created the Active Directory group.

ElasticSearch – LDAP Authentication on Active Directory

To begin, install the required packages.

# apt-get update
# apt-get install curl jq mlocateCopy Code

Verify the license installed on the ElasticSearch server.

# curl -X GET “http://192.168.100.7:9200/_xpack/license”Copy Code

Here is the command output:

{
“license” : {
“status” : “active”,
“uid” : “9f3d50e7-4d3c-47ec-8011-6f6b1d1167c0”,
“type” : “basic”,
“issue_date” : “2020-04-22T00:46:28.831Z”,
“issue_date_in_millis” : 1587516388831,
“max_nodes” : 1000,
“issued_to” : “elasticsearch”,
“issuer” : “elasticsearch”,
“start_date_in_millis” : -1
}
}Copy Code

For example, we have a basic license installed on the ElasticSearch server.

Enable the trial license on the ElasticSearch server.

# curl -X POST “http://192.168.100.7:9200/_license/start_trial?acknowledge=true&pretty”Copy Code

Here is the command output:

{
“acknowledged”: true,
“trial_was_started”: true,
“type”: “trial”
}Copy Code

Then we stop the ElasticSearch service.

# systemctl stop elasticsearchCopy Code

Subsequently, edit the ElasticSearch configuration file, elasticsearch.yml

# vi /etc/elasticsearch/elasticsearch.ymlCopy Code

To do that, we add the following lines at the end of the file.

xpack:
security:
authc:
realms:
ldap:
ldap1:
order: 0
url: “ldap://192.168.100.10:389”
bind_dn: “CN=bind,CN=Users,DC=TECH,DC=LOCAL”
user_search:
base_dn: “DC=TECH,DC=LOCAL”
filter: “(cn={0})”
group_search:
base_dn: “DC=TECH,DC=LOCAL”
files:
role_mapping: “role_mapping.yml”
unmapped_groups_as_roles: falseCopy Code

Here is the original file, before our configuration.

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0
cluster.initial_master_nodes: elasticsearch.localCopy Code

Here is the file with our configuration.

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0
cluster.initial_master_nodes: elasticsearch.local
xpack.security.enabled: true
xpack:
security:
authc:
realms:
ldap:
ldap1:
order: 0
url: “ldap://192.168.100.10:389”
bind_dn: “CN=bind,CN=Users,DC=TECH,DC=LOCAL”
user_search:
base_dn: “DC=TECH,DC=LOCAL”
filter: “(cn={0})”
group_search:
base_dn: “DC=TECH,DC=LOCAL”
files:
role_mapping: “role_mapping.yml”
unmapped_groups_as_roles: falseCopy Code

Then we locate the command named: ELASTICSEARCH-KEYSTORE

udpatedb
locate elasticsearch-keystoreCopy Code

Generally, the ElasticSearch server needs to store the credentials of the Active Directory user named BIND.

# /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.authc.realms.ldap.ldap1.secure_bind_passwordCopy Code

Here, we enter the Active Directory password for the user named BIND.

Similarly, enter value for xpack.security.authc.realms.ldap.ldap1.secure_bind_password:

Then create a configuration file named: role_mapping.yml

# vi /etc/elasticsearch/role_mapping.ymlCopy Code

Here is the file content.

monitoring_user:
– “CN=elasticsearch-user,CN=Users,DC=TECH,DC=LOCAL”
superuser:
– “CN=elasticsearch-superuser,CN=Users,DC=TECH,DC=LOCAL”Copy Code

On the other hand, set the correct file permissions.

# chown root.elasticsearch /etc/elasticsearch/role_mapping.yml
# chmod 660 /etc/elasticsearch/role_mapping.ymlCopy Code

Then, start the ElasticSearch service.

# systemctl start elasticsearchCopy Code

Finally, test the communication with the ElasticSearch server using the Active Directory credentials

# curl –user admin:123qwe.. -X GET “http://192.168.100.7:9200?pretty”Copy Code

Here is the command output:

{
“name” : “elasticsearch.local”,
“cluster_name” : “elasticsearch”,
“cluster_uuid” : “w5CUwsjPQPqW4Ne_04wuRg”,
“version” : {
“number” : “7.6.2”,
“build_flavor” : “default”,
“build_type” : “deb”,
“build_hash” : “ef48eb35cf30adf4db14086e8aabd07ef6fb113f”,
“build_date” : “2020-03-26T06:34:37.794943Z”,
“build_snapshot” : false,
“lucene_version” : “8.4.0”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}Copy Code

[Couldn’t get through the configuration? We’d be happy to assist]

Conclusion

To conclude, we saw how to authenticate ElasticSearch users using the Active Directory from Microsoft Windows and the LDAP protocol. Today, we saw an effective method employed by our Support Engineers.