Wondering how to configure ElasticSearch LDAP Authentication on the Active Directory? We can help you.

As part of our Server Management Services, we assist our customers with several Windows queries.

Today, let’s see how to authenticate ElasticSearch users using the Active Directory.

Microsoft Windows and LDAP protocol

In this article, let’s see how to authenticate ElasticSearch users using the Active Directory from Microsoft Windows and the LDAP protocol.

To begin, our Support Engineers suggest having:

• Ubuntu 18
• Ubuntu 19
• ElasticSearch 7.6.2
• Windows 2012 R2

In our example, The ElastiSearch server IP address is 192.168.100.7, and the domain controller IP address is 192.168.100.10.

Windows – Domain Controller Firewall

IP – 192.168.100.10
Operacional System – WINDOWS 2012 R2
Hostname – TECH-DC01

• First, we need to create a Firewall rule on the Windows domain controller.
• This firewall rule will allow the ElasticSearch server to query the Active directory.
• On the domain controller, open the application named Windows Firewall with Advanced Security.
• Here, we create a new Inbound firewall rule.
• Select the PORT option.
• Then select the TCP option.
• Select the Specific local ports option.
• Then enter the TCP port 389.
• After that, we select the Allow the connection option.
• Subsequently, check the DOMAIN option.
• Then check the PRIVATE option.
• Similarly, check the PUBLIC option.
• Enter a description of the firewall rule.
• We have created the required firewall rule.
• This rule will allow the ElasticSearch server to query the Active Directory database.

Windows – Domain Account Creation

• Next, we need to create at least 2 accounts on the Active Directory database.
• The ADMIN account will be used to login to the ElasticSearch server as Superuser.
• On the other hand, the BIND account will be to query the Active Directory database.
• On the domain controller, open Active Directory Users and Computers
• Create a new account inside the Users container.
• Then create a new account, admin
• Set the password configured to the ADMIN user as 123qwe..
• This account will be to authenticate on the ElasticSearch.
• Then create a new account, bind
• Set password configured to the BIND user as kamisama123..
• This account will be used by Elasticsearch to query the Active Directory.
• We have created the required Active Directory accounts.

Windows – Domain Group Creation

• Finally, we need to create at least 2 groups on the Active Directory database.
• On the domain controller, we open the application, Active Directory Users, and Computers.
• First, create a new group inside the Users container.
• Then, create a new group, ElasticSearch-Superuser.
• Members of this group will have administrative permission on the ElasticSearch.
• Subsequently, add the admin user as a member of the ElasticSearch-Superuser group.
• Then create a new group named: ElasticSearch-User.
• Members of this group will have user permission on the ElasticSearch server.
• We have created the Active Directory group.

ElasticSearch – LDAP Authentication on Active Directory

To begin, install the required packages.

# apt-get update
# apt-get install curl jq mlocate

Verify the license installed on the ElasticSearch server.

# curl -X GET “http://192.168.100.7:9200/_xpack/license”

Here is the command output:

{
“license” : {
“status” : “active”,
“uid” : “9f3d50e7-4d3c-47ec-8011-6f6b1d1167c0”,
“type” : “basic”,
“issue_date” : “2020-04-22T00:46:28.831Z”,
“issue_date_in_millis” : 1587516388831,
“max_nodes” : 1000,
“issued_to” : “elasticsearch”,
“issuer” : “elasticsearch”,
“start_date_in_millis” : -1
}
}

For example, we have a basic license installed on the ElasticSearch server.

Enable the trial license on the ElasticSearch server.

# curl -X POST “http://192.168.100.7:9200/_license/start_trial?acknowledge=true&pretty”

Here is the command output:

{
“acknowledged”: true,
“trial_was_started”: true,
“type”: “trial”
}

Then we stop the ElasticSearch service.

# systemctl stop elasticsearch

Subsequently, edit the ElasticSearch configuration file, elasticsearch.yml

# vi /etc/elasticsearch/elasticsearch.yml

To do that, we add the following lines at the end of the file.

xpack:
security:
authc:
realms:
ldap:
ldap1:
order: 0
url: “ldap://192.168.100.10:389”
bind_dn: “CN=bind,CN=Users,DC=TECH,DC=LOCAL”
user_search:
base_dn: “DC=TECH,DC=LOCAL”
filter: “(cn={0})”
group_search:
base_dn: “DC=TECH,DC=LOCAL”
files:
role_mapping: “role_mapping.yml”
unmapped_groups_as_roles: false

Here is the original file, before our configuration.

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0
cluster.initial_master_nodes: elasticsearch.local

Here is the file with our configuration.

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0
cluster.initial_master_nodes: elasticsearch.local
xpack.security.enabled: true
xpack:
security:
authc:
realms:
ldap:
ldap1:
order: 0
url: “ldap://192.168.100.10:389”
bind_dn: “CN=bind,CN=Users,DC=TECH,DC=LOCAL”
user_search:
base_dn: “DC=TECH,DC=LOCAL”
filter: “(cn={0})”
group_search:
base_dn: “DC=TECH,DC=LOCAL”
files:
role_mapping: “role_mapping.yml”
unmapped_groups_as_roles: false

Then we locate the command named: ELASTICSEARCH-KEYSTORE

udpatedb
locate elasticsearch-keystore

Generally, the ElasticSearch server needs to store the credentials of the Active Directory user named BIND.

# /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.authc.realms.ldap.ldap1.secure_bind_password

Here, we enter the Active Directory password for the user named BIND.

Similarly, enter value for xpack.security.authc.realms.ldap.ldap1.secure_bind_password:

Then create a configuration file named: role_mapping.yml

# vi /etc/elasticsearch/role_mapping.yml

Here is the file content.

monitoring_user:
– “CN=elasticsearch-user,CN=Users,DC=TECH,DC=LOCAL”
superuser:
– “CN=elasticsearch-superuser,CN=Users,DC=TECH,DC=LOCAL”

On the other hand, set the correct file permissions.

# chown root.elasticsearch /etc/elasticsearch/role_mapping.yml
# chmod 660 /etc/elasticsearch/role_mapping.yml

Then, start the ElasticSearch service.

# systemctl start elasticsearch

Finally, test the communication with the ElasticSearch server using the Active Directory credentials

# curl –user admin:123qwe.. -X GET “http://192.168.100.7:9200?pretty”

Here is the command output:

{
“name” : “elasticsearch.local”,
“cluster_name” : “elasticsearch”,
“cluster_uuid” : “w5CUwsjPQPqW4Ne_04wuRg”,
“version” : {
“number” : “7.6.2”,
“build_flavor” : “default”,
“build_type” : “deb”,
“build_hash” : “ef48eb35cf30adf4db14086e8aabd07ef6fb113f”,
“build_date” : “2020-03-26T06:34:37.794943Z”,
“build_snapshot” : false,
“lucene_version” : “8.4.0”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}

[Couldn’t get through the configuration? We’d be happy to assist]

Conclusion

To conclude, we saw how to authenticate ElasticSearch users using the Active Directory from Microsoft Windows and the LDAP protocol. Today, we saw an effective method employed by our Support Engineers.