Create LDAP configuration
- POST /platform/configuration/security/realms/ldap
Creates a new LDAP configuration.
Request
The LDAP configuration
-
idstringrequired -
The identifier for the security realm
-
namestringrequired -
The friendly name of the security realm
-
urlsstringrequired -
The LDAP URLs used to authenticate against, in the format ldap[s]://server:port. Note that ldap and ldaps protocols cannot be mixed together.
-
bind_anonymouslybooleanrequired -
When true, bindDb credentials are ignored
-
group_searchLdapGroupSearch -
The group search configuration for the Elasticsearch security LDAP realm.
-
base_dnstring -
Specifies a container DN to search for groups in which the user has membership
-
scope -
Specifies whether the group search should be sub_tree, one_level or base. one_level only searches objects directly contained within the base_dn. The default sub_tree searches all objects contained under base_dn. base specifies that the base_dn is a group object, and that it is the only group considered.
-
Values:
sub_treeone_levelbase -
filterstring -
Specifies a filter to search for a group. When unspecified, the security realm searches for group, groupOfNames, groupOfUniqueNames, or posixGroup with the attributes member, memberOf, or memberUid. Any instance of {0} in the filter is replaced by the user attribute defined in user_attribute.
-
user_attributestring -
Specifies the user attribute that is fetched and provided as a parameter to the filter. When unspecified, the user DN is passed to the filter.
-
user_searchLdapUserSearch -
The user search configuration for the Elasticsearch security LDAP realm.
-
base_dnstring -
Specifies a container DN to search for users
-
scope -
The scope of the user search. Valid values are sub_tree, one_level, or base. one_level only searches objects directly contained in the base_dn. sub_tree searches all objects contained in base_dn. base specifies that the base_dn is the user object, and that it is the only user considered. Defaults to sub_tree.
-
Values:
sub_treeone_levelbase -
filterstring -
Specifies the filter to search the directory and match an entry with the username provided by the user. Defaults to (uid={0}). {0} is substituted with the username provided when searching.
-
user_dn_templatesstring -
The distinguished name template that replaces the user name with the string {0}. Only used when bind_type is set to 'user_templates'.
-
bind_dnstring -
The distinguished name of the user that is used to bind to the LDAP and perform searches. Only used when bind_type is set to 'user_search'.
-
bind_passwordstring -
The user password that is used to bind to the LDAP server. Only used when bind_type is set to 'user_search'.
-
user_group_attributestring -
Specifies the attribute to examine on the user for group membership. If any 'group_search' settings are specified, this setting is ignored. Defaults to 'memberOf'.
-
load_balanceLdapSecurityRealmLoadBalance -
The load balancing configuration for the Elasticsearch security LDAP realm.
-
certificate_urlstring -
The SSL trusted CA certificate bundle URL. The bundle should be a zip file containing a single keystore file 'keystore.ks' in the directory '/ldap/:id/truststore', where :id is the value of the [id] field.
-
certificate_url_truststore_passwordstring -
The password to the certificate bundle URL truststore
-
certificate_url_truststore_type -
The format of the truststore file. Should be jks to use the Java Keystore format or PKCS12 to use PKCS#12 files. The default is jks.
-
Values:
jksPKCS12 -
role_mappingsLdapSecurityRealmRoleMappingRules -
The role mapping ruleset for the Elasticsearch security LDAP realm.
-
default_rolesstringrequired -
The default roles applied to all users
-
rulesLdapSecurityRealmRoleMappingRulerequired -
The role mapping rules to evaluate
-
enabledboolean -
When true, enables the security realm
-
orderinteger -
The order that the security realm is evaluated
-
override_yamlstring -
Advanced configuration options in YAML format. Any settings defined here will override any configuration set via the API. Note that all keys should omit the 'xpack.security.authc.realms.ldap.{realm_id}' prefix. For example, when the realm ID is set to 'ldap1', the advanced configuration 'xpack.security.authc.realms.ldap.ldap1.ssl.verification_mode: full' should be added as 'ssl.verification_mode: full'.
Responses
The LDAP configuration was successfully created
Response Type: EmptyResponse
Response Headers
-
x-cloud-resource-versionstring The resource version, which is used to avoid update conflicts with concurrent operations
-
x-cloud-resource-createdstring The date-time when the resource was created (ISO format relative to UTC)
-
x-cloud-resource-last-modifiedstring The date-time when the resource was last modified (ISO format relative to UTC)
- The realm id is already in use. (code:
security_realm.id_conflict) - The selected id is not valid. (code:
security_realm.invalid_id) - Order must be greater than zero. (code:
security_realm.invalid_order) - Invalid Elasticsearch Security realm type. (code:
security_realm.invalid_type) - The realm order is already in use. (code:
security_realm.order_conflict) - Advanced YAML format is invalid. (code:
security_realm.invalid_yaml) - The url format is invalid. (code:
security_realm.invalid_url) - Invalid LDAP URL. (code:
security_realm.ldap.invalid_url) - Invalid certificate bundle URL. (code:
security_realm.invalid_bundle_url)
-
errorsBasicFailedReplyElementrequired -
A list of errors that occurred in the failing request
Response Headers
-
x-cloud-error-codes The error codes associated with the response