Manage users and roles

ECE ECK Elastic Cloud Hosted Self Managed Serverless

To prevent unauthorized access to your Elastic resources, you need a way to identify users and validate that a user is who they claim to be (authentication), and control what data users can access and what tasks they can perform (authorization).

The methods that you use to authenticate users and control access depends on the way Elastic is deployed.

If you’re using Elastic Cloud, then you can perform the following tasks to control access to your Cloud organization, your Cloud Hosted deployments, and your Cloud Serverless projects:

• Invite users to join your organization
• Assign user roles and privileges:
  • Manage organization-level roles and high-level access to deployments and projects.
  • Assign project-level roles and create custom roles. (Serverless only)
• Configure SAML single sign-on for your organization

Elastic Cloud Hosted deployments can also use cluster-level authentication and authorization. Cluster-level auth features are not available for Elastic Cloud Serverless.

Control access to your Elastic Cloud Enterprise orchestrator and deployments.

• Manage passwords for default users

• Manage orchestrator users and roles:

  • Using native users
  • By integrating with external authentication providers:
    • Active Directory
    • LDAP
    • SAML

• Configure single sign-on to deployments for orchestrator users

  Tip

  For Elastic Cloud Enterprise deployments, you can configure SSO at the orchestrator level, the deployment level, or both.

Elastic Cloud Enterprise deployments can also use cluster-level authentication and authorization.

As an extension of the predefined instance access roles offered for Serverless projects, you can create custom roles at the project level to provide more granular control, and provide users with only the access they need within specific projects.

Learn more about custom roles for Elastic Cloud Serverless projects.

Set up authentication and authorization at the cluster or deployment level, and learn about the underlying security technologies that Elasticsearch uses to authenticate and authorize requests internally and across services.

Set up methods to identify users to the Elasticsearch cluster.

Key tasks for managing user authentication include:

• Managing default users
• Managing users natively
• Integrating with external authentication providers

You can also learn the basics of Elasticsearch authentication, learn about accounts used to communicate within an Elasticsearch cluster and across services, and perform advanced tasks.

View all user authentication docs

After a user is authenticated, use role-based access control to determine whether the user behind an incoming request is allowed to execute the request.

Key tasks for managing user authorization include:

• Assigning built-in roles or defining your own
• Mapping users and groups to roles
• Setting up field- and document-level security

You can also learn the basics of Elasticsearch authorization, and perform advanced tasks.

View all user authorization docs