Native user authentication

ECE ECK Elastic Cloud Hosted Self Managed

The easiest way to manage and authenticate users is with the internal native realm. You can use Elasticsearch REST APIs or Kibana to add and remove users, assign user roles, and manage user passwords.

In self-managed Elasticsearch clusters, you can also reset passwords for users in the native realm using the command line.

The native realm is available and enabled by default. You can disable it explicitly with the following setting.

xpack.security.authc.realms.native.native1:
  enabled: false

You can configure a native realm in the xpack.security.authc.realms.native namespace in elasticsearch.yml. Explicitly configuring a native realm enables you to set the order in which it appears in the realm chain, temporarily disable the realm, and control its cache options.

1. Add a realm configuration to elasticsearch.yml under the xpack.security.authc.realms.native namespace. It is recommended that you explicitly set the order attribute for the realm.

   Note

   You can configure only one native realm on Elasticsearch nodes.

   See Native realm settings for all of the options you can set for the native realm. For example, the following snippet shows a native realm configuration that sets the order to zero so the realm is checked first:

   xpack.security.authc.realms.native.native1:
     order: 0
   

   Note

   To limit exposure to credential theft and mitigate credential compromise, the native realm stores passwords and caches user credentials according to security best practices. By default, a hashed version of user credentials is stored in memory, using a salted sha-256 hash algorithm and a hashed version of passwords is stored on disk salted and hashed with the bcrypt hash algorithm. To use different hash algorithms, see User cache and password hash algorithms.

2. Restart Elasticsearch.

Elastic enables you to easily manage users in Kibana on the Stack Management > Security > Users page. From this page, you can create users, edit users, assign roles to users, and change user passwords. You can also deactivate or delete existing users.

1. Navigate to Stack Management, and under Security, select Users.
2. Click Create user.
3. Give the user a descriptive username, and choose a secure password.
4. Optional: assign roles to the user.
5. Click Create user.

You can manage users through the Elasticsearch user API.

For example, you can change a user's password:

 POST /_security/user/user1/_password {
  "password" : "new-test-password"
}

For more information and examples, see Users.

Self Managed

You can also reset passwords for users in the native realm through the command line using the elasticsearch-reset-password tool.

For example, the following command changes the password for a user with the username user1 to an auto-generated value, and prints the new password to the terminal:

bin/elasticsearch-reset-password -u user1

To explicitly set a password for a user, include the -i parameter with the intended password.

bin/elasticsearch-reset-password -u user1 -i <password>