{"id":397,"date":"2020-02-13T10:41:10","date_gmt":"2020-02-13T10:41:10","guid":{"rendered":"https:\/\/www.samarthya.me\/wps\/?p=397"},"modified":"2020-02-13T16:22:36","modified_gmt":"2020-02-13T16:22:36","slug":"authentication-elastic","status":"publish","type":"post","link":"https:\/\/blog.samarthya.me\/wps\/2020\/02\/13\/authentication-elastic\/","title":{"rendered":"Authentication: Elastic"},"content":{"rendered":"

As a software professional, I have been working in the space of IAM, SSO, DRM for quite some time and from my experience I can say, the way Elastic has simplified the integration of external or internal security for access is a treat for fellow developers. It was interesting to experiment with the security settings, and control tenancy.<\/p>\n

In this multi step blog, I will try and capture the concepts first and then do a final integration with a dummy IdP to show case a demo.<\/p>\n

Realms<\/h2>\n

Realms in the context of elastic is a service that provides authentication.<\/p>\n

\n
https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/realms.html<\/a><\/pre>\n<\/blockquote>\n
From the official documentation – A realm<\/em> is used to resolve and authenticate users based on authentication tokens.<\/p>\n
The beauty is the chaining that allows to plug in one ore more such services as a fallback option. A prioritized list of configured realms of different types.<\/p>\n
\n
The priority in the realm chain is always ascending; implying the lowest order is evaluated first.<\/p>\n<\/blockquote>\n
Authentication explained<\/h2>\n
During authentication the incoming request is tried against one realm at a time. Once one of the realms successfully authenticates<\/strong><\/span> the request, the authentication is considered to be successful. The authenticated user is associated with the request, which then proceeds to the authorization<\/strong> phase<\/strong><\/span>.<\/p>\n
If a realm cannot authenticate the request, the next realm in the chain is consulted. If all realms in the chain cannot authenticate the request, the authentication is considered to be unsuccessful and an authentication error is returned.<\/p>\n
\"\"<\/p>\n
Only when the security is enabled<\/h3>\n
When security features (xpack.security.enabled: true<\/strong>) are enabled, depending on the realms you\u2019ve configured the authentication will be evaluated.<\/p>\n
\"\"<\/span><\/p>\n
Internal realms are managed by elastic 
<\/span><\/pre>\n
Types of realms<\/h2>\n
There are two main categories<\/p>\n