Managing Users and Roles

Properly managing users and roles is crucial for securing an Elasticsearch cluster.

Step 1: Define Roles

Roles define specific permissions for users. You can create and manage roles using Kibana or the REST API.

Using Kibana

• Open Kibana and go to Management > Security > Roles.
• Click Create role.
• Define the role name and permissions (e.g., read access to specific indices).

Using the REST API

Create a role using the REST API:

curl -u my_user:mypassword -X PUT "localhost:9200/_security/role/my_role" -H 'Content-Type: application/json' -d'
{
  "cluster": ["all"],
  "indices": [
    {
      "names": ["myindex"],
      "privileges": ["read"]
    }
  ]
}'

Step 2: Assign Roles to Users

Assign the created role to a user using Kibana or the REST API.

Using Kibana

• Open Kibana and go to Management > Security > Users.
• Edit the user and assign the role.

Using the REST API

Assign a role to a user using the REST API:

curl -u my_user:mypassword -X POST "localhost:9200/_security/user/my_user/_roles" -H 'Content-Type: application/json' -d'
{
  "roles": ["my_role"]
}'

Step 3: Authenticate API Requests with Role-Based Permissions

Authenticated API requests will now have access based on the assigned roles.

Example: Querying an Index with Role-Based Permissions

curl -u my_user:mypassword -X GET "localhost:9200/myindex/_search" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match_all": {}
  }
}'

Output

The response will include documents from the myindex index:

{
  "took": 10,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": 1.0,
    "hits": [
      {
        "_index": "myindex",
        "_id": "1",
        "_score": 1.0,
        "_source": {
          "name": "John Doe",
          "age": 30,
          "city": "New York"
        }
      }
    ]
  }
}

Elasticsearch is a powerful distributed search and analytics engine commonly used for logging, monitoring, and data analysis. Security is paramount when dealing with sensitive data, and basic authentication is one of the fundamental methods to ensure that only authorized users can access your Elasticsearch cluster.

This article provides a detailed guide on setting up basic authentication for an Elasticsearch cluster, complete with examples and outputs. The guide is designed to be easy to understand and beginner-friendly.