maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

[DOCS] Adds principal associated to keytab file (#96498)

Browse source 
* [DOCS] Adds principal associated to keytab file

* Update docs/user/security/authentication/index.asciidoc

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>

* Review comments

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
This commit is contained in:
Kaarina Tungseth 2021-04-08 16:35:59 -05:00 committed by GitHub
parent 65dc108575
commit cf7fdecdfe
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
docs/user/security/authentication/index.asciidoc
View file

@ -292,7 +292,11 @@ xpack.security.authc.providers:
order: 1
-----------------------------------------------
Kibana uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. At the end of the Kerberos handshake, Kibana will forward the service ticket to Elasticsearch. Elasticsearch will unpack it and it will respond with an access and refresh token which are then used for subsequent authentication.
IMPORTANT: {kib} uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications.
At the end of the Kerberos handshake, {kib} forwards the service ticket to {es}, then {es} unpacks the service ticket and responds with an access and refresh token, which are used for subsequent authentication.
On every {es} node that {kib} connects to, the keytab file should always contain the HTTP service principal for the {kib} host.
The HTTP service principal name must have the `HTTP/kibana.domain.local@KIBANA.DOMAIN.LOCAL` format.
[[anonymous-authentication]]
==== Anonymous authentication