b2a2aff75e
Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
247 lines
8.6 KiB
Plaintext
247 lines
8.6 KiB
Plaintext
[role="xpack"]
|
|
[[security-settings-kb]]
|
|
=== Security settings in {kib}
|
|
++++
|
|
<titleabbrev>Security settings</titleabbrev>
|
|
++++
|
|
|
|
You do not need to configure any additional settings to use the
|
|
{security-features} in {kib}. They are enabled by default.
|
|
|
|
[float]
|
|
[[general-security-settings]]
|
|
==== General security settings
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.enabled`
|
|
| By default, {kib} automatically detects whether to enable the
|
|
{security-features} based on the license and whether {es} {security-features}
|
|
are enabled. +
|
|
+
|
|
Do not set this to `false`; it disables the login form, user and role management
|
|
screens, and authorization using <<kibana-privileges>>. To disable
|
|
{security-features} entirely, see
|
|
{ref}/security-settings.html[{es} security settings].
|
|
|
|
| `xpack.security.audit.enabled`
|
|
| Set to `true` to enable audit logging for security events. By default, it is set
|
|
to `false`. For more details see <<xpack-security-audit-logging>>.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[authentication-security-settings]]
|
|
==== Authentication security settings
|
|
|
|
You configure authentication settings in the `xpack.security.authc` namespace in `kibana.yml`.
|
|
|
|
For example:
|
|
|
|
[source,yaml]
|
|
----------------------------------------
|
|
xpack.security.authc:
|
|
providers:
|
|
basic.basic1: <1>
|
|
order: 0 <2>
|
|
...
|
|
|
|
saml.saml1: <3>
|
|
order: 1
|
|
...
|
|
|
|
saml.saml2: <4>
|
|
order: 2
|
|
...
|
|
|
|
pki.realm3:
|
|
order: 3
|
|
...
|
|
...
|
|
----------------------------------------
|
|
<1> Specifies the type of authentication provider (for example, `basic`, `token`, `saml`, `oidc`, `kerberos`, `pki`) and the provider name. This setting is mandatory.
|
|
<2> Specifies the order of the provider in the authentication chain and on the Login Selector UI. This setting is mandatory.
|
|
<3> Specifies the settings for the SAML authentication provider with a `saml1` name.
|
|
<4> Specifies the settings for the SAML authentication provider with a `saml2` name.
|
|
|
|
The valid settings in the `xpack.security.authc.providers` namespace vary depending on the authentication provider type. For more information, refer to <<kibana-authentication>>.
|
|
|
|
[float]
|
|
[[authentication-provider-settings]]
|
|
===== Valid settings for all authentication providers
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.enabled`
|
|
| Determines if the authentication provider should be enabled. By default, {kib} enables the provider as soon as you configure any of its properties.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.order`
|
|
| Order of the provider in the authentication chain and on the Login Selector UI.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.description`
|
|
| Custom description of the provider entry displayed on the Login Selector UI.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.hint`
|
|
| Custom hint for the provider entry displayed on the Login Selector UI.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.icon`
|
|
| Custom icon for the provider entry displayed on the Login Selector UI.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.showInSelector`
|
|
| Flag that indicates if the provider should have an entry on the Login Selector UI. Setting this to `false` doesn't remove the provider from the authentication chain.
|
|
|
|
|===
|
|
|
|
[NOTE]
|
|
============
|
|
You are unable to set this setting to `false` for `basic` and `token` authentication providers.
|
|
============
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`<provider-type>.<provider-name>.accessAgreement.message`
|
|
| Access agreement text in Markdown format. For more information, refer to <<xpack-security-access-agreement>>.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[saml-authentication-provider-settings]]
|
|
===== SAML authentication provider settings
|
|
|
|
In addition to <<authentication-provider-settings,the settings that are valid for all providers>>, you can specify the following settings:
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.authc.providers.`
|
|
`saml.<provider-name>.realm`
|
|
| SAML realm in {es} that provider should use.
|
|
|
|
| `xpack.security.authc.providers.`
|
|
`saml.<provider-name>.maxRedirectURLSize`
|
|
| The maximum size of the URL that {kib} is allowed to store during the authentication SAML handshake. For more information, refer to <<security-saml-and-long-urls>>.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[oidc-authentication-provider-settings]]
|
|
===== OpenID Connect authentication provider settings
|
|
|
|
In addition to <<authentication-provider-settings,the settings that are valid for all providers>>, you can specify the following settings:
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.authc.providers.`
|
|
`oidc.<provider-name>.realm`
|
|
| OpenID Connect realm in {es} that the provider should use.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[http-authentication-settings]]
|
|
===== HTTP authentication settings
|
|
|
|
There is a very limited set of cases when you'd want to change these settings. For more information, refer to <<http-authentication>>.
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.authc.http.enabled`
|
|
| Determines if HTTP authentication should be enabled. By default, this setting is set to `true`.
|
|
|
|
| `xpack.security.authc.http.autoSchemesEnabled`
|
|
| Determines if HTTP authentication schemes used by the enabled authentication providers should be automatically supported during HTTP authentication. By default, this setting is set to `true`.
|
|
|
|
| `xpack.security.authc.http.schemes`
|
|
| List of HTTP authentication schemes that {kib} HTTP authentication should support. By default, this setting is set to `['apikey']` to support HTTP authentication with <<api-keys, `ApiKey`>> scheme.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[login-selector-settings]]
|
|
===== Login Selector UI settings
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.authc.selector.enabled`
|
|
| Determines if the Login Selector UI should be enabled. By default, this setting is set to `true` if more than one authentication provider is configured.
|
|
|
|
|===
|
|
|
|
[float]
|
|
[[security-ui-settings]]
|
|
==== User interface security settings
|
|
|
|
You can configure the following settings in the `kibana.yml` file.
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
| `xpack.security.cookieName`
|
|
| Sets the name of the cookie used for the session. The default value is `"sid"`.
|
|
|
|
| `xpack.security.encryptionKey`
|
|
| An arbitrary string of 32 characters or more that is used to encrypt credentials
|
|
in a cookie. It is crucial that this key is not exposed to users of {kib}. By
|
|
default, a value is automatically generated in memory. If you use that default
|
|
behavior, all sessions are invalidated when {kib} restarts.
|
|
In addition, high-availability deployments of {kib} will behave unexpectedly
|
|
if this setting isn't the same for all instances of {kib}.
|
|
|
|
| `xpack.security.secureCookies`
|
|
| Sets the `secure` flag of the session cookie. The default value is `false`. It
|
|
is automatically set to `true` if `server.ssl.enabled` is set to `true`. Set
|
|
this to `true` if SSL is configured outside of {kib} (for example, you are
|
|
routing requests through a load balancer or proxy).
|
|
|
|
| `xpack.security.sameSiteCookies`
|
|
| Sets the `SameSite` attribute of the session cookie. This allows you to declare whether your cookie should be restricted to a first-party or same-site context.
|
|
Valid values are `Strict`, `Lax`, `None`.
|
|
This is *not set* by default, which modern browsers will treat as `Lax`. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to `None`. Setting this value to `None` requires cookies to be sent over a secure connection by setting `xpack.security.secureCookies: true`.
|
|
|
|
| `xpack.security.session.idleTimeout`
|
|
| Sets the session duration. By default, sessions stay active until the
|
|
browser is closed. When this is set to an explicit idle timeout, closing the
|
|
browser still requires the user to log back in to {kib}.
|
|
|
|
|===
|
|
|
|
[TIP]
|
|
============
|
|
The format is a string of `<count>[ms|s|m|h|d|w|M|Y]`
|
|
(e.g. '70ms', '5s', '3d', '1Y').
|
|
============
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
|
|
| `xpack.security.session.lifespan`
|
|
| Sets the maximum duration, also known as "absolute timeout". By default,
|
|
a session can be renewed indefinitely. When this value is set, a session will end
|
|
once its lifespan is exceeded, even if the user is not idle. NOTE: if `idleTimeout`
|
|
is not set, this setting will still cause sessions to expire.
|
|
|
|
|===
|
|
|
|
[TIP]
|
|
============
|
|
The format is a
|
|
string of `<count>[ms|s|m|h|d|w|M|Y]` (e.g. '70ms', '5s', '3d', '1Y').
|
|
============
|
|
|
|
[cols="2*<"]
|
|
|===
|
|
|
|
| `xpack.security.loginAssistanceMessage`
|
|
| Adds a message to the login screen. Useful for displaying information about maintenance windows, links to corporate sign up pages etc.
|
|
|
|
| `xpack.security.loginHelp`
|
|
| Adds a message accessible at the Login Selector UI with additional help information for the login process.
|
|
|
|
|===
|