Cherry-pick #17927 to 7.x: Add Kerberos support to Elasticsearch output #18080
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR adds support for Kerberos authentication to Elasticsearch output. Users can authenticate using either passwords or keytabs. The option `service_name` is not exposed as in case of ES it has be `HTTP`. Thus, the [SPN](https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-user/What-is-a-Kerberos-Principal_003f.html) of the output is always `HTTP/{output.elasticsearch.host}@{output.elasticsearch.kerberos.realm}`. ```yaml ``` (cherry picked from commit f66b079)
|
Pinging @elastic/integrations-services (Team:Services) |
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
urso
approved these changes
Apr 29, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #17927 to 7.x branch. Original message:
What does this PR do?
This PR adds support for Kerberos authentication to Elasticsearch output.
Configuration
Users can authenticate using either passwords or keytabs.
The option
service_nameis not exposed as in case of ES it has beHTTP. Thus, the SPN of the output is alwaysHTTP/{output.elasticsearch.host}@{output.elasticsearch.kerberos.realm}.Architecture
Kerberos authentication is implemented by using the
spnego.Clientfromgopkg.in/jcmturner/gokrb5/v7.5. It is an HTTP client which is able to authenticate to a Kerberos KDC and get the required session key to authenticate to Elasticsearch.In order to use the client when communicating with ES, I introduced a new interface named
esHTTPClientwith the following functions:So the newly created
kerberos.Clientandhttp.Clientcan be used inConnection.The only drawback of this solution is that it is not compatible with
github.com/elastic/go-elasticsearch. The main issue is the constructor of that package only lets us configurehttp.Transport. However,http.Transportshould be used for authentication according to Golang documentation. For the record, it is possible to implement Kerberos authentication in a specialRoundTripper, but I am not a huge fan of that approach as the Golang docs advise against it.Reference:
Testing
I am planning to add tests in a follow-up PR. I wanted to raise this first, so we can agree on the selected architecture.
Why is it important?
Users now can authenticate to Kerberos-aware Elasticsearch instances.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.