Elasticsearch, Kibana and Auth

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

Hi,
I'm trying to use ECK so that

  • Elasticsearch is protected by a password
  • Kibana allows un-authenticated traffic

We run a custom oauth proxy in front of kibana to perform authentication - this way we can allow users to use their regular g-suite credentials to access kibana.

In the past (prior to starting to use ECK), this was achieved by using the special format for the elasticsearch url setting in the kibana config file:
https://user:password@elasticsearch.url:443. (at the top of my head I can't remember if we had to base64-encode the username/password part of the url, that may be).

In any case, this worked well enough altho a bit hacky - as far as I know it's the only way of making Kibana talk to an auth-enabled Elasticsearch cluster without auth-enabling Kibana.

However, after switching to ECK the constructs are higher level, and kibana simply references an ECK Elasticsearch cluster by name, not url.

So, before I give up and look for some other solution I guess I'm asking:

  • it seems strange to me that Kibana "officially" seems to require "passing thru" credentials, making it difficult to turn kibana security off while leaving Elasticsearch security on. Is it really supposed to be near-impossible to achieve this?

  • Is there any way using ECK that I can maniupulate kibana's setting for the Elasticsearch url so we can implement the "auth bypass hack" while while still using ECK?

2

Rather than using a custom proxy, it may be simpler to use saml for authentication (which works with gsuite)

it seems strange to me that Kibana "officially" seems to require "passing thru" credentials, making it difficult to turn kibana security off while leaving Elasticsearch security on. Is it really supposed to be near-impossible to achieve this?

This may be better suited to the Kibana section of the forums.

Is there any way using ECK that I can maniupulate kibana's setting for the Elasticsearch url so we can implement the "auth bypass hack" while while still using ECK?

You can configure kibana in the config section of the spec as described in these docs:

Though again it may be worth a) using saml, or b) asking in the kibana section if there are better ways to accomplish your use case.

3

Thanks,
Unfortunately, the way Elastic licenses are organized, it requires a platinum license to use SAML. We're not prepared to spend that kind of money.