ES 7.4.1 - Authentication [Rest API]

[AsfK]

Truly, I already asked the question in stackoverflow but didn't receive an answer yet, so I also create a new topic here..

I’m a newbie in ES and I have a task in my new job to upgrade from 6.4.2 to 7.4.1 – From TCP client to Rest High Level API.

Previously we built the client like this (with SSL & Certificate):

Settings settings = Settings.builder()
      .put("xpack.security.user", String.format("%s:%s",esJavaUser,esJavaPassword))
      .put("cluster.name", esClusterName)
      .put("xpack.security.transport.ssl.enabled", xpackSecurityTransportSslEnabled)
      .put("xpack.ssl.certificate_authorities", xpackSslCertificateAuthorities)
      .build();

 client = new PreBuiltXPackTransportClient(settings);

Now, in rest API, it’s changed to this:

final CredentialsProvider credentialsProvider =
        new BasicCredentialsProvider();
credentialsProvider.setCredentials(AuthScope.ANY,
        new UsernamePasswordCredentials(esJavaUser, esJavaPassword));

RestClientBuilder restClientBuilder = RestClient.builder(hosts)
        .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
                .setDefaultCredentialsProvider(credentialsProvider));
restHighLevelClient = new RestHighLevelClient(restClientBuilder);

With this build I set ES user and password by CredentialsProvider but what about ssl.enabled and certificate_authorities”? how should I provided them with rest API?

[TimV (Tim Vernum)]

The documentation you are looking for is here: Encrypted communication | Java REST Client [7.4] | Elastic

@AsfK

what about ssl.enabled and certificate_authorities”

SSL is automatically enabled (or not) based on the scheme (protocol) in the HttpHost objects you pass to the builder.

RestClient.builder(hosts)

If you are using SSL, you want to pass "https" as the scheme (3rd argument) when you construct the HttpHost objects (hosts).

Unfortunately there is no simple means to pass certificate_authorities to the Rest client, you need to turn those certificates into a standard Java truststore.

You can probably find some sample code on the web ("convert PEM certificates to Java truststore"), but the gist of it is:

1. Open the certificate authority files as an InputStream
2. Create a X.509 certificate factory: java.security.cert.CertificateFactory.getInstance("X.509")
3. Call generateCertificates on the certificate factory to read those certificate files into java Certificate objects
4. Construct an empty KeyStore object
5. Add the loaded certificates as trusted entries
6. Pass that to SSLContextBuilder.loadTrustMaterial

[AsfK]

Thank you very much!!

P.S. The documentaion not mention the certificate section you wrote in your answer, maybe you might want to add it... Thanks again!