Hi All,
I read recently a very good article regarding integration of the ES with 3rd party auth, and I'd like to discuss with the community the following point:
the author has created an internal ES "fake" account (user1) for the "real" user's account "user1":
curl -u elastic:changeme -XPOST "http://localhost:9200/_xpack/security/user/user1" -H 'Content-Type: application/json' -d'
{
"password" : "B&J$v,&%2SV*g9Xv",
"roles" : ["kibana_user", "shakespeare_bank_read"],
"full_name" : "My Test User 1"
}'
and granted the technical role nginx permission to impersonate that user:
curl -u elastic:changeme -XPOST "http://localhost:9200/_xpack/security/role/nginx" -H 'Content-Type: application/json' -d'
{
"run_as": ["user1"]
}'
That means, if we're going to use an LDAP (AD) server of an enterprise with, let's say, 200.000 users, we'd have to create an internal ES user for every "real" account? And, if wildcards are not allowed, the second query above, would contain a huge run_as list with these 200k accounts? (to say nothing of maintaining/synchronizing the external and internal user names).
So, do I get it right, that this kind of architecture
would make sense for systems with a "manageable" amount of users?
Thanks!
