Es service failed with AD shield

Elastic Stack Elasticsearch
1

hi added these lines to my ES server at elasticsearch.yml
shield.authc.realms:
active_directory:
type: active_directory
order: 0
domain_name: domain.com
unmapped_groups_as_roles: true
url: ldap://domain.com

after doing that , the elasticsearch service won't start
nothing in the logs , when commenting out these lines everything is working just fine
am i missing something?

2

forgot to add :
i have shield installed properly and so far i have used basic authentication
and everything worked

3

what version of shield are you using?

4

Hi, thanks for your reply
Im using shield 2.3

5

Is that 2.3.0? Can you try 2.3.2? https://www.elastic.co/guide/en/shield/current/release-notes.html#_2_3_2

6

it's 2.3.3 actually

7

by the way
any shiled setting i put in the elasticsearch.yml , after restart , the es service fails
like i tried to add this setting : shield.audit.enabled
and again restarted the service and again it faild

8

Have you tried starting elasticsearch manually bin/elasticsearch rather than as a service to see if any exception is printed?

9

yes , got this message
Exception in thread "main" ElasticsearchException[Failed to load logging configu ration]; nested: NoSuchFileException[/usr/share/elasticsearch/config];
Likely root cause: java.nio.file.NoSuchFileException: /usr/share/elasticsearch/c onfig
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86 )
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
at sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttrib uteViews.java:55)
at sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvid er.java:144)
at sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProv ider.java:99)
at java.nio.file.Files.readAttributes(Files.java:1737)
at java.nio.file.FileTreeWalker.getAttributes(FileTreeWalker.java:225)
at java.nio.file.FileTreeWalker.visit(FileTreeWalker.java:276)
at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:322)
at java.nio.file.Files.walkFileTree(Files.java:2662)
at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig( LogConfigurator.java:142)
at org.elasticsearch.common.logging.log4j.LogConfigurator.configure(LogC onfigurator.java:103)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:243)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Refer to the log for complete error details.

10

ok , i've moved the ymls files to the /usr/share/elasticsearch/config dorectory and now i'm getting this:

Exception in thread "main" SettingsException[Failed to load settings from [elasticsearch.yml]]; nested: E lasticsearchParseException[malformed, expected end of settings but encountered additional content startin g at line number: [97], column number: [1]]; nested: ParserException[expected '', but fou nd BlockMappingStart
in 'reader', line 97, column 1:
shield.authc.realms:
^
];
Likely root cause: expected '', but found BlockMappingStart
in 'reader', line 97, column 1:
shield.authc.realms:
^

    at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl$ParseDocumentStart.produce(P                               arserImpl.java:225)
    at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl.peekEvent(ParserImpl.java:15                               8)
    at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl.getEvent(ParserImpl.java:168                               )
    at com.fasterxml.jackson.dataformat.yaml.YAMLParser.nextToken(YAMLParser.java:342)
    at org.elasticsearch.common.xcontent.json.JsonXContentParser.nextToken(JsonXContentParser.java:53                               )
    at org.elasticsearch.common.settings.loader.XContentSettingsLoader.load(XContentSettingsLoader.ja                               va:72)
    at org.elasticsearch.common.settings.loader.XContentSettingsLoader.load(XContentSettingsLoader.ja                               va:45)
    at org.elasticsearch.common.settings.loader.YamlSettingsLoader.load(YamlSettingsLoader.java:46)
    at org.elasticsearch.common.settings.Settings$Builder.loadFromStream(Settings.java:1080)
    at org.elasticsearch.common.settings.Settings$Builder.loadFromPath(Settings.java:1067)
    at org.elasticsearch.node.internal.InternalSettingsPreparer.prepareEnvironment(InternalSettingsPr                               eparer.java:88)
    at org.elasticsearch.common.cli.CliTool.<init>(CliTool.java:107)
    at org.elasticsearch.common.cli.CliTool.<init>(CliTool.java:100)
    at org.elasticsearch.bootstrap.BootstrapCLIParser.<init>(BootstrapCLIParser.java:48)
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:226)
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)

Refer to the log for complete error details.

11

i dont know why but now the service is starting stays active for 4-5 sec and then fails again with the following error in the log file :
java.lang.IllegalArgumentException: missing realm type for [domain_name] realm
at org.elasticsearch.shield.authc.Realms.initRealms(Realms.java:111)
at org.elasticsearch.shield.authc.Realms.doStart(Realms.java:59)
at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:68)
at org.elasticsearch.node.Node.start(Node.java:255)
at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:206)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:272)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
[2016-07-07 10:58:13,152][INFO ][node ] [elastic_test_02] stopping ...
[2016-07-07 10:58:13,152][INFO ][node ] [elastic_test_02] stopped
[2016-07-07 10:58:13,152][INFO ][node ] [elastic_test_02] closing ...
[2016-07-07 10:58:13,158][INFO ][node ] [elastic_test_02] closed

12

It seems like your elasticsearch.yml file isn't formatted correctly. Can you upload the actual file and preserve formatting?

13

Yes , you were right , the format was bad .. i played around a little bit with the spaces and tabs , that solved it
Thanks you so mach for your help!