# Kerberos, ActiveDirectory and Token API Combination

**URL:** <https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 31, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080 "2019-10-31T16:29:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![j0t0](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@j0t0](https://discuss.elastic.co/u/j0t0)\
**Post date:** [October 31, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080/1 "2019-10-31T16:29:40Z")

</div>

I'm looking for some guidance on how best to implement access security to search. My search clients are all Windows apps running in an AD domain. I have configured Elasticsearch with a Kerberos realm for authentication and an Active Directly realm for authorization. I've mapped AD groups to Elasticsearch roles and everything is working as expected. However, I can see that every search request from the client takes two HTTP requests, one that receive the 401 challenge followed by a second that provides the kerberos ticket. To avoid the double hit on every search request I am using the Token api to generate a "session" token that I can send along with all subsequent search requests after the initial kerberos exchange. One concern I had is that I have to give "manage\_token" access to the groups that will use the client application in order to be able to call the Token API.

My question is, is this a proper approach to handling SSO in my environment. Is there a better implementation approach that I'm just not aware of or a way to avoid having to use a token?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080/2 "2019-11-28T16:29:41Z")

</div>

Closed on November 28, 2019, 4:29pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.