Kibana second instance on a different domain - best practices?

[AClerk]

Hey All,
I have 1 Elasticsearch cluster (version 7.6.x) that is connected to Kibana (2 nodes behind a load balancer).
I would like to create another Kibana instance on a different domain. So users from that other domain can access dashboards and visualisations, and manage their own users in the second domain.
What is the best approach? best practices?
Any known issues? Things to be aware of? Limitations?

Thank you!

[warkolm (Mark Walkom)]

By domain do you mean URL, or auth domain?

[AClerk]

Not sure what you mean.
So current users can log in either with local domain or as local users.
user@domain.com or user
admin@domain.com or admin

I want to add another user group from a different domain.

user@new_domain.com

[warkolm (Mark Walkom)]

Righto, so auth domain.

You will need to make sure that it's setup in Elasticsearch. I'm not sure if there are other considerations.

[TimV (Tim Vernum)]

@AClerk

manage their own users in the second domain.

Assuming you are using Elasticsearch native security, then there is only a single security domain. You cannot segregate users in that way within a single Elasticsearch instance.

If you really want that level of separation you need to run multiple separate clusters.

[AClerk]

Yes, using elastic security solution.
So users will have to be managed as internal users only?