# PKI Realm

**URL:** <https://discuss.elastic.co/t/pki-realm/101985>\
**Category:** Elastic Cloud Enterprise (ECE)\
**Created:** [September 27, 2017, 1:22pm UTC](https://discuss.elastic.co/t/pki-realm/101985 "2017-09-27T13:22:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adesouza](https://avatars.discourse-cdn.com/v4/letter/a/8baadc/32.png) [@adesouza](https://discuss.elastic.co/u/adesouza)\
**Post date:** [September 27, 2017, 1:22pm UTC](https://discuss.elastic.co/t/pki-realm/101985/1 "2017-09-27T13:22:31Z")

</div>

Hi,

Is the PKI realm supported for clusters in ECE? I had a look through the documentation but didn't see any mention, just wanted to double check that I haven't missed something.

Thanks,

Aaron

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [September 27, 2017, 2:10pm UTC](https://discuss.elastic.co/t/pki-realm/101985/2 "2017-09-27T14:10:36Z")

</div>

@adesouza

The biggest limitation is that normally these types of auth require access to files (eg in the PKI case I believe you will normally want a [custom trust store](https://www.elastic.co/guide/en/x-pack/current/pki-realm.html#pki-ssl-config) and optionally a [roles mapping file](https://www.elastic.co/guide/en/x-pack/current/pki-realm.html#assigning-roles-pki) - though it seems like you can also set the role mapping via the [xpack API](https://www.elastic.co/guide/en/x-pack/current/pki-realm.html#assigning-roles-pki))

1.0 is somewhat limited in its handling of custom files - you cannot configure the docker containers to view external files and the only way of importing files is via the [user bundles](https://www.elastic.co/guide/en/cloud-enterprise/current/ElasticsearchConfiguration.html) in the ECE API (or via the equivalent field in the advanced config page, also under `"elasticsearch"`) - this lets you specify a URL (which has to be "publicly available") of a zip file that is then expanded and its children under the sub-directory `dictionaries` are copied into `/app/config` in the container

Note we haven't tested this configuration internally, though we have demonstrated LDAP integration working (requires a similar use of bundles as described above), and also token based authentication (which just requires a change to the cluster settings)

Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 11, 2017, 2:11pm UTC](https://discuss.elastic.co/t/pki-realm/101985/3 "2017-10-11T14:11:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.