# Shield and Java Transport Client **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 2, 2017, 10:40am UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653 "2017-02-02T10:40:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![gsb](https://avatars.discourse-cdn.com/v4/letter/g/cc9497/32.png) [@gsb](https://discuss.elastic.co/u/gsb)\ **Post date:** [February 2, 2017, 10:40am UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/1 "2017-02-02T10:40:56Z")
When shield is integrated Java application (over transport layer) using elastic shield transport client, if user enables SSL in elastic shield , Is it mandatory to pass username/password also along with certificate information ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 2, 2017, 6:20pm UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/2 "2017-02-02T18:20:57Z")
It is not mandatory if you set up a PKI realm that will be able to authenticate the client certificate. ---
**Author:** ![gsb](https://avatars.discourse-cdn.com/v4/letter/g/cc9497/32.png) [@gsb](https://discuss.elastic.co/u/gsb)\ **Post date:** [February 3, 2017, 9:31am UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/3 "2017-02-03T09:31:16Z")
Thanks Jay. Can you please confirm if my following configuration is right (I have added my comments against few of the params for clarification ) ? // For Java Client Using Transport Layer In elasticsearch.yml file shield: authc: realms: pki1: type: pki truststore: path: "/path/to/pki\_truststore.jks" //Is this field mandatory if client certifcate is signed by same CA ? // can I use keystore path instead of truststore ? password: "changeme" In role\_mapping.yml my\_role: - "cn=unique cn" In my Java client TransportClient client = TransportClient.builder() .addPlugin(ShieldPlugin.class) .settings(Settings.builder() .put("[cluster.name](http://cluster.name)", "myClusterName") .put("shield.ssl.keystore.path", "/path/to/client.jks") .put("shield.ssl.keystore.password", "password") ... .build()); What should be format(extension) of certificate in shield.ssl.keystore.path. // For Http Client (python) in my case , how can I pass certificate and key from the input. es = Elasticsearch( ['localhost', 'otherhost'], http\_auth=('user', 'secret'), // Can I omit this ? port=443, use\_ssl=True, ca\_certs='/path/to/cacert.pem', // what shall be path here ? because there we are passing jks path . client\_cert='/path/to/client\_cert.pem', // what shall be path here ? will just .crt file work ? client\_key='/path/to/client\_key.pem', // what shall be path here ? will just the .key file work ? ) //For Http Client (Kibana and curl) etc. I do want to keep using http username/password authentication . Do I need to change any existing configuration for this, right now it's authenticated using native realm users. * * * Please let me know in case I'm missing anything in my configuration(s). //---------- Is it possible to achieve the same functionality using native realm, i.e. not passing username/password from client (transport and http) ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 3, 2017, 3:23pm UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/4 "2017-02-03T15:23:10Z")
> [@gsb](#): > > path: "/path/to/pki\_truststore.jks" //Is this field mandatory if client certifcate is signed by same CA ? not mandatory since the CA is already trusted > [@gsb](#): > > // can I use keystore path instead of truststore ? Yes keystore file path would have been fine[quote="gsb, post:3, topic:73653"] ca\_certs='/path/to/cacert.pem', // what shall be path here ? because there we are passing jks path . [/quote] This should be the path to the CA certificate. JKS is really only for java. > [@gsb](#): > > // what shall be path here ? will just .crt file work ? Yes the certificate file.[quote="gsb, post:3, topic:73653"] // what shall be path here ? will just the .key file work ? [/quote] The .key file will work. > [@gsb](#): > > Do I need to change any existing configuration for this, You will need to enable http client auth and make it optional: `shield.http.ssl.client.auth: optional`. You also need to add a native realm definition in your elasticsearch.yml if you haven't already. > [@gsb](#): > > What should be format(extension) of certificate in shield.ssl.keystore.path. This should be a java keystore file. > [@gsb](#): > > Is it possible to achieve the same functionality using native realm, i.e. not passing username/password from client (transport and http) The only way would be by enabling anonymous but that means anyone can access it... ---
**Author:** ![gsb](https://avatars.discourse-cdn.com/v4/letter/g/cc9497/32.png) [@gsb](https://discuss.elastic.co/u/gsb)\ **Post date:** [February 3, 2017, 3:40pm UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/5 "2017-02-03T15:40:48Z")
Thanks for detailed answers. In python client - when passing certificate. http\_auth=('user', 'secret'), // Can I omit this ? > [@jaymode](#): > > You will need to enable http client auth and make it optional: shield.http.ssl.client.auth: optional. In the above case if I made it optional , does it mean user can make a rest call without http header(username/password) in a rest client ? Also does the same mean , user can login to kibana without username/password ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 3, 2017, 4:16pm UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/6 "2017-02-03T16:16:05Z")
Client authentication in this context is about SSL/TLS. This means that a client will be asked to present its certificate and the server will verify it. When set to optional, the server requests it but does not require it. This allows both PKI and username/password authentication to work. However, this does not change the overall authentication requirement, so username and password will be required as long as the user does not have a trusted certificate. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2017, 4:16pm UTC](https://discuss.elastic.co/t/shield-and-java-transport-client/73653/7 "2017-03-03T16:16:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.