# Use curl for PKI realm authentication

**URL:** <https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 26, 2019, 1:00am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834 "2019-01-26T01:00:33Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 26, 2019, 1:00am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/1 "2019-01-26T01:00:33Z")

</div>

Is it possible to use curl - for client PKI realm authentication? I know that we can fulfill file realm authentication by using curl -u username:password ... . But how to present client x509 certificate for PKI realm authentication with curl?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [January 28, 2019, 6:24am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/2 "2019-01-28T06:24:51Z")

</div>

Hi,

See the `--key` and `--cert` options : [https://curl.haxx.se/docs/manpage.html](https://curl.haxx.se/docs/manpage.html)

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 28, 2019, 11:08am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/3 "2019-01-28T11:08:26Z")

</div>

Are you sure? I tried but failed. It maybe for client certificate in the case of bi-directional certification of TSL. Not for authentication of PKI realm.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [January 28, 2019, 11:33am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/4 "2019-01-28T11:33:46Z")

</div>

> [@li\_jessen2016](#):
>
> I tried but failed.

This is not enough information for us to be able to assist you further.

- What did you try and what and how it failed ?
- What is your elasticsearch PKI realm configuration ?
- What did you use as a certificate and key with curl ?
- What was the error you got in curl ?
- What was printed out in the elasticsearch logs?

> It maybe for client certificate in the case of bi-directional certification of TSL. Not for authentication of PKI realm.

PKI realm authentication **IS** TLS client authentication.

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 30, 2019, 1:53pm UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/5 "2019-01-30T13:53:40Z")

</div>

I use the curl:  
curl -v --cacert ./config/certs/ca-test.crt --cert ./cl-cert/cl-cert.pem --key ./cl-cert/clKey.pem [https://el.node.cn:9200/](https://el.node.cn:9200/)

The response is :

- About to connect() to [el.node.cn](http://el.node.cn) port 9200 (#0)
- Trying 192.168.1.108...
- Connected to [el.node.cn](http://el.node.cn) (192.168.1.108) port 9200 (#0)
- Initializing NSS with certpath: sql:/etc/pki/nssdb
- CAfile: ./config/certs/ca-test.crt  
CApath: none
- SSL connection using TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA
- Server certificate:
- subject: [CN=el.node.cn](http://CN=el.node.cn)
- start date: Jan 19 15:08:02 2019 GMT
- expire date: Jan 18 15:08:02 2022 GMT
- common name: [el.node.cn](http://el.node.cn)
- issuer: CN=Elastic Certificate Tool Autogenerated CA

> GET / HTTP/1.1  
> User-Agent: curl/7.29.0  
> Host: [el.node.cn:9200](http://el.node.cn:9200)  
> Accept: _/_

\< HTTP/1.1 401 Unauthorized  
\< WWW-Authenticate: Bearer realm="security"  
\< WWW-Authenticate: Basic realm="security" charset="UTF-8"  
\< content-type: application/json; charset=UTF-8  
\< content-length: 429  
\<

- Connection #0 to host [el.node.cn](http://el.node.cn) left intact  
{"error":{"root\_cause":[{"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Bearer realm="security"","Basic realm="security" charset="UTF-8""]}}],"type":"security\_exception","reason":"missing authentication token for REST request [/]","header":{"WWW-Authenticate":["Bearer realm="security"","Basic realm="security" charset="UTF-8""]}},"status":401}

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [January 30, 2019, 8:10pm UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/6 "2019-01-30T20:10:28Z")

</div>

You still didn't share your elasticsearch configuration so we can't know for sure. My guess is that your TLS configuration for the http layer is missing the

```auto
xpack.security.http.ssl.client_authentication: 

```

setting that needs to be set to `optional` or `required` as described in our [PKI realm documentation](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/configuring-pki-realm.html)

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 31, 2019, 1:54am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/7 "2019-01-31T01:54:10Z")

</div>

But as I read from the documents, this value is defaulted to required. So I haven't set it specifically in elasticsearch.yml.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 31, 2019, 2:16am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/8 "2019-01-31T02:16:32Z")

</div>

Can you point to the docs that say that?  
It's certainly not true, if it were true then every http connection would need a client certificate.

You should explicitly enable TLS client authentication. I would recommend that you set it to `optional`.

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 31, 2019, 3:06am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/9 "2019-01-31T03:06:25Z")

</div>

Oh, I made a mistake. What I saw is the default TSL/SSL settings. The http TSL/SSL settings override them.  
After I set xpack.security.http.ssl.client\_authentication: optional, I got the following error:

{"error":{"root\_cause":[{"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [cl-jli]"}],"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [cl-jli]"},"status":403}

Though I have some addition in config/role\_mapping.yml:  
monitoring:

- "cn=cl-jli,OU=11-14B,O=Std"

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 31, 2019, 4:44am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/10 "2019-01-31T04:44:56Z")

</div>

> [@li\_jessen2016](#):
>
> ```auto
> monitoring:
> - "cn=cl-jli,OU=11-14B,O=Std"
> 
> ```

We have no way of knowing whether that is the correct role mapping.

- does the `monitoring` role exist? What privileges does it have?
- Is that the correct DN for your certificate?

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 31, 2019, 6:10am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/11 "2019-01-31T06:10:33Z")

</div>

> [@li\_jessen2016](#):
>
> action [cluster:monitor/main] is unauthorized for user

In roles.yml, I added:  
monitoring:  
cluster: ['monitor'].

But even I changed the role to _superuser_ in role\_mapping.yml, i found the some error.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 31, 2019, 7:04am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/12 "2019-01-31T07:04:27Z")

</div>

Then it seems like you are using an incorrect DN.

Try using the [Authenticate API](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/security-api-authenticate.html) to debug this.

---

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 31, 2019, 7:20am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/13 "2019-01-31T07:20:52Z")

</div>

I use _openssl x509 -subject -nameopt RFC2253 -noout -in cl-cert.pem_ to get exact DN from the client certificate. And then add the DN to role\_mapping.yml with the role of monitoring\_user. It works.  
Thanks you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2019, 7:22am UTC](https://discuss.elastic.co/t/use-curl-for-pki-realm-authentication/165834/14 "2019-02-28T07:22:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.