Always enable file based user auth #1698
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The operator relies on file realm for creating all the internal users including the built-in elastic user. This commit makes sure the file realm is always enabled in case a user wants to configure additional realms. The order of the file realm is set to -100 to favor the fact that it is used first but there is no complete guarantee about that. The user can still configure a realm with an order less than -100 but it is very unlikely given this is not suggested in the documentation (order starts to 0). The main known issue could be to configure a realm that relies on a system (e.g. Active Directory) that has a temporary lock-out period after several successive failed login attempts, as being checked first (https://www.elastic.co/guide/en/elastic-stack-overview/current/trouble-shoot-active-directory.html).
charith-elastic
approved these changes
Sep 10, 2019
|
I updated the PR to support the two syntaxes for the realm settings depending the major version (breaking changes in 7.0). I'm mixed to use a more advanced way to switch the config for this little variation, like we did in the past for ES and still have for Kibana. |
I think I tend to prefer what you implemented where we pass the version around and use it where it matters, instead of having several driver plugs. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The operator relies on file realm for creating all the internal users
including the built-in elastic user. This commit makes sure the file
realm is always enabled in case a user wants to configure additional
realms.
The order of the file realm is set to -100 to favor the fact that it is
used first but there is no complete guarantee about that. The user can
still configure a realm with an order less than -100 but it is very
unlikely given this is not suggested in the documentation (order starts to 0).
The main known issue could be to configure a realm that relies on a
system (e.g. Active Directory) that has a temporary lock-out period
after several successive failed login attempts, as being checked first
(https://www.elastic.co/guide/en/elastic-stack-overview/current/trouble-shoot-active-directory.html).
Resolves #1629.