Users and roles: Overviews, cloud org, project custom roles #340
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,129 @@ | ||
| --- | ||
| navigation_title: "Users and roles" | ||
| mapped_pages: | ||
| - https://www.elastic.co/guide/en/serverless/current/project-settings-access.html | ||
| applies: | ||
| serverless: all | ||
| hosted: all | ||
| ece: all | ||
| eck: all | ||
| stack: all | ||
| --- | ||
|
|
||
| # Manage users and roles | ||
|
|
||
| To prevent unauthorized access to your Elastic resources, you need a way to identify users and validate that a user is who they claim to be (*authentication*), and control what data users can access and what tasks they can perform (*authorization*). | ||
|
|
||
| The methods that you use to authenticate users and control access depends on the way Elastic is deployed. | ||
|
|
||
| ::::{note} | ||
| Preventing unauthorized access is only one element of a complete security strategy. To secure your Elastic environment, you can also do the following: | ||
|
|
||
| * Restrict the nodes and clients that can connect to the cluster using [traffic filters](/deploy-manage/security/traffic-filtering.md). | ||
| * Take steps to maintain your data integrity and confidentiality by [encrypting HTTP and inter-node communications](/deploy-manage/security/secure-endpoints.md), as well as [encrypting your data at rest](/deploy-manage/security/encrypt-deployment.md). | ||
| * Maintain an [audit trail](/deploy-manage/monitor/logging-configuration/security-event-audit-logging.md) for security-related events. | ||
| * Control access to dashboards and other saved objects in your UI using [{{kib}} spaces](/deploy-manage/manage-spaces.md). | ||
| * Connect your cluster to a [remote cluster](/deploy-manage/remote-clusters.md) to enable cross-cluster replication and search. | ||
| * Manage [API keys](/deploy-manage/api-keys.md) used for programmatic access to Elastic. | ||
| :::: | ||
|
|
||
| ## Cloud organization level | ||
|
|
||
| :::{applies} | ||
| :hosted: all | ||
| :serverless: all | ||
| ::: | ||
|
|
||
| If you’re using {{ecloud}}, then you can perform the following tasks to control access to your Cloud organization, your Cloud Hosted deployments, and your Cloud Serverless projects: | ||
|
|
||
| * [Invite users to join your organization](/deploy-manage/users-roles/cloud-organization/manage-users.md) | ||
| * Assign [user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md): | ||
| * Manage organization-level roles and high-level access to deployments and projects. | ||
| * Assign project-level roles and [create custom roles](/deploy-manage/users-roles/custom-roles.md). ({{serverless-short}} only) | ||
| * Configure [SAML single sign-on](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md) for your organization | ||
|
|
||
| ::::{tip} | ||
| For {{ech}} deployments, you can configure SSO at the organization level, the deployment level, or both. Refer to [Cloud organization users](/deploy-manage/users-roles/cloud-organization.md#organization-deployment-sso) for more information. | ||
| :::: | ||
|
|
||
| {{ech}} deployments can also use [cluster-level authentication and authorization](/deploy-manage/users-roles/cluster-or-deployment-auth.md). Cluster-level auth features are not available for {{serverless-full}}. | ||
|
|
||
| ## Orchestrator level | ||
|
|
||
| :::{applies} | ||
| :ece: all | ||
| ::: | ||
|
|
||
| Control access to your {{ece}} [orchestrator](/deploy-manage/deploy/cloud-enterprise/deploy-an-orchestrator.md) and deployments. | ||
|
|
||
| * [Manage passwords for default users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-system-passwords.md) | ||
| * [Manage orchestrator users and roles](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-users-roles.md): | ||
| * [Using native users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/native-user-authentication.md) | ||
| * By integrating with external authentication providers: | ||
| * [Active Directory](/deploy-manage/users-roles/cloud-enterprise-orchestrator/active-directory.md) | ||
| * [LDAP](/deploy-manage/users-roles/cloud-enterprise-orchestrator/ldap.md) | ||
| * [SAML](/deploy-manage/users-roles/cloud-enterprise-orchestrator/saml.md) | ||
| * [Configure single sign-on to deployments](/deploy-manage/users-roles/cloud-enterprise-orchestrator/configure-sso-for-deployments.md) for orchestrator users | ||
|
|
||
| ::::{tip} | ||
| For {{ece}} deployments, you can configure SSO at the orchestrator level, the deployment level, or both. | ||
| :::: | ||
|
|
||
| {{ece}} deployments can also use [cluster-level authentication and authorization](/deploy-manage/users-roles/cluster-or-deployment-auth.md). | ||
shainaraskas marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| :::{note} | ||
| You can't manage users and roles for {{eck}} clusters at the orchestrator level. {{eck}} deployments use cluster-level authentication and authorization only. | ||
| ::: | ||
|
|
||
| ## Project level | ||
|
|
||
| :::{applies} | ||
| :serverless: all | ||
| ::: | ||
|
|
||
| As an extension of the [predefined instance access roles](/deploy-manage/users-roles/cloud-organization/user-roles.md#ec_instance_access_roles) offered for {{serverless-short}} projects, you can create custom roles at the project level to provide more granular control, and provide users with only the access they need within specific projects. | ||
|
|
||
| [Learn more about custom roles for {{serverless-full}} projects](/deploy-manage/users-roles/custom-roles.md). | ||
|
|
||
| ## Cluster or deployment level | ||
|
|
||
| :::{applies} | ||
| :ece: all | ||
| :hosted: all | ||
| :eck: all | ||
| :stack: all | ||
| ::: | ||
|
|
||
| Set up authentication and authorization at the cluster or deployment level, and learn about the underlying security technologies that Elasticsearch uses to authenticate and authorize requests internally and across services. | ||
|
|
||
| ### User authentication | ||
|
|
||
| Set up methods to identify users to the Elasticsearch cluster. | ||
|
|
||
| Key tasks for managing user authentication include: | ||
|
|
||
| * [Managing default users](/deploy-manage/users-roles/cluster-or-deployment-auth/built-in-users.md) | ||
| * [Managing users natively](/deploy-manage/users-roles/cluster-or-deployment-auth/native.md) | ||
| * [Integrating with external authentication providers](/deploy-manage/users-roles/cluster-or-deployment-auth/external-authentication.md) | ||
|
|
||
| You can also learn the basics of Elasticsearch authentication, learn about accounts used to communicate within an Elasticsearch cluster and across services, and perform advanced tasks. | ||
|
|
||
| [View all user authentication docs](/deploy-manage/users-roles/cluster-or-deployment-auth/user-authentication.md) | ||
|
|
||
| ### User authorization | ||
|
|
||
| After a user is authenticated, use role-based access control to determine whether the user behind an incoming request is allowed to execute the request. | ||
|
|
||
| Key tasks for managing user authorization include: | ||
|
|
||
| * Assigning [built-in roles](/deploy-manage/users-roles/cluster-or-deployment-auth/built-in-roles.md) or [defining your own](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md) | ||
| * [Mapping users and groups to roles](/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles.md) | ||
| * [Setting up field- and document-level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) | ||
|
|
||
| You can also learn the basics of Elasticsearch authorization, and perform advanced tasks. | ||
|
|
||
| ::::{tip} | ||
| User roles are also used to control access to [{{kib}} spaces](/deploy-manage/manage-spaces.md). | ||
| :::: | ||
|
|
||
| [View all user authorization docs](/deploy-manage/users-roles/cluster-or-deployment-auth/user-roles.md) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| For {{ech}} deployments, you can configure SSO at the [organization level](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md), the [deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md), or both. | ||
|
|
||
| The option that you choose depends on your requirements: | ||
|
|
||
| | Consideration | Organization-level | Deployment-level | | ||
| | --- | --- | --- | | ||
| | **Management experience** | Manage authentication and role mapping centrally for all deployments in the organization | Configure SSO for each deployment individually | | ||
| | **Authentication protocols** | SAML only | Multiple protocols, including LDAP, OIDC, and SAML | | ||
| | **Role mapping** | [Organization-level roles and instance access roles](../../../deploy-manage/users-roles/cloud-organization/user-roles.md), Serverless project [custom roles](https://docs.elastic.co/serverless/custom-roles.md) | [Built-in](../../../deploy-manage/users-roles/cluster-or-deployment-auth/built-in-roles.md) and [custom](../../../deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md) stack-level roles | | ||
| | **User experience** | Users interact with Cloud | Users interact with the deployment directly | | ||
|
|
||
| If you want to avoid exposing users to the {{ecloud}} Console, or have users who only interact with some deployments, then you might prefer users to interact with your deployment directly. | ||
|
|
||
| In some circumstances, you might want to use both organization-level and deployment-level SSO. For example, if you have a data analyst who interacts only with data in specific deployments, then you might want to configure deployment-level SSO for them. If you manage multiple tenants in a single organization, then you might want to configure organization-level SSO to administer deployments, and deployment-level SSO for the users who are using each deployment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,24 @@ | ||
| --- | ||
| navigation_title: "ECE orchestrator" | ||
| applies: | ||
| ece: all | ||
| --- | ||
|
|
||
| # Elastic Cloud Enterprise orchestrator users | ||
|
|
||
| Control access to your {{ece}} [orchestrator](/deploy-manage/deploy/cloud-enterprise/deploy-an-orchestrator.md) and deployments. | ||
|
|
||
| * [Manage passwords for default users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-system-passwords.md) | ||
| * [Manage orchestrator users and roles](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-users-roles.md): | ||
| * [Using native users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/native-user-authentication.md) | ||
| * By integrating with external authentication providers: | ||
| * [Active Directory](/deploy-manage/users-roles/cloud-enterprise-orchestrator/active-directory.md) | ||
| * [LDAP](/deploy-manage/users-roles/cloud-enterprise-orchestrator/ldap.md) | ||
| * [SAML](/deploy-manage/users-roles/cloud-enterprise-orchestrator/saml.md) | ||
| * [Configure single sign-on to deployments](/deploy-manage/users-roles/cloud-enterprise-orchestrator/configure-sso-for-deployments.md) for orchestrator users | ||
|
|
||
| ::::{tip} | ||
| For {{ece}} deployments, you can configure SSO at the orchestrator level, the deployment level, or both. | ||
| :::: | ||
|
|
||
| {{ece}} deployments can also use [cluster-level authentication and authorization](/deploy-manage/users-roles/cluster-or-deployment-auth.md). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,33 @@ | ||
| --- | ||
| navigation_title: "Cloud organization" | ||
| mapped_pages: | ||
| - https://www.elastic.co/guide/en/cloud/current/ec-organizations.html | ||
| applies: | ||
| serverless: all | ||
| hosted: all | ||
| --- | ||
|
|
||
| # Cloud organization users [ec-organizations] | ||
|
|
||
| When you sign up to {{ecloud}}, you create an organization. This organization is the umbrella for all of your {{ecloud}} resources, users, and account settings. Every organization has a unique identifier. | ||
|
|
||
| You can perform the following tasks to control access to your Cloud organization, your {{ech}} deployments, and your {{serverless-full}} projects: | ||
|
|
||
| * [Manage users](/deploy-manage/users-roles/cloud-organization/manage-users.md): Invite users to join your organization and manage existing users. | ||
| * Assign [user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md): | ||
| * Manage organization-level roles and high-level access to deployments and projects. | ||
| * If you have {{serverless-full}} projects, assign project-level roles and create custom roles. | ||
| * Configure [SAML single sign-on](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md) for your organization. | ||
|
|
||
| :::{tip} | ||
| If you're using {{ech}}, then you can also manage users and control access [at the deployment level](/deploy-manage/users-roles/cluster-or-deployment-auth.md). | ||
| ::: | ||
|
|
||
| ## Should I use organization-level or deployment-level SSO? [organization-deployment-sso] | ||
|
|
||
| :::{applies} | ||
| :hosted: all | ||
| ::: | ||
|
|
||
| :::{include} _snippets/org-vs-deploy-sso.md | ||
| ::: |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.