#ROR, Own Home and NGINX
- In this guide, I’m sharing how we were able to get ROR, Own Home and NGINX working together to provide multitenancy with rights management by ROR
- This is how I got it working for me, no guarantees it’ll work exactly right for you! Hopefully this can serve as a rough map, though!
- In this scenario, there are four users. User1 has access to both indices starting with “research” and “sales”. User2 has access only to “sales”, user3 only “research” and “administrator” is an administrator with access to everything.
Software versions
- ROR 1.16.7 for ES 5.4.0
- Own Home 5.4.0
- Kibana 5.4.0
- Elasticsearch 5.4.0
- NGINX - 1.10.3
Instructions
- Install and configure your elasticsearch cluster.
- Install ROR plugin in Elasticsearch
- Install and configure your Kibana instance.
- Install own_home plugin in Kibana
Configure own_home plugin in kibana.yml as below
own_home.proxy_user_header: x-forwarded-user
own_home.session.secretkey: "mysecretkey"
own_home.session.isSecure: false
own_home.local.groups: [ sandbox ]
elasticsearch.url: "http://localhost:19200"
elasticsearch.username: "kibana"
elasticsearch.password: "kibana"
elasticsearch.requestHeadersWhitelist: [ authorization, x-forwarded-user ]
Configure elasticsearch.yml as below (also configure any other elasticsearch.yml options are needed, of course, this is ROR support parameters only.
readonlyrest:
enable: true
response_if_req_forbidden: Forbidden by ReadonlyREST ES plugin
access_control_rules:
- name: "user1_kibana"
proxy_auth: ["user1"]
indices: [".kibana_user1"]
actions: ["*"]
- name: "user2_kibana"
proxy_auth: ["user2"]
indices: [".kibana_user2"]
actions: ["*"]
- name: "user3_kibana"
proxy_auth: ["user3"]
indices: [".kibana_user3"]
actions: ["*"]
- name: "proxy auth - user1"
proxy_auth: ["user1"]
actions: ["indices:data/read/*","indices:admin/mappings/*"]
indices: ["sales_*","research_*"]
kibana_access: rw
- name: "proxy auth - user2"
proxy_auth: ["user2"]
actions: ["indices:data/read/*","indices:admin/mappings/*"]
indices: ["sales_*"]
kibana_access: rw
- name: "proxy auth - user3 only"
proxy_auth: ["user3"]
actions: ["indices:data/read/*","indices:admin/mappings/*"]
indices: ["research_*"]
kibana_access: rw
- name: "::KIBANA-SRV::"
auth_key: kibana:kibana
- name: "Administrator access"
proxy_auth: ["administrator"]
kibana_access: admin
actions: ["*"]
Configure /etc/nginx/default.d/kibana.conf like the following:
location ~ (/app/kibana|/bundles|/kibana|/status|/plugins|/ui|/api|/es_admin|/elasticsearch|/app/own_home|/app/timelion) {
proxy_pass https://localhost:5601;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
rewrite ^/kibana(.*)$ /$1 break;
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
auth_basic "Basic Auth";
auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
proxy_set_header x-forwarded-user $remote_user;
proxy_set_header Authorization "";
access_log /var/log/nginx/kibana.access.log;
}
Configure /etc/nginx/conf.d/.htpasswd accounts that correspond to user1, user2, user3 and administrator.
- Start elasticsearch, kibana and nginx services
- Navigate to your nginx host (HTTP/HTTPS as you configure in /etc/nginx/nginx.conf)
- You’ll be prompted for credentials as defined in your .htpasswd file
- The validated username is passed on to Kibana through nginx on the x-forwarded-user header
- own_home plugin proxies an appropriate index and does its magic to point kibana towards that personalized index
- Kibana passes the x-forwarded-user header on to Elasticsearch, and proxy-auth, ROR uses this to grant appropriate access
Notes on improvements:
- kibana_index: “.kibana_@{x-forwarded-user}” parameter doesn’t seem to work - this might allow us to avoid the need for the userX_kibana ACL blocks. Without write access to the individual own_home created .kibana_userX index, kibana fails. I also tried specifying explicit “.kibana_user1” values on the kibana_index option, to no avail.
- However, if we wanted to provide user1, user2 and user3 write permissions to the indexes, we could probably collapse the .kibana_userX index into the block with the other permissions.
- We have to specify “indices:admin/mappings/*” permissions, otherwise users are unable to create their own mappings in their own kibana indexes. I can see why these are split out, but reading the mappings and field properties seems generally innocent.
- I can’t have the ROR Kibana plugin installed when I am running proxy_auth blocks. I successfully pass through the proxy auth header, and am redirected to the login screen. Some ability to get around this, as is discussed in Skip Login page for kibana would be useful.
#Thoughts
I’ve seen that Kibana multitenancy is on the roadmap for ROR - perhaps a partnership with own_home would be an efficient path forward?