So i would like to authenticate the users using JWT Token, In the documentation i have read we can pass the roles permission and the user name in the jwt token,
How can we define the indices policy per user , In my case
User john need access with perimeter-customerA-2018-11-09 and
User peter need access with perimeter-customerB-2018-11-09
In the below how can we map the user with indices
readonlyrest:
access_control_rules:
- name: Valid JWT token with a viewer role
kibana_access: ro
jwt_auth:
name: "jwt_provider_1"
roles: ["viewer"]
- name: Valid JWT token with a writer role
kibana_access: rw
jwt_auth:
name: "jwt_provider_1"
roles: ["writer"]
jwt:
- name: jwt_provider_1
signature_algo: RSA
signature_key: "your_signature"
user_claim: email
roles_claim: resource_access.client-app.roles # JSON-path style
header_name: Authorization
You can refer to the current username as a dynamic variable within many rules, including the indices rule. To follow your requirement, something like this would probably do the trick:
readonlyrest:
access_control_rules:
- name: Valid JWT token with a viewer role
kibana_access: ro
jwt_auth:
name: "jwt_provider_1"
roles: ["viewer"]
indices: [".kibana", "perimeter-@user-*"]
- name: Valid JWT token with a writer role
indices: [".kibana", "perimeter-@user-*"]
kibana_access: rw
jwt_auth:
name: "jwt_provider_1"
roles: ["writer"]
jwt:
- name: jwt_provider_1
signature_algo: RSA
signature_key: "your_signature"
user_claim: email
roles_claim: resource_access.client-app.roles # JSON-path style
header_name: Authorization
Notice how:
You need to allow the .kibana index within the list of allowed indices for kibana users
The order in which you write the rules inside an ACL block does not count (I added the indices rule in different places in two similar ACL blocks).
(The number 1,2,3,4,5 presented in the above indices are respective customer id’s)
But in user name ,i have to allow for some users to access more than one customer id’s
indices: [".kibana", "perimeter-@user-*"]
Hope in the above @user will get the details from jwt claim of the user. but i have to map the different customer indices to specific user at run time.
Is there any possible way to send the multiple customerid’s by jwt and using dynamically
indices: [".kibana", "perimeter-@customerid-*",]
or
Is there any way to pass the indices dynamically with jwt token claim
We are working on a multi tenant solution for our Logging cluster. This would definitely help in keeping the configuration on the readonlyrest side to the minimal and do most of the processing on our side and send the details in an encrypted JWT token.
We should also use “explode” keyword in example above. “Explode” is used to split CSV variable and scatter the elements into an array (“explode” can be used only inside array context).
Without “explode” we’re going to get sth like that:
# Referencing array-typed values from JWT claims will expand in a list of strings
indices: [ ".kibana_@{jwt:allowedIndices}", "otherIdx"]
# claims = {"username": "u1", "allowedIndices": ["x", "y"] }
# -> indices: [".kibana_x,y", "otherIdx"]
So if we reference a claim of type Array, it will be serialised to comma-separated string, unless we use “explode”? And this is valid also for rules that accept array values like “indices”?