shield.authc.realms.file1.type: file

shield.authc.realms.file1.order: 0

HERE

2.启动(或重启)elasticsearch

3.创建file based用户

https://www.elastic.co/guide/en/shield/current/defining-roles.html#valid-role-name

https://www.elastic.co/guide/en/shield/current/enable-basic-auth.html

/opt/elasticsearch-2.3.2/bin/shield/esusers useradd es_admin -p P@ssw0rd -r admin

/opt/elasticsearch-2.3.2/bin/shield/esusers useradd kibana -p P@ssw0rd -r kibana4_server

[root@ela-client ~]# /opt/elasticsearch-2.3.2/bin/shield/esusers list

es_admin       : admin

kibana         : kibana4_server

/opt/elasticsearch-2.3.2/config/shield/users

/opt/elasticsearch-2.3.2/config/shield/users_roles

5.测试用户认证

[root@ela-client ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_cat/health?v'

epoch      timestamp cluster               status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent

1462705707 19:08:27  elasticsearch_cluster green           6         2     52  26    0    0       0             0                  -                100.0%

[root@ela-client ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_cat/indices?v'

health status index               pri rep docs.count docs.deleted store.size pri.store.size

green  open   shakespeare           5   1     111396            0     36.5mb         18.2mb

green  open   logstash-2015.05.20   5   1       4750            0     72.9mb         35.7mb

green  open   bank                  5   1       1000            0    890.5kb       447.9kb

green  open   .kibana               1   1          4            0     44.5kb        22.2kb

green  open   logstash-2015.05.18   5   1       4631            0     64.9mb         32.7mb

green  open   logstash-2015.05.19   5   1       4624            0     66.7mb           32mb

shield.authc.realms.native1.type: native

shield.authc.realms.native1.order: 0

HERE

2.启动(或重启)elasticsearch

3.创建native用户

curl -u es_admin:P@ssw0rd -XPOST 'http://localhost:9200/_shield/user/fooadmin' -d '

{

"password" : "foo.123",

"roles" : [ "admin", "other_role1" ],

"full_name" : "Jlive Liu",

"email" : "iliujun_live@163.com",

"metadata" : {

"intelligence" : 7

}

}

'

说明:

1.新增native用户也需要认证，但启用了shield之后默认是没有native用户的，所以就需要借助file based用户来授权

2.native用户是存放在elasticsearch集群中，集群中的所有节点会自动同步

[root@ela-client ~]# curl -u es_admin:P@ssw0rd -XPOST 'http://localhost:9200/_shield/user/fooadmin' -d '

{

"password" : "foo.123",

"roles" : [ "admin", "other_role1" ],

"full_name" : "Jlive Liu",

"email" : "iliujun_live@163.com",

"metadata" : {

"intelligence" : 7

}

}

'

{"user":{"created":true}}

[root@ela-data1 ~]# curl -u es_admin:P@ssw0rd 'http://localhost:9200/_shield/user'

{"fooadmin":{"username":"fooadmin","roles":["admin","other_role1"],"full_name":"Jlive Liu","email":"iliujun_live@163.com","metadata":{"intelligence":7}}}

4.测试用户认证

[root@ela-master2 ~]# curl -u fooadmin:foo.123 'http://localhost:9200/_cat/health?v'

epoch      timestamp cluster               status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent

1462707192 19:33:12  elasticsearch_cluster green           6         2     54  27    0    0       0             0                  -                100.0%