美文网首页Elastic/日志分析
ElasticSearch结合LDAP实现权限、用户管控

ElasticSearch结合LDAP实现权限、用户管控

作者: Super岩岩 | 来源:发表于2019-08-16 17:27 被阅读0次

    项目背景
    使用ElasticSearch实现数据宽表，处理热交互数据，需要实现权限管控等功能，权限粒度要求精确到列。
    最初考虑使用Es的SearchGuard开源插件，发现SearchGuard的LDAP功能需要使用企业版，收费的，并且权限粒度仅支持到索引和type，并不支持列；
    后来采用Es提供的xpack插件，想办法处理下，就不收费了。

    Es需要安装xpack插件，配置默认用户，修改elastic用户的密码为elastic，后续使用简单点

    注意，本文只记录ElasticSearch结合LDAP和内置角色，实现列级别的权限管控，不管SSL和TLS加密传输

    ElasticSearch、Kibana配置
    /conf/elasticsearch.yml中这么添加

    xpack.security.enabled:  true
xpack:
 security:
    authc:
      realms:
        ldap1:
          type: ldap
          order: 0
          url: "ldap://192.168.13.12"
          bind_dn: "cn=root,dc=intelli706,dc=com" #ldap管理账户dn
          bind_password: 123456 #ldap管理账户密码
          user_search:
            base_dn: "dc=intelli706,dc=com" #在这个目录树里面检索用户信息
            attribute: uid
          group_search:
            base_dn: "dc=intelli706,dc=com" # 在这个目录树里面检索组信息
          files:
            # 下面这个是通过文件方式配置的LDAP用户域和Es内置角色的映射关系
            role_mapping: "D:\\elasticsearch\\es-xpack\\esnew\\elasticsearch-6.8.0\\config\\role_mapping.yml"
          unmapped_groups_as_roles: false

    role_mapping.yml，可配置可不配，就放这里参考下，一般通过api配置映射关系

    # Role mapping configuration file which has elasticsearch roles as keys
# that map to one or more user or group distinguished names

#roleA:   this is an elasticsearch role
#  - groupA-DN  this is a group distinguished name
#  - groupB-DN
#  - user1-DN   this is the full user distinguished name

#power_user:
#  - "cn=admins,dc=example,dc=com"
#user:
#  - "cn=users,dc=example,dc=com"
#  - "cn=admins,dc=example,dc=com"
#  - "cn=John Doe,cn=other users,dc=example,dc=com"
superuser:
  - "cn=admin,ou=person,dc=intelli706,dc=com"
  - "cn=zhangyan,ou=person,dc=intelli706,dc=com"

    /conf/kibana.yml配置，主要添加了es的用户名密码

    elasticsearch.username: "elastic"
elasticsearch.password: "elastic"

    再启动ES和kibana后，就需要输入用户名密码才能登陆和访问ES中数据了

    LDAP
    搭建过程省略；

    创建dn时，使用的objectClass是inetOrgPerson
    rdn设置为cn=admin, sn=admin, uid=admin, userPassword=admin

    使用LDAP Admin windows客户端，连接LDAP服务器，添加组（ou），和模拟用户（cn=admin）,生成的dn为 cn=admin,ou=person,dc=intelli,dc=com，简单说明下，LDAP采用树形目录存储结构，cn=admin,ou=person,dc=intelli,dc=com就是一个dn（Distinguish Name），也就是一个唯一ID，能看出来这个是一个目录树的路径，所以能唯一标识entry信息（类似数据库里的一条）

    验证admin用户，通过admin账户和admin的密码访问ES的/_xpack/security/_authenticate接口，能看到用户的信息

    GET /_xpack/security/_authenticate -u admin:admin
返回：
{
  "username": "admin",
  "roles": [], #注意，还没有绑定任何角色，现在角色是空的
  "full_name": null,
  "email": null,
  "metadata": {
    "ldap_dn": "cn=admin,ou=person,dc=intelli706,dc=com", #admin账户的dn
    "ldap_groups": []
  },
  "enabled": true,
  "authentication_realm": {
    "name": "ldap1", #能看到使用ldap方式获取用户了
    "type": "ldap"
  },
  "lookup_realm": {
    "name": "ldap1",
    "type": "ldap"
  }
}

    以下操作用elastic:elastic账户管理

    Api方式查询ES中的角色
    Kibana界面中其实可以在Management界面中管控角色和内置用户，这里使用Api方式，方便代码调用

    GET /_xpack/security/role

    注意，使用使用http方式请求时，需要制定Basic Auth的用户名和密码分别为elastic，现在加权限了，请求不带用户名和密码该驳回了。

    创建角色
    创建一个角色，并给这个角色一个索引权限，能读取索引中的一部分列

    POST / _xpack / security / role / <rolename>

POST / _xpack / security / role /xsjc
{
  "cluster": ["all"],
  "indices": [
    {
      "names": [ "tyyw*"],
      "privileges": ["read"],
      "field_security" : {
        "grant" : [ "TYYW_2001_AJ__CBDW_MC", "TYYW_2001_AJ__CBDW_MC.keyword" ]
      }
    }
  ]
}
返回：
{
  "role": {
    "created": true
  }
}

    查询角色

    GET /_xpack/security/role #查询所有角色
GET /_xpack/security/role/xsjc #查询指定角色

    返回

    {
  "xsjc": {
    "cluster": [
      "all"
    ],
    "indices": [
      {
        "names": [
          "tyyw*"
        ],
        "privileges": [
          "read"
        ],
        "field_security": {
          "grant": [
            "TYYW_2001_AJ__CBDW_MC",
            "TYYW_2001_AJ__CBDW_MC.keyword" #注意，这个角色只给这两列的read权限
          ]
        },
        "allow_restricted_indices": false
      }
    ],
    "applications": [],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

    给用户绑定角色
    本质上是创建一个用户和角色的映射关系，<user_role_map_name>就是这个角色和映射关系的名称

    POST /_xpack/security/role_mapping/<user_role_map_name>

POST /_xpack/security/role_mapping/zhangyan_role
{
    "enabled": true,
    "roles": "xsjc",
    "rules": {
        "field": {
            "dn": "cn=zhangyan,ou=person,dc=intelli706,dc=com"
        }
    }
}
返回：
{
  "role_mapping": {
    "created": true
  }
}

    查询用户_角色绑定映射关系

    GET /_xpack/security/role_mapping #查询所有的用户_角色映射关系

GET /_xpack/security/role_mapping/zhangyan_role #查询指定的用户_角色映射关系
返回：
{
  "zhangyan_role": {
    "enabled": true,
    "roles": [
      "xsjc"
    ],
    "rules": {
      "field": {
        "dn": "cn=zhangyan,ou=person,dc=intelli706,dc=com"
      }
    },
    "metadata": {}
  }
}

    查询用户信息

     GET /_xpack/security/_authenticate -u zhangyan:zhangyan
返回:
{
  "username": "zhangyan",
  "roles": [
    "xsjc" # 可以看到已经有权限了
  ],
  "full_name": null,
  "email": null,
  "metadata": {
    "ldap_dn": "cn=zhangyan,ou=person,dc=intelli706,dc=com",
    "ldap_groups": []
  },
  "enabled": true,
  "authentication_realm": {
    "name": "ldap1",
    "type": "ldap"
  },
  "lookup_realm": {
    "name": "ldap1",
    "type": "ldap"
  }
}

    使用zhangyan账户，查询es
    可以留意下，返回的数据source中只有TYYW_2001_AJ__CBDW_MC列

    {
  "took": 79,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 201,
    "max_score": 1.0,
    "hits": [
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100176",
        "_score": 1.0,
        "_source": {
          "TYYW_2001_AJ__CBDW_MC": "河北省院"
        }
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100063",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100184",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100146",
        "_score": 1.0,
        "_source": {
          "TYYW_2001_AJ__CBDW_MC": "广东省院"
        }
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100092",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100096",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "央检刑捕受[2019]770000100038",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "西检刑捕受[2019]770000100005",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100080",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100163",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "央检刑捕受[2019]770000100040",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100093",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100151",
        "_score": 1.0,
        "_source": {
          "TYYW_2001_AJ__CBDW_MC": "汉东省院"
        }
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100179",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "区检刑捕受[2019]770000100108",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100058",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100183",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "市检刑捕受[2019]770000100091",
        "_score": 1.0,
        "_source": {
          "TYYW_2001_AJ__CBDW_MC": "汉东省院"
        }
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "东检刑捕受[2019]770000100189",
        "_score": 1.0,
        "_source": {}
      },
      {
        "_index": "tyyw_xsjc_0731",
        "_type": "_doc",
        "_id": "央检刑捕受[2019]770000100043",
        "_score": 1.0,
        "_source": {}
      }
    ]
  },
  "aggregations": {
    "test": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": []
    }
  }
}

    相关文章

      网友评论

        本文标题：ElasticSearch结合LDAP实现权限、用户管控

        本文链接：https://www.haomeiwen.com/subject/eeafsctx.html

        延伸阅读

        深度阅读

        • 您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！

        栏目导航

        热点阅读

        Elastic/日志分析

        关于我们|服务条款|联系我们|ElasticSearch结合LDAP实现权限、用户管控|投稿指南|网站地图|RSS订阅|排版工具|手机版

        提供经典美文摘抄,优美散文欣赏,现代诗歌精选,短篇小说,心情随笔,表白情书范文,故事会在线阅读欣赏

        Copyright © 2014-2023 Haomeiwen.com All Rights Reserved. 好美文阅读网 版权所有

        备案信息：桂公网安备 45052102000051号 · 桂ICP备13007215号-3

        本站所收录作品、热点评论等信息部分来源互联网，目的只是为了系统归纳学习和传递资讯

        所有作品版权归原创作者所有，与本站立场无关，如不慎侵犯了你的权益，请联系我们告知，我们将做删除处理！