Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document new xpack.security.authc.* settings and related 8.0.0 breaking changes. #61443

Merged
merged 5 commits into from
Apr 1, 2020
Merged

Document new xpack.security.authc.* settings and related 8.0.0 breaking changes. #61443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9f8d426
Document new `xpack.security.authc.*` settings and related 8.0.0 brea…
azasypkin Mar 26, 2020
57369f8
Merge branch 'master' into issue-xxx-new-authc-docs
azasypkin Mar 31, 2020
ad3ab01
Review#1: handle review comments.
azasypkin Mar 31, 2020
c236aea
Merge branch 'master' into issue-xxx-new-authc-docs
azasypkin Mar 31, 2020
07cfddf
Review#1: do not mention that SAML/OpenID Connect/PKI is meant to be …
azasypkin Mar 31, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 37 additions & 8 deletions docs/migration/migrate_8_0.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,24 +61,53 @@ for example, `logstash-*`.
*Impact:* Use `xpack.security.authc.providers` instead.

[float]
==== `xpack.security.authc.saml.realm` is now mandatory when using the SAML authentication provider
*Details:* Previously Kibana was choosing the appropriate Elasticsearch SAML realm automatically using the `Assertion Consumer Service`
URL that it derived from the actual server address. Starting in 8.0.0, the Elasticsearch SAML realm name that Kibana will use should be
specified explicitly.
==== `xpack.security.authc.providers` has changed value format
*Details:* `xpack.security.authc.providers` setting in the `kibana.yml` has changed value format.

*Impact:* Always define `xpack.security.authc.saml.realm` when using the SAML authentication provider.
*Impact:* Array of provider types as a value is no longer supported, use extended object format instead.

[float]
==== `xpack.security.authc.saml` is no longer valid
*Details:* The deprecated `xpack.security.authc.saml` setting in the `kibana.yml` file has been removed.

*Impact:* Configure SAML authentication providers using `xpack.security.authc.providers.saml.{provider unique name}.*` settings instead.

[float]
==== `xpack.security.authc.oidc` is no longer valid
*Details:* The deprecated `xpack.security.authc.oidc` setting in the `kibana.yml` file has been removed.

*Impact:* Configure OpenID Connect authentication providers using `xpack.security.authc.providers.oidc.{provider unique name}.*` settings instead.

[float]
==== `xpack.security.public` is no longer valid
*Details:* The deprecated `xpack.security.public` setting in the `kibana.yml` file has been removed.
*Details:* Previously Kibana was choosing the appropriate Elasticsearch SAML realm automatically using the `Assertion Consumer Service`
URL that it derived from the actual server address and `xpack.security.public` setting. Starting in 8.0.0, the deprecated `xpack.security.public` setting in the `kibana.yml` file has been removed and the Elasticsearch SAML realm name that Kibana will use should be specified explicitly.

*Impact:* Define `xpack.security.authc.saml.realm` when using the SAML authentication provider instead.
*Impact:* Define `xpack.security.authc.providers.saml.{provider unique name}.realm` when using the SAML authentication providers instead.

[float]
==== `/api/security/v1/saml` endpoint is no longer supported
*Details:* The deprecated `/api/security/v1/saml` endpoint is no longer supported.

*Impact:* Rely on `/api/security/saml/callback` endpoint when using SAML instead. This change should be reflected in Kibana `server.xsrf.whitelist` config as well as in Elasticsearch and Identity Provider SAML settings.
*Impact:* Rely on `/api/security/saml/callback` endpoint when using SAML instead. This change should be reflected in Elasticsearch and Identity Provider SAML settings.

[float]
==== `/api/security/v1/oidc` endpoint is no longer supported
*Details:* The deprecated `/api/security/v1/oidc` endpoint is no longer supported.

*Impact:* Rely on `/api/security/oidc/callback` endpoint when using OpenID Connect instead. This change should be reflected in Elasticsearch and OpenID Connect Provider settings.

[float]
==== `/api/security/v1/oidc` endpoint is no longer supported for Third Party initiated login
*Details:* The deprecated `/api/security/v1/oidc` endpoint is no longer supported for Third Party initiated login.

*Impact:* Rely on `/api/security/oidc/initiate_login` endpoint when using Third Party initiated OpenID Connect login instead. This change should be reflected in Elasticsearch and OpenID Connect Provider settings.

[float]
==== `/api/security/v1/oidc/implicit` endpoint is no longer supported
*Details:* The deprecated `/api/security/v1/oidc/implicit` endpoint is no longer supported.

*Impact:* Rely on `/api/security/oidc/implicit` endpoint when using OpenID Connect Implicit Flow instead. This change should be reflected in OpenID Connect Provider settings.

[float]
=== `optimize` directory is now in the `data` folder
Expand Down
4 changes: 1 addition & 3 deletions docs/setup/settings.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,9 +410,7 @@ all http requests to https over the port configured as `server.port`.
supported protocols with versions. Valid protocols: `TLSv1`, `TLSv1.1`, `TLSv1.2`

`server.xsrf.whitelist:`:: It is not recommended to disable protections for
arbitrary API endpoints. Instead, supply the `kbn-xsrf` header. There are some
scenarios where whitelisting is required, however, such as
<<kibana-authentication, SAML and OpenID Connect Single Sign-On setups>>.
arbitrary API endpoints. Instead, supply the `kbn-xsrf` header.
The `server.xsrf.whitelist` setting requires the following format:

[source,text]
Expand Down
Loading