Logstash to support SPNEGO + Kerberos authentication to Elasticsearch

[jakelandis]

Elasticsearch is implementing a Kerberos realm and Logstash should support this authentication via Kerberos.

More specifically Keberos is being implemented as SPNEGO + Keberos, which is a Base64 encoded token sent in the "Negotiate" header of the HTTP request.

At a high level the following changes will be needed for Logstash:

• Ability to use JAAS to Authenticate against a Kerberos keytab
• Ability to Generate a SPNEGO token via the GSSAPI
• Provide a means for the plugins to obtain the token needed for the Negotiate header
• Update plugins to send the correct header.

Note - the Apache HTTP client offers SPNEGO + Kerberos support, which may be used. However, since there is a mix of Java and Ruby clients, and the access to Apache HTTP client is via Manticore, more research would be needed to see if this would be helpful. Also, the use of the Apache HTTP client wouldn't obviate the need to authenticate via Kerberos and a keytab.

[loekvangool]

Related Tickets:

• Elasticsearch - Kerberos support elasticsearch#30243
• Beats - Kerberos Authentication for Elasticsearch beats#7404
• Kibana - Add Kerberos Realm kibana#18188