The Active Directory URLs used to authenticate against, in the format ldap[s]://server:port. Note that ldap and ldaps protocols cannot be mixed together.
domain_namestringrequired
Specifies the domain name of the Active Directory (the forest root domain name).
bind_anonymouslybooleanrequired
When true, bindDb credentials are ignored
group_searchobject
Elasticsearch Security Active Directory realm group search configuration
base_dnstring
Specifies a container DN to search for groups in which the user has membership
scopeenum
Specifies whether the group search should be sub_tree, one_level or base. one_level only searches objects directly contained within the base_dn. The default sub_tree searches all objects contained under base_dn. base specifies that the base_dn is a group object, and that it is the only group considered.
Values:sub_treeone_levelbase
user_searchobject
Elasticsearch Security Active Directory realm user search configuration
base_dnstring
Specifies a container DN to search for users
scopeenum
The scope of the user search. Valid values are sub_tree, one_level, or base. one_level only searches objects directly contained in the base_dn. sub_tree searches all objects contained in base_dn. base specifies that the base_dn is the user object, and that it is the only user considered. Defaults to sub_tree.
Values:sub_treeone_levelbase
filterstring
Specifies the filter to search the directory and match an entry with the username provided by the user. Defaults to (uid={0}). {0} is substituted with the username provided when searching.
bind_dnstring
The distinguished name of the user that is used to bind to the Active Directory and perform searches.
bind_passwordstring
The user password that is used to bind to the Active Directory server.
load_balanceobject
Elasticsearch Security Active Directory load balancing configuration
typeenum
The behavior to use when there are multiple Active Directory URLs defined
When using dns_failover or dns_round_robin as the load balancing type, this setting controls the amount of time to cache DNS lookups. Defaults to 1h.
certificate_urlstring
The SSL trusted CA certificate bundle URL. The bundle should be a zip file containing a single keystore file 'keystore.ks' in the directory '/active_directory/:id/truststore', where :id is the value of the [id] field.
certificate_url_truststore_passwordstring
The password to the certificate bundle URL truststore
certificate_url_truststore_typeenum
The format of the truststore file. Should be jks to use the Java Keystore format or PKCS12 to use PKCS#12 files. The default is jks.
Values:jksPKCS12
role_mappingsobject
Elasticsearch Security Active Directory role mapping rule set
default_rolesstring[]required
The default roles applied to all users
rulesobject[]required
The role mapping rules to evaluate
typeenumrequired
The type of role mapping rule
Values:user_dngroup_dn
rolesstring[]required
The roles that are applied when the mapping rule is successfully evaluated
valuestringrequired
The value to match when evaluating this rule
enabledboolean
When true, enables the security realm
orderinteger · format: int32
The order that the security realm is evaluated
override_yamlstring
Advanced configuration options in YAML format. Any settings defined here will override any configuration set via the API. Note that all keys should omit the 'xpack.security.authc.realms.active_directory.{realm_id}' prefix. For example, when the realm ID is set to 'ad1', the advanced configuration 'xpack.security.authc.realms.active_directory.ad1.ssl.verification_mode: full' should be added as 'ssl.verification_mode: full'.