The LDAP URLs used to authenticate against, in the format ldap[s]://server:port. Note that ldap and ldaps protocols cannot be mixed together.
bind_anonymouslybooleanrequired
When true, bindDb credentials are ignored
bind_typeenumrequired
The type of user binding to apply
Values:user_searchuser_templates
group_searchobject
The group search configuration for the Elasticsearch security LDAP realm.
base_dnstring
Specifies a container DN to search for groups in which the user has membership
scopeenum
Specifies whether the group search should be sub_tree, one_level or base. one_level only searches objects directly contained within the base_dn. The default sub_tree searches all objects contained under base_dn. base specifies that the base_dn is a group object, and that it is the only group considered.
Values:sub_treeone_levelbase
filterstring
Specifies a filter to search for a group. When unspecified, the security realm searches for group, groupOfNames, groupOfUniqueNames, or posixGroup with the attributes member, memberOf, or memberUid. Any instance of {0} in the filter is replaced by the user attribute defined in user_attribute.
user_attributestring
Specifies the user attribute that is fetched and provided as a parameter to the filter. When unspecified, the user DN is passed to the filter.
user_searchobject
The user search configuration for the Elasticsearch security LDAP realm.
base_dnstring
Specifies a container DN to search for users
scopeenum
The scope of the user search. Valid values are sub_tree, one_level, or base. one_level only searches objects directly contained in the base_dn. sub_tree searches all objects contained in base_dn. base specifies that the base_dn is the user object, and that it is the only user considered. Defaults to sub_tree.
Values:sub_treeone_levelbase
filterstring
Specifies the filter to search the directory and match an entry with the username provided by the user. Defaults to (uid={0}). {0} is substituted with the username provided when searching.
user_dn_templatesstring[]
The distinguished name template that replaces the user name with the string {0}. Only used when bind_type is set to 'user_templates'.
bind_dnstring
The distinguished name of the user that is used to bind to the LDAP and perform searches. Only used when bind_type is set to 'user_search'.
bind_passwordstring
The user password that is used to bind to the LDAP server. Only used when bind_type is set to 'user_search'.
user_group_attributestring
Specifies the attribute to examine on the user for group membership. If any 'group_search' settings are specified, this setting is ignored. Defaults to 'memberOf'.
load_balanceobject
The load balancing configuration for the Elasticsearch security LDAP realm.
typeenum
The behavior to use when there are multiple LDAP URLs defined
When using dns_failover or dns_round_robin as the load balancing type, this setting controls the amount of time to cache DNS lookups. Defaults to 1h.
certificate_urlstring
The SSL trusted CA certificate bundle URL. The bundle should be a zip file containing a single keystore file 'keystore.ks' in the directory '/ldap/:id/truststore', where :id is the value of the [id] field.
certificate_url_truststore_passwordstring
The password to the certificate bundle URL truststore
certificate_url_truststore_typeenum
The format of the truststore file. Should be jks to use the Java Keystore format or PKCS12 to use PKCS#12 files. The default is jks.
Values:jksPKCS12
role_mappingsobject
The role mapping ruleset for the Elasticsearch security LDAP realm.
default_rolesstring[]required
The default roles applied to all users
rulesobject[]required
The role mapping rules to evaluate
typeenumrequired
The type of role mapping rule
Values:user_dngroup_dn
rolesstring[]required
The roles that are applied when the mapping rule is successfully evaluated
valuestringrequired
The value to match when evaluating this rule
enabledboolean
When true, enables the security realm
orderinteger · format: int32
The order that the security realm is evaluated
override_yamlstring
Advanced configuration options in YAML format. Any settings defined here will override any configuration set via the API. Note that all keys should omit the 'xpack.security.authc.realms.ldap.{realm_id}' prefix. For example, when the realm ID is set to 'ldap1', the advanced configuration 'xpack.security.authc.realms.ldap.ldap1.ssl.verification_mode: full' should be added as 'ssl.verification_mode: full'.