Kerberos authentication for browser monitors

Kerberos authentication enables monitoring on single sign-on (SSO) protected sites, usually behind Microsoft Active Directory.

Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. HTTP monitors reach Kerberos-protected endpoints a different way. Rather than the Chromium settings described here, they take a kerberos block in the monitor configuration. Like browser monitors, they only run from Private Locations. For the fields that block takes, refer to the HTTP options.

Browser monitors support for SSO Kerberos authentication natively. Specify the protected domains under playwrightOptions.args:

playwrightOptions: {
  args: [
    '--auth-server-allowlist=*.corp.local,corp.local',
    '--auth-negotiate-delegate-allowlist=*.corp.local',
  ],
}

The hostname must match an entry in --auth-server-allowlist. Matching is hostname-only and supports shell-style wildcards — *.corp.local will not match the bare corp.local.