|
1 | 1 | --- |
2 | | -navigation_title: "Access" |
| 2 | +navigation_title: "Users and roles" |
3 | 3 | mapped_pages: |
4 | 4 | - https://www.elastic.co/guide/en/serverless/current/project-settings-access.html |
| 5 | +applies: |
| 6 | + serverless: all |
| 7 | + hosted: all |
| 8 | + ece: all |
| 9 | + eck: all |
| 10 | + stack: all |
5 | 11 | --- |
6 | 12 |
|
| 13 | +# Manage users and roles |
7 | 14 |
|
| 15 | +To prevent unauthorized access to your Elastic resources, you need a way to identify users and validate that a user is who they claim to be (*authentication*), and control what data users can access and what tasks they can perform (*authorization*). |
8 | 16 |
|
9 | | -# Manage users and roles [project-settings-access] |
| 17 | +The methods that you use to authenticate users and control access depends on the way Elastic is deployed. |
10 | 18 |
|
| 19 | +::::{note} |
| 20 | +Preventing unauthorized access is only one element of a complete security strategy. To secure your Elastic environment, you can also do the following: |
| 21 | + |
| 22 | +* Restrict the nodes and clients that can connect to the cluster using [traffic filters](/deploy-manage/security/traffic-filtering.md). |
| 23 | +* Take steps to maintain your data integrity and confidentiality by [encrypting HTTP and inter-node communications](/deploy-manage/security/secure-endpoints.md), as well as [encrypting your data at rest](/deploy-manage/security/encrypt-deployment.md). |
| 24 | +* Maintain an [audit trail](/deploy-manage/monitor/logging-configuration/security-event-audit-logging.md) for security-related events. |
| 25 | +* Control access to dashboards and other saved objects in your UI using [{{kib}} spaces](/deploy-manage/manage-spaces.md). |
| 26 | +* Connect your cluster to a [remote cluster](/deploy-manage/remote-clusters.md) to enable cross-cluster replication and search. |
| 27 | +* Manage [API keys](/deploy-manage/api-keys.md) used for programmatic access to Elastic. |
| 28 | +:::: |
11 | 29 |
|
12 | | -Go to **Project settings**, then ** Management** to manage your indices, data views, saved objects, settings, and more. You can also open Management by using the [global search field](../explore-analyze/find-and-organize/find-apps-and-objects.md). |
| 30 | +## Cloud organization level |
13 | 31 |
|
14 | | -Access to individual features is governed by Elastic user roles. Consult your administrator if you do not have the appropriate access. To learn more about roles, refer to [Assign user roles and privileges](users-roles/cloud-organization/manage-users.md#general-assign-user-roles). |
| 32 | +:::{applies} |
| 33 | +:hosted: all |
| 34 | +:serverless: all |
| 35 | +::: |
15 | 36 |
|
16 | | -| Feature | Description | Available in | |
17 | | -| --- | --- | --- | |
18 | | -| [Organization members](api-keys/serverless-project-api-keys.md) | Invite and manage your team’s access to your organization. | [](../solutions/search.md)[](../solutions/observability.md)[](../solutions/security/elastic-security-serverless.md) | |
19 | | -| [Project API keys](api-keys/serverless-project-api-keys.md) | Create and manage keys that can interact with your project’s data. | [](../solutions/search.md)[](../solutions/observability.md)[](../solutions/security/elastic-security-serverless.md) | |
20 | | -| [Custom roles](users-roles/cloud-organization/user-roles.md) | Create and manage custom roles for your users. | [](../solutions/search.md)[](../solutions/security/elastic-security-serverless.md) | |
| 37 | +If you’re using {{ecloud}}, then you can perform the following tasks to control access to your Cloud organization, your Cloud Hosted deployments, and your Cloud Serverless projects: |
| 38 | + |
| 39 | +* [Invite users to join your organization](/deploy-manage/users-roles/cloud-organization/manage-users.md) |
| 40 | +* Assign [user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md): |
| 41 | + * Manage organization-level roles and high-level access to deployments and projects. |
| 42 | + * Assign project-level roles and [create custom roles](/deploy-manage/users-roles/custom-roles.md). ({{serverless-short}} only) |
| 43 | +* Configure [SAML single sign-on](/deploy-manage/users-roles/cloud-organization/configure-saml-authentication.md) for your organization |
| 44 | + |
| 45 | +::::{tip} |
| 46 | +For {{ech}} deployments, you can configure SSO at the organization level, the deployment level, or both. Refer to [Cloud organization users](/deploy-manage/users-roles/cloud-organization.md#organization-deployment-sso) for more information. |
| 47 | +:::: |
| 48 | + |
| 49 | +{{ech}} deployments can also use [cluster-level authentication and authorization](/deploy-manage/users-roles/cluster-or-deployment-auth.md). Cluster-level auth features are not available for {{serverless-full}}. |
| 50 | + |
| 51 | +## Orchestrator level |
| 52 | + |
| 53 | +:::{applies} |
| 54 | +:ece: all |
| 55 | +::: |
| 56 | + |
| 57 | +Control access to your {{ece}} [orchestrator](/deploy-manage/deploy/cloud-enterprise/deploy-an-orchestrator.md) and deployments. |
| 58 | + |
| 59 | +* [Manage passwords for default users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-system-passwords.md) |
| 60 | +* [Manage orchestrator users and roles](/deploy-manage/users-roles/cloud-enterprise-orchestrator/manage-users-roles.md): |
| 61 | + * [Using native users](/deploy-manage/users-roles/cloud-enterprise-orchestrator/native-user-authentication.md) |
| 62 | + * By integrating with external authentication providers: |
| 63 | + * [Active Directory](/deploy-manage/users-roles/cloud-enterprise-orchestrator/active-directory.md) |
| 64 | + * [LDAP](/deploy-manage/users-roles/cloud-enterprise-orchestrator/ldap.md) |
| 65 | + * [SAML](/deploy-manage/users-roles/cloud-enterprise-orchestrator/saml.md) |
| 66 | +* [Configure single sign-on to deployments](/deploy-manage/users-roles/cloud-enterprise-orchestrator/configure-sso-for-deployments.md) for orchestrator users |
| 67 | + |
| 68 | + ::::{tip} |
| 69 | + For {{ece}} deployments, you can configure SSO at the orchestrator level, the deployment level, or both. |
| 70 | + :::: |
| 71 | + |
| 72 | +{{ece}} deployments can also use [cluster-level authentication and authorization](/deploy-manage/users-roles/cluster-or-deployment-auth.md). |
| 73 | + |
| 74 | +:::{note} |
| 75 | +You can't manage users and roles for {{eck}} clusters at the orchestrator level. {{eck}} deployments use cluster-level authentication and authorization only. |
| 76 | +::: |
| 77 | + |
| 78 | +## Project level |
| 79 | + |
| 80 | +:::{applies} |
| 81 | +:serverless: all |
| 82 | +::: |
| 83 | + |
| 84 | +As an extension of the [predefined instance access roles](/deploy-manage/users-roles/cloud-organization/user-roles.md#ec_instance_access_roles) offered for {{serverless-short}} projects, you can create custom roles at the project level to provide more granular control, and provide users with only the access they need within specific projects. |
| 85 | + |
| 86 | +[Learn more about custom roles for {{serverless-full}} projects](/deploy-manage/users-roles/custom-roles.md). |
| 87 | + |
| 88 | +## Cluster or deployment level |
| 89 | + |
| 90 | +:::{applies} |
| 91 | +:ece: all |
| 92 | +:hosted: all |
| 93 | +:eck: all |
| 94 | +:stack: all |
| 95 | +::: |
| 96 | + |
| 97 | +Set up authentication and authorization at the cluster or deployment level, and learn about the underlying security technologies that Elasticsearch uses to authenticate and authorize requests internally and across services. |
| 98 | + |
| 99 | +### User authentication |
| 100 | + |
| 101 | +Set up methods to identify users to the Elasticsearch cluster. |
| 102 | + |
| 103 | +Key tasks for managing user authentication include: |
| 104 | + |
| 105 | +* [Managing default users](/deploy-manage/users-roles/cluster-or-deployment-auth/built-in-users.md) |
| 106 | +* [Managing users natively](/deploy-manage/users-roles/cluster-or-deployment-auth/native.md) |
| 107 | +* [Integrating with external authentication providers](/deploy-manage/users-roles/cluster-or-deployment-auth/external-authentication.md) |
| 108 | + |
| 109 | +You can also learn the basics of Elasticsearch authentication, learn about accounts used to communicate within an Elasticsearch cluster and across services, and perform advanced tasks. |
| 110 | + |
| 111 | +[View all user authentication docs](/deploy-manage/users-roles/cluster-or-deployment-auth/user-authentication.md) |
| 112 | + |
| 113 | +### User authorization |
| 114 | + |
| 115 | +After a user is authenticated, use role-based access control to determine whether the user behind an incoming request is allowed to execute the request. |
| 116 | + |
| 117 | +Key tasks for managing user authorization include: |
| 118 | + |
| 119 | +* Assigning [built-in roles](/deploy-manage/users-roles/cluster-or-deployment-auth/built-in-roles.md) or [defining your own](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md) |
| 120 | +* [Mapping users and groups to roles](/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles.md) |
| 121 | +* [Setting up field- and document-level security](/deploy-manage/users-roles/cluster-or-deployment-auth/controlling-access-at-document-field-level.md) |
| 122 | + |
| 123 | +You can also learn the basics of Elasticsearch authorization, and perform advanced tasks. |
| 124 | + |
| 125 | +::::{tip} |
| 126 | +User roles are also used to control access to [{{kib}} spaces](/deploy-manage/manage-spaces.md). |
| 127 | +:::: |
| 128 | + |
| 129 | +[View all user authorization docs](/deploy-manage/users-roles/cluster-or-deployment-auth/user-roles.md) |
0 commit comments