You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can manage and authenticate users with the built-in `file` realm. With the `file` realm, users are defined in local files on each node in the cluster.
18
18
19
-
The `file` realm is useful as a fallback or recovery realm. For example in cases where the cluster is unresponsive or the security index is unavailable, or when you forget the password for your administrative users. In this type of scenario, the `file` realm is a convenient workaround: you can define a new `admin` user in the `file` realm and use it to log in and reset the credentials of all other users. For more information, see [file-based recovery](/troubleshoot/elasticsearch/file-based-recovery.md).
20
-
21
-
Refer to [enabling a file realm user for recovery](https://www.youtube.com/watch?v=sueO7sz1buw) for a video walkthrough.
19
+
The `file` realm is useful as a fallback or recovery realm. For example, you might use this realm in cases where the cluster is unresponsive or the security index is unavailable, or when you forget the password for your administrative users. In this type of scenario, the `file` realm is a convenient workaround: you can define a new `admin` user in the `file` realm and use it to log in and reset the credentials of all other users. For a walkthrough of this process, refer to [](/troubleshoot/elasticsearch/file-based-recovery.md). Refer to [enabling a file realm user for recovery](https://www.youtube.com/watch?v=sueO7sz1buw) for a video walkthrough.
22
20
23
21
::::{important}
24
22
* In self-managed deployments, as the administrator of the cluster, it is your responsibility to ensure the same users are defined on every node in the cluster. The {{stack}} {{security-features}} do not deliver any mechanism to guarantee this.
@@ -27,7 +25,7 @@ Refer to [enabling a file realm user for recovery](https://www.youtube.com/watch
27
25
28
26
## Configure a file realm [file-realm-configuration]
29
27
30
-
You don’t need to explicitly configure a `file` realm. The `file` and `native` realms are added to the realm chain by default. Unless configured otherwise, the `file` realm is added first, followed by the `native` realm. You can define only one `file` realm per node.
28
+
You don’t need to explicitly configure a `file` realm. The `file` and `native` realms are added to the realm chain by default. Unless configured otherwise, the `file` realm is added first, followed by the `native` realm. You can define only one `file` realm on each node.
31
29
32
30
1. (Optional) Add a realm configuration to [`elasticsearch.yml`](/deploy-manage/stack-settings.md) under the `xpack.security.authc.realms.file` namespace. At a minimum, you must set the realm’s `order` attribute.
33
31
@@ -37,15 +35,17 @@ You don’t need to explicitly configure a `file` realm. The `file` and `native`
37
35
xpack.security.authc.realms.file.file1.order: 0
38
36
```
39
37
40
-
2. (Optional) For self-managed deployments, you may change how often the `users` and `users_roles` files are checked.
38
+
2. (Optional) For self-managed deployments, you can change how often the `users` and `users_roles` files are checked.
41
39
42
40
By default, {{es}} checks these files for changes every 5 seconds. You can change this default behavior by changing the `resource.reload.interval.high` setting in the [`elasticsearch.yml`](/deploy-manage/stack-settings.md) file.
43
41
44
42
:::{{warning}}
45
43
Because `resource.reload.interval.high` is a common setting in {{es}}, changing its value may effect other schedules in the system.
46
44
:::
47
45
48
-
3. In self-managed deployments, if either prior setting is modified, you will need to [rolling restart](/deploy-manage/maintenance/start-stop-services/full-cluster-restart-rolling-restart-procedures.md#restart-cluster-rolling) those {{es}} nodes for your changes to take effect. In {{eck}}, changes are automatically propagated.
46
+
3. In self-managed deployments, if of these settings is modified, perform a [rolling restart](/deploy-manage/maintenance/start-stop-services/full-cluster-restart-rolling-restart-procedures.md#restart-cluster-rolling) of the {{es}} nodes for your changes to take effect.
47
+
48
+
In {{eck}}, changes are automatically propagated.
49
49
50
50
51
51
## Add users
@@ -110,13 +110,13 @@ In a self-managed cluster, you can edit the contents of `ES_PATH_CONF/users` and
110
110
:::{tab-item} {{eck}}
111
111
You can pass `users` and `user_roles` files to {{eck}} using a file realm secret:
0 commit comments