Skip to content

Commit c1aed6f

Browse files
authored
Adjust file realm docs (#52471) (#52747)
The existing wording in the file realm docs proved confusing for users as it seemed to indicate that it should _only_ be used as a fallback/recovery realm and that it is not a first class realm. This change attempts to clarify this and point out that recovery is _a_ use case for the file realm but not the only intended one.
1 parent df1fa68 commit c1aed6f

File tree

1 file changed

+12
-8
lines changed

1 file changed

+12
-8
lines changed

x-pack/docs/en/security/authentication/file-realm.asciidoc

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,21 @@ With the `file` realm, users are defined in local files on each node in the clus
77

88
IMPORTANT: As the administrator of the cluster, it is your responsibility to
99
ensure the same users are defined on every node in the cluster. The {stack}
10-
{security-features} do not deliver any mechanism to guarantee this.
10+
{security-features} do not deliver any mechanism to guarantee this. You should
11+
also be aware that you cannot add or manage users in the `file` realm via the
12+
<<security-user-apis, user APIs>> and you cannot add or manage them in {kib} on the
13+
*Management / Security / Users* page
1114

12-
The `file` realm is primarily supported to serve as a fallback/recovery realm. It
13-
is mostly useful in situations where all users locked themselves out of the system
14-
(no one remembers their username/password). In this type of scenarios, the `file`
15-
realm is your only way out - you can define a new `admin` user in the `file` realm
16-
and use it to log in and reset the credentials of all other users.
15+
The `file` realm is very useful as a fallback or recovery realm. For example in cases where
16+
the cluster is unresponsive or the security index is unavailable, or when you forget the
17+
password for your administrative users.
18+
In this type of scenario, the `file` realm is a convenient way out - you can
19+
define a new `admin` user in the `file` realm and use it to log in and reset the
20+
credentials of all other users.
1721

1822
IMPORTANT: When you configure realms in `elasticsearch.yml`, only the realms you
19-
specify are used for authentication. To use the `file` realm as a fallback, you
20-
must include it in the realm chain.
23+
specify are used for authentication. To use the `file` realm you must explicitly
24+
include it in the realm chain.
2125

2226
To define users, the {security-features} provide the
2327
{ref}/users-command.html[users] command-line tool. This tool enables you to add

0 commit comments

Comments
 (0)