summaryrefslogtreecommitdiffstats
path: root/components/aai-elasticsearch/resources/config/sg/sg_config.yml
diff options
context:
space:
mode:
Diffstat (limited to 'components/aai-elasticsearch/resources/config/sg/sg_config.yml')
-rw-r--r--components/aai-elasticsearch/resources/config/sg/sg_config.yml123
1 files changed, 0 insertions, 123 deletions
diff --git a/components/aai-elasticsearch/resources/config/sg/sg_config.yml b/components/aai-elasticsearch/resources/config/sg/sg_config.yml
deleted file mode 100644
index d0050e0..0000000
--- a/components/aai-elasticsearch/resources/config/sg/sg_config.yml
+++ /dev/null
@@ -1,123 +0,0 @@
-# This is the main Search Guard configuration file where authentication
-# and authorization is defined.
-#
-# You need to configure at least one authentication domain in the authc of this file.
-# An authentication domain is responsible for extracting the user credentials from
-# the request and for validating them against an authentication backend like Active Directory for example.
-#
-# If more than one authentication domain is configured the first one which succeeds wins.
-# If all authentication domains fail then the request is unauthenticated.
-# In this case an exception is thrown and/or the HTTP status is set to 401.
-#
-# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
-# the roles from a given backend for the authenticated user.
-#
-# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both.
-# http_enabled: true
-# transport_enabled: true
-#
-# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility.
-#
-# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to
-# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated.
-# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous"
-# and one role named "sg_anonymous_backendrole".
-# If you enable anonymous authentication all HTTP authenticators will not challenge.
-#
-#
-# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert"
-# first and the challenging one last.
-# Because it's not possible to challenge a client with two different authentication methods (for example
-# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation
-# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request.
-#
-# Default value of the challenge flag is true.
-#
-#
-# HTTP
-# basic (challenging)
-# proxy (not challenging, needs xff)
-# clientcert (not challenging, needs https)
-# host (not challenging) #DEPRECATED, will be removed in a future version.
-# host based authentication is configurable in sg_roles_mapping
-
-# Authc
-# internal
-# noop
-
-# Authz
-# noop
-
-# Some SearchGuard functionality is licensed under Apache-2.0, while other functionality is non-free;
-# see https://github.com/floragunncom/search-guard. The functionality enabled in this configuration
-# file only include those that are licensed under Apache-2.0. Please use care and review SearchGuard's
-# license details before enabling any additional features here.
-
-searchguard:
- dynamic:
- # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
- # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
- # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
- #filtered_alias_mode: warn
- http:
- anonymous_auth_enabled: false
- xff:
- enabled: false
- internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
- #internalProxies: '.*' # trust all internal proxies, regex pattern
- remoteIpHeader: 'x-forwarded-for'
- proxiesHeader: 'x-forwarded-by'
- #trustedProxies: '.*' # trust all external proxies, regex pattern
- ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
- ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
- ###### and here https://tools.ietf.org/html/rfc7239
- ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
- authc:
- basic_internal_auth_domain:
- http_enabled: true
- transport_enabled: true
- order: 2
- http_authenticator:
- type: basic
- challenge: true
- authentication_backend:
- type: intern
- proxy_auth_domain:
- http_enabled: false
- transport_enabled: false
- order: 3
- http_authenticator:
- type: proxy
- challenge: false
- config:
- user_header: "x-proxy-user"
- roles_header: "x-proxy-roles"
- authentication_backend:
- type: noop
- jwt_auth_domain:
- http_enabled: false
- transport_enabled: false
- order: 0
- http_authenticator:
- type: jwt
- challenge: false
- config:
- signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
- jwt_header: "Authorization"
- jwt_url_parameter: null
- roles_key: null
- subject_key: null
- authentication_backend:
- type: noop
- clientcert_auth_domain:
- http_enabled: true
- transport_enabled: true
- order: 1
- http_authenticator:
- type: clientcert
- config:
- username_attribute: cn #optional, if omitted DN becomes username
- challenge: false
- authentication_backend:
- type: noop
- authz: \ No newline at end of file