Prevent boot if bind DN is set without password#118366
Prevent boot if bind DN is set without password#118366elasticsearchmachine merged 15 commits intoelastic:mainfrom
Conversation
n1v0lg
added
>breaking
:Security/Authentication
|
Hi @n1v0lg, I've created a changelog YAML for you. Note that since this PR is labelled |
…g/elasticsearch into ldap-fail-bind-dn-without-password
|
Pinging @elastic/es-security (Team:Security) |
slobodanadamovic
left a comment
slobodanadamovic
left a comment
There was a problem hiding this comment.
LGTM 👍
Left suggestions regarding changelog file, none of which should require another review.
docs/changelog/118366.yaml
Outdated
| impact: -| | ||
| If you have a bind DN configured for an LDAP or AD authentication | ||
| realm, set a bind password for | ||
| [LDAP](https://www.elastic.co/guide/en/elasticsearch/reference/current/ldap-realm.html#ldap-realm-configuration) |
There was a problem hiding this comment.
If I'm not mistaken, instead of absolute URLs, I think we should make these links relative and leverage the {ref} variable. Meaning, we should replace them with:
{ref}/ldap-realm.html#ldap-realm-configuration[LDAP]{ref}/active-directory-realm.html#ad-realm-configuration[Active Directory]
There was a problem hiding this comment.
Nice, if that works, absolutely -- changelogs are yaml as opposed to asciidoc though so I'm not positive the same rules apply. I asked in the ES docs channel -- lets see!
n1v0lg
added
the
auto-merge-without-approval
LDAP/AD authentication realms can be configured to authenticate through LDAP via a bind user. For this it's necessary to set a bind DN (via `bind_dn`) together with a bind password (via `bind_password` or `secure_bind_password`). Setting a bind DN without a bind password will cause all LDAP/AD realm authentication to fail, leaving the node non-operational. This PR adds a bootstrap check to prevent a misconfigured node from starting. This behavior was deprecated in elastic#85326. Closes: ES-9749
|
@n1v0lg is this PR relevant to the serverless changelog? [FYI this question is based on 9.0 breaking changes] |
4 participants
LDAP/AD authentication realms can be configured to authenticate through LDAP via a bind user. For this it's necessary to set a bind DN (via
bind_dn) together with a bind password (viabind_passwordorsecure_bind_password). Setting a bind DN without a bind password will cause all LDAP/AD realm authentication to fail, leaving the node non-operational. This PR adds a bootstrap check to prevent a misconfigured node from starting. This behavior was deprecated in #85326.Closes: ES-9749