ELK 与 LDAP 的集成

Question

I recently got to manage an opensource-based infrastructure composed by multiple Debian servers. On some of them, the ELK stack is installed. I am verifying verify the presence of any integration between ELK and LDAP or other IAMs. On the dedicated monitoring node, I looked for IAM-related info into the following configuration files:

/etc/elasticsearch/elasticsearch.yaml

/etc/kibana/kibana.yml

/etc/logstash/logstash.yml

but the only login/account credentials I have been able to find are in the kibana.yml file:

elasticsearch.username: "username"
elasticsearch.password: "password"

In /etc/kibana/kibana.yml and /etc/elasticsearch/elasticsearch.yml I find the following:

xpack.security.enabled: false

which leads me think to the presence of a "xpack" plugin in somehow related to ldap. Where should I look for LDAP integration ?

Answer 1

Thanks to @Wonka for suggesting the presence of ReadOnlyRest. I found a readonlyrest.yml in /etc/elasticsearch. There, the following was present:

ldaps:
- name: ldap1
host: "ourldapserver.ourdomain"
[...]

Here is where LDAP integration occured.