[Docs] Document Anonymous authentication provider. #84910

azasypkin · 2020-12-03T15:06:51Z

Document Anonymous authentication provider introduced in #79985 and #84074.

elasticmachine · 2020-12-03T15:22:22Z

Pinging @elastic/kibana-security (Team:Security)

azasypkin · 2020-12-03T15:29:31Z

docs/settings/security-settings.asciidoc

+
+[source,yaml]
+----------------------------------------
+# Username and password credentials


note: not super happy about having technically invalid yaml snippet (because of duplicated entries), but couldn't think of a better option.

I think this is reasonable. We could split this out into 4 different snippets if necessary, but I think what you have here is fine.

legrego

As always, we'll let the docs team help refine my suggestions, but here's my first attempt. Thanks for writing this up, looks great!

legrego · 2020-12-04T14:49:34Z

docs/user/security/authentication/index.asciidoc

+
+[IMPORTANT]
+============================================================================
+Since anonymous access allows anyone to access {kib} as long as they can access network {kib} is exposed to, make sure to grant anonymous service account only as many privileges as really needed.


Suggested change

Since anonymous access allows anyone to access {kib} as long as they can access network {kib} is exposed to, make sure to grant anonymous service account only as many privileges as really needed.

Anyone with access to the network {kib} is exposed to will be able to access {kib}. Make sure that you've properly restricted the capabilities of the anonymous service account so that anonymous users can't perform destructive actions or escalate their own privileges.

Much better, thanks!

legrego · 2020-12-04T14:50:46Z

docs/user/security/authentication/index.asciidoc

+Since anonymous access allows anyone to access {kib} as long as they can access network {kib} is exposed to, make sure to grant anonymous service account only as many privileges as really needed.
+============================================================================
+
+Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed {kib} dashboard in another application or set up a demo {kib} instance in your internal network while still keeping other {kib} security features intact.


Suggested change

Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed {kib} dashboard in another application or set up a demo {kib} instance in your internal network while still keeping other {kib} security features intact.

Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network while still keeping other security features intact.

legrego · 2020-12-04T14:51:57Z

docs/user/security/authentication/index.asciidoc

+
+Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed {kib} dashboard in another application or set up a demo {kib} instance in your internal network while still keeping other {kib} security features intact.
+
+To enable anonymous authentication in {kib}, you need to decide what credentials or so-called anonymous service account {kib} should use internally to authenticate anonymous requests to {es}. You can pick one of the three different approaches here:


Suggested change

To enable anonymous authentication in {kib}, you need to decide what credentials or so-called anonymous service account {kib} should use internally to authenticate anonymous requests to {es}. You can pick one of the three different approaches here:

To enable anonymous authentication in {kib}, you need to decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:

legrego · 2020-12-04T14:54:11Z

docs/user/security/authentication/index.asciidoc

+[float]
+===== Anonymous access and other types of authentication
+
+You can also configure any other authentication mechanisms in addition to the anonymous access in {kib}. In this case Login Selector UI will present a dedicated `Continue as Guest` option for the anonymous access:


Suggested change

You can also configure any other authentication mechanisms in addition to the anonymous access in {kib}. In this case Login Selector UI will present a dedicated `Continue as Guest` option for the anonymous access:

You can configure other authentication providers in addition to anonymous access in {kib}. In this case Login Selector UI will present a dedicated `Continue as Guest` option for anonymous access:

legrego · 2020-12-04T14:57:13Z

docs/user/security/authentication/index.asciidoc

+    credentials: "elasticsearch_anonymous_user" <1>
+-----------------------------------------------
+
+<1> The `elasticsearch_anonymous_user` is just a special constant that doesn't have any other meaning


Suggested change

<1> The `elasticsearch_anonymous_user` is just a special constant that doesn't have any other meaning

<1> The `elasticsearch_anonymous_user` is a special constant that indicates you wish to use Elasticsearch's anonymous user.

legrego · 2020-12-04T14:58:07Z

docs/user/security/authentication/index.asciidoc

+[float]
+===== Anonymous access and embedding
+
+One of the most popular use cases for the anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as a sole authentication mechanism, you don't need to do anything special while embedding {kib}. 


Suggested change

One of the most popular use cases for the anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as a sole authentication mechanism, you don't need to do anything special while embedding {kib}.

One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.

legrego · 2020-12-04T15:02:07Z

docs/user/security/authentication/index.asciidoc

+
+One of the most popular use cases for the anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as a sole authentication mechanism, you don't need to do anything special while embedding {kib}. 
+
+The things become a bit tricky if you configure multiple authentication mechanisms and use Login Selector UI to log in to {kib}. In this case embedded {kib} doesn't know whether you want your users to use anonymous access or not. If the intention is to use anonymous access then you should add `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL.


I don't think we need to qualify the Login Selector UI here. We are trying to discourage disabling this, so I think it's safe for us to assume in these docs that it'll be enabled.

Suggested change

The things become a bit tricky if you configure multiple authentication mechanisms and use Login Selector UI to log in to {kib}. In this case embedded {kib} doesn't know whether you want your users to use anonymous access or not. If the intention is to use anonymous access then you should add `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL.

If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.

I don't think we need to qualify the Login Selector UI here. We are trying to discourage disabling this, so I think it's safe for us to assume in these docs that it'll be enabled.

Wholeheartedly agree!

legrego · 2020-12-04T15:03:22Z

docs/settings/security-settings.asciidoc

+
+[source,yaml]
+----------------------------------------
+# Username and password credentials


I think this is reasonable. We could split this out into 4 different snippets if necessary, but I think what you have here is fine.

elasticmachine · 2020-12-04T15:37:14Z

Pinging @elastic/kibana-docs (Team:Docs)

gchaps · 2020-12-04T18:54:04Z

docs/settings/security-settings.asciidoc

+|===
+| `xpack.security.authc.providers.`
+`anonymous.<provider-name>.credentials` {ess-icon}
+| Credentials that {kib} should use internally to authenticate anonymous requests to {es}. Possible values are: username and password credentials, API key or `elasticsearch_anonymous_user` constant if you want to leverage {ref}/anonymous-access.html[{es} anonymous access].


Suggested change

| Credentials that {kib} should use internally to authenticate anonymous requests to {es}. Possible values are: username and password credentials, API key or `elasticsearch_anonymous_user` constant if you want to leverage {ref}/anonymous-access.html[{es} anonymous access].

| Credentials that {kib} should use internally to authenticate anonymous requests to {es}. Possible values are: username and password, API key, or the constant `elasticsearch_anonymous_user` if you want to leverage {ref}/anonymous-access.html[{es} anonymous access].

gchaps · 2020-12-04T18:57:59Z

docs/user/security/authentication/index.asciidoc

+Anyone with access to the network {kib} is exposed to will be able to access {kib}. Make sure that you've properly restricted the capabilities of the anonymous service account so that anonymous users can't perform destructive actions or escalate their own privileges.
+============================================================================
+
+Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network while still keeping other security features intact.


Suggested change

Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network while still keeping other security features intact.

Anonymous authentication gives users access to {kib} without requiring them to provide credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network, while still keeping other security features intact.

gchaps · 2020-12-04T19:00:41Z

docs/user/security/authentication/index.asciidoc

+
+Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network while still keeping other security features intact.
+
+To enable anonymous authentication in {kib}, you need to decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:


Suggested change

To enable anonymous authentication in {kib}, you need to decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:

To enable anonymous authentication in {kib}, you must decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:

gchaps · 2020-12-04T19:01:36Z

docs/user/security/authentication/index.asciidoc

+
+To enable anonymous authentication in {kib}, you need to decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:
+
+NOTE: You can configure only one anonymous authentication provider per {kib} instance.


Suggest moving the sentence "There are three ways to specify these credentials" to after the Note.

gchaps · 2020-12-04T19:03:37Z

docs/user/security/authentication/index.asciidoc

+
+NOTE: You can configure only one anonymous authentication provider per {kib} instance.
+
+If you have a user that can authenticate to {es} using username and password, from a Native or LDAP security realms for instance, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` can look like if you want to use username and password credentials:


Suggested change

If you have a user that can authenticate to {es} using username and password, from a Native or LDAP security realms for instance, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` can look like if you want to use username and password credentials:

If you have a user who can authenticate to {es} using username and password, for instance from a Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:

gchaps · 2020-12-04T19:13:03Z

docs/user/security/authentication/index.asciidoc

+[float]
+===== Anonymous access and embedding
+
+One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.


Suggested change

One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.

One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.

gchaps · 2020-12-04T19:13:53Z

docs/user/security/authentication/index.asciidoc

+
+One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.
+
+If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.


Suggested change

If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.

If you have multiple authentication providers enabled, and you want to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.

gchaps · 2020-12-04T19:14:06Z

docs/user/security/authentication/index.asciidoc

+
+If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.
+
+For example, if you generate the iFrame code to embed {kib} it will look like this:


Suggested change

For example, if you generate the iFrame code to embed {kib} it will look like this:

For example, if you generate the iFrame code to embed {kib}, it will look like this:

gchaps · 2020-12-04T19:14:40Z

docs/user/security/authentication/index.asciidoc

+<iframe src="https://localhost:5601/app/dashboards#/view/722b74f0-b882-11e8-a6d9-e546fe2bba5f?embed=true&_g=(....)" height="600" width="800"></iframe>
+```
+
+To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in `src` iFrame attribute to look like this:


Suggested change

To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in `src` iFrame attribute to look like this:

To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in the `src` iFrame attribute to look like this:

gchaps · 2020-12-04T19:15:13Z

docs/user/security/authentication/index.asciidoc

+<iframe src="https://localhost:5601/app/dashboards?auth_provider_hint=anonymous1#/view/722b74f0-b882-11e8-a6d9-e546fe2bba5f?embed=true&_g=(....)" height="600" width="800"></iframe>
+```
+
+Note that `auth_provider_hint` query string parameter goes _before_ the hash URL fragment.


Suggested change

Note that `auth_provider_hint` query string parameter goes _before_ the hash URL fragment.

Note that `auth_provider_hint` query string parameter goes *before* the hash URL fragment.

azasypkin · 2020-12-07T06:59:49Z

Thanks for the review @gchaps and @legrego ! PR should be ready for another review pass whenever you have time.

legrego · 2020-12-08T12:54:47Z

docs/user/security/authentication/index.asciidoc

+
+There are three ways to specify these credentials:
+
+If you have a user who can authenticate to {es} using username and password, for instance from a Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:


Suggested change

If you have a user who can authenticate to {es} using username and password, for instance from a Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:

If you have a user who can authenticate to {es} using username and password, for instance from the Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:

legrego · 2020-12-08T12:55:16Z

docs/user/security/authentication/index.asciidoc

+
+It's also possible to use {kib} anonymous access in conjunction with the {es} anonymous access.
+
+Prior to configuring {kib}, ensure that the anonymous access is enabled and properly configured in {es}. See {ref}/anonymous-access.html[Enabling anonymous access] for more information.


Suggested change

Prior to configuring {kib}, ensure that the anonymous access is enabled and properly configured in {es}. See {ref}/anonymous-access.html[Enabling anonymous access] for more information.

Prior to configuring {kib}, ensure that anonymous access is enabled and properly configured in {es}. See {ref}/anonymous-access.html[Enabling anonymous access] for more information.

legrego · 2020-12-08T12:56:42Z

docs/user/security/authentication/index.asciidoc

+[float]
+===== Anonymous access and other types of authentication
+
+You can configure more authentication providers in addition to anonymous access in {kib}. In this case, the Login Selector presents a dedicated *Continue as Guest* option for anonymous access:


This hints that they can customize the text if they'd like to 😄

Suggested change

You can configure more authentication providers in addition to anonymous access in {kib}. In this case, the Login Selector presents a dedicated *Continue as Guest* option for anonymous access:

You can configure more authentication providers in addition to anonymous access in {kib}. In this case, the Login Selector presents a configurable *Continue as Guest* option for anonymous access:

legrego · 2020-12-08T12:57:42Z

docs/user/security/authentication/index.asciidoc

+
+If you have multiple authentication providers enabled, and you want to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.
+
+For example, if you generate the iFrame code to embed {kib}, it will look like this:


I blame Apple!

Suggested change

For example, if you generate the iFrame code to embed {kib}, it will look like this:

For example, if you generate the iframe code to embed {kib}, it will look like this:

Oh no, so embarrassing! 🙈

legrego · 2020-12-08T12:57:54Z

docs/user/security/authentication/index.asciidoc

+<iframe src="https://localhost:5601/app/dashboards#/view/722b74f0-b882-11e8-a6d9-e546fe2bba5f?embed=true&_g=(....)" height="600" width="800"></iframe>
+```
+
+To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in the `src` iFrame attribute to look like this:


Suggested change

To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in the `src` iFrame attribute to look like this:

To make this iframe leverage anonymous access automatically, you will need to modify a link to {kib} in the `src` iframe attribute to look like this:

…ed HTML Inline Frame elements.

gchaps

LGTM

azasypkin · 2020-12-09T07:07:31Z

7.x/7.11.0: 393d1e4

[Docs] Document Anonymous authentication provider.

1131b70

azasypkin added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! Feature:Security/Authentication Platform Security - Authentication v8.0.0 release_note:skip Skip the PR/issue when compiling release notes docs v7.11.0 labels Dec 3, 2020

azasypkin marked this pull request as ready for review December 3, 2020 15:22

azasypkin commented Dec 3, 2020

View reviewed changes

azasypkin requested a review from legrego December 3, 2020 16:06

legrego reviewed Dec 4, 2020

View reviewed changes

azasypkin added 2 commits December 4, 2020 16:26

Merge branch 'master' into issue-xxx-anonymous-provider-docs

3260a82

Review#1: handle review feedback.

56ff2f6

azasypkin added the Team:Docs label Dec 4, 2020

azasypkin requested review from a team and legrego December 4, 2020 15:37

gchaps reviewed Dec 4, 2020

View reviewed changes

azasypkin added 2 commits December 7, 2020 07:45

Merge branch 'master' into issue-xxx-anonymous-provider-docs

0b3c88a

Review#2: handle review feedback.

4485e69

azasypkin requested a review from gchaps December 7, 2020 06:59

legrego approved these changes Dec 8, 2020

View reviewed changes

azasypkin added 2 commits December 8, 2020 13:59

Merge branch 'master' into issue-xxx-anonymous-provider-docs

c4047a6

Review#3: handle feedback and stress that it was not Apple who invent…

c2331e9

…ed HTML Inline Frame elements.

gchaps approved these changes Dec 8, 2020

View reviewed changes

azasypkin merged commit 467ba0a into elastic:master Dec 8, 2020

azasypkin deleted the issue-xxx-anonymous-provider-docs branch December 8, 2020 19:06

azasypkin mentioned this pull request Dec 8, 2020

[7.x] [Docs] Document Anonymous authentication provider. (#84910) #85324

Merged

azasypkin added a commit to azasypkin/kibana that referenced this pull request Dec 8, 2020

[Docs] Document Anonymous authentication provider. (elastic#84910)

378514f

azasypkin added the backported label Dec 9, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Docs] Document Anonymous authentication provider. #84910

[Docs] Document Anonymous authentication provider. #84910

azasypkin commented Dec 3, 2020 •

edited

Loading

elasticmachine commented Dec 3, 2020

azasypkin Dec 3, 2020

legrego Dec 4, 2020

legrego left a comment

legrego Dec 4, 2020

azasypkin Dec 4, 2020

legrego Dec 4, 2020

legrego Dec 4, 2020

legrego Dec 4, 2020

legrego Dec 4, 2020

legrego Dec 4, 2020

legrego Dec 4, 2020

azasypkin Dec 4, 2020

legrego Dec 4, 2020

elasticmachine commented Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

gchaps Dec 4, 2020

azasypkin commented Dec 7, 2020

legrego Dec 8, 2020

legrego Dec 8, 2020

legrego Dec 8, 2020

legrego Dec 8, 2020

azasypkin Dec 8, 2020

legrego Dec 8, 2020

gchaps left a comment

azasypkin commented Dec 9, 2020

	Since anonymous access allows anyone to access {kib} as long as they can access network {kib} is exposed to, make sure to grant anonymous service account only as many privileges as really needed.
	Anyone with access to the network {kib} is exposed to will be able to access {kib}. Make sure that you've properly restricted the capabilities of the anonymous service account so that anonymous users can't perform destructive actions or escalate their own privileges.

	Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed {kib} dashboard in another application or set up a demo {kib} instance in your internal network while still keeping other {kib} security features intact.
	Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed dashboards in another application or set up a demo {kib} instance in your internal network while still keeping other security features intact.


		Anonymous authentication gives users access to {kib} without requiring them to provide any sort of credentials. This can be useful if you want your users to skip the login step when you embed {kib} dashboard in another application or set up a demo {kib} instance in your internal network while still keeping other {kib} security features intact.

		To enable anonymous authentication in {kib}, you need to decide what credentials or so-called anonymous service account {kib} should use internally to authenticate anonymous requests to {es}. You can pick one of the three different approaches here:

	You can also configure any other authentication mechanisms in addition to the anonymous access in {kib}. In this case Login Selector UI will present a dedicated `Continue as Guest` option for the anonymous access:
	You can configure other authentication providers in addition to anonymous access in {kib}. In this case Login Selector UI will present a dedicated `Continue as Guest` option for anonymous access:

	<1> The `elasticsearch_anonymous_user` is just a special constant that doesn't have any other meaning
	<1> The `elasticsearch_anonymous_user` is a special constant that indicates you wish to use Elasticsearch's anonymous user.

	One of the most popular use cases for the anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as a sole authentication mechanism, you don't need to do anything special while embedding {kib}.
	One of the most popular use cases for anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as the sole authentication mechanism, you don't need to do anything special while embedding {kib}.


		One of the most popular use cases for the anonymous access is when you embed {kib} into other applications and don't want to force your users to log in just to view it. If you configured {kib} to use anonymous access as a sole authentication mechanism, you don't need to do anything special while embedding {kib}.

		The things become a bit tricky if you configure multiple authentication mechanisms and use Login Selector UI to log in to {kib}. In this case embedded {kib} doesn't know whether you want your users to use anonymous access or not. If the intention is to use anonymous access then you should add `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL.

	The things become a bit tricky if you configure multiple authentication mechanisms and use Login Selector UI to log in to {kib}. In this case embedded {kib} doesn't know whether you want your users to use anonymous access or not. If the intention is to use anonymous access then you should add `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL.
	If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.

	\| Credentials that {kib} should use internally to authenticate anonymous requests to {es}. Possible values are: username and password credentials, API key or `elasticsearch_anonymous_user` constant if you want to leverage {ref}/anonymous-access.html[{es} anonymous access].
	\| Credentials that {kib} should use internally to authenticate anonymous requests to {es}. Possible values are: username and password, API key, or the constant `elasticsearch_anonymous_user` if you want to leverage {ref}/anonymous-access.html[{es} anonymous access].


		To enable anonymous authentication in {kib}, you need to decide what credentials the anonymous service account {kib} should use internally to authenticate anonymous requests. There are three ways to specify these credentials:

		NOTE: You can configure only one anonymous authentication provider per {kib} instance.


		NOTE: You can configure only one anonymous authentication provider per {kib} instance.

		If you have a user that can authenticate to {es} using username and password, from a Native or LDAP security realms for instance, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` can look like if you want to use username and password credentials:

	If you have a user that can authenticate to {es} using username and password, from a Native or LDAP security realms for instance, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` can look like if you want to use username and password credentials:
	If you have a user who can authenticate to {es} using username and password, for instance from a Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:


		If you have multiple authentication providers enabled, and you wish to automatically log in anonymous users when embedding, then you will need to add the `auth_provider_hint=<anonymous-provider-name>` query string parameter to the {kib} URL that you're embedding.

		For example, if you generate the iFrame code to embed {kib} it will look like this:

	To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in `src` iFrame attribute to look like this:
	To make this iFrame leverage anonymous access automatically, you will need to modify a link to {kib} in the `src` iFrame attribute to look like this:

	Note that `auth_provider_hint` query string parameter goes _before_ the hash URL fragment.
	Note that `auth_provider_hint` query string parameter goes before the hash URL fragment.


		There are three ways to specify these credentials:

		If you have a user who can authenticate to {es} using username and password, for instance from a Native or LDAP security realms, you can also use these credentials to impersonate the anonymous users. Here is how your `kibana.yml` might look if you use username and password credentials:


		It's also possible to use {kib} anonymous access in conjunction with the {es} anonymous access.

		Prior to configuring {kib}, ensure that the anonymous access is enabled and properly configured in {es}. See {ref}/anonymous-access.html[Enabling anonymous access] for more information.

	You can configure more authentication providers in addition to anonymous access in {kib}. In this case, the Login Selector presents a dedicated Continue as Guest option for anonymous access:
	You can configure more authentication providers in addition to anonymous access in {kib}. In this case, the Login Selector presents a configurable Continue as Guest option for anonymous access:

[Docs] Document Anonymous authentication provider. #84910

[Docs] Document Anonymous authentication provider. #84910

Conversation

azasypkin commented Dec 3, 2020 • edited Loading

elasticmachine commented Dec 3, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

legrego left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Dec 4, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin commented Dec 7, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gchaps left a comment

Choose a reason for hiding this comment

azasypkin commented Dec 9, 2020

azasypkin commented Dec 3, 2020 •

edited

Loading