Authentication basics in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is authentication in Elasticsearch?

Authentication in Elasticsearch is the process of verifying the identity of a user or system before allowing access to the cluster or its data.

beginner

Name two common authentication methods supported by Elasticsearch.

Elasticsearch commonly supports Basic Authentication (username and password) and API Key Authentication for verifying users or applications.

beginner

What is Basic Authentication in Elasticsearch?

Basic Authentication sends a username and password encoded in the HTTP header to verify the user’s identity.

intermediate

Why should you use HTTPS with Elasticsearch authentication?

Using HTTPS encrypts the data sent between client and server, protecting sensitive information like passwords from being intercepted.

intermediate

What is an API key in Elasticsearch authentication?

An API key is a token generated by Elasticsearch that allows clients to authenticate without sending username and password every time.

Which of the following is a common authentication method in Elasticsearch?

A SAML only

B OAuth 2.0

C Basic Authentication

D JWT only

Basic Authentication is a common method supported by Elasticsearch for verifying users.

What does Basic Authentication send in the HTTP header?

A Encrypted token

B Plain text password only

C API key only

D Username and password encoded

Basic Authentication sends the username and password encoded in the HTTP header.

Why is HTTPS recommended when using authentication in Elasticsearch?

A To speed up queries

B To encrypt data and protect credentials

C To reduce server load

D To allow anonymous access

HTTPS encrypts data, protecting sensitive information like passwords during transmission.

What is the purpose of an API key in Elasticsearch?

A To authenticate clients without sending username and password each time

B To encrypt data at rest

C To create user roles

D To monitor cluster health

API keys allow clients to authenticate securely without repeatedly sending username and password.

Which statement about Elasticsearch authentication is true?

A Authentication verifies user identity before access

B Authentication encrypts data stored in Elasticsearch

C Authentication is not needed for public clusters

D Authentication only works with API keys

Authentication is the process of verifying user identity before granting access.

Explain what authentication means in Elasticsearch and why it is important.

Think about how you prove who you are before entering a secure building.

Describe the difference between Basic Authentication and API key authentication in Elasticsearch.

Compare logging in with a password versus using a special access card.

Practice

1. What is the main purpose of authentication in Elasticsearch?

easy

A. To backup the Elasticsearch index

B. To store data securely in the cluster

C. To verify the identity of a user or system before granting access

D. To improve search speed

Solution

1. Step 1: Understand authentication concept

   Authentication is the process of checking who you are before allowing access.

2. Step 2: Match with Elasticsearch context

   Elasticsearch uses authentication to verify user or system identity before access.

3. Final Answer:

   To verify the identity of a user or system before granting access -> Option C

4. Quick Check:

   Authentication = Verify identity [OK]

Hint: Authentication means checking who you are [OK]

Common Mistakes:

• Confusing authentication with data storage
• Thinking authentication speeds up search
• Mixing authentication with backup processes

2. Which of the following is the correct way to call the Elasticsearch API to check your authentication status?

easy

A. GET /_cluster/_health

B. POST /_search/_authenticate

C. PUT /_security/_authenticate

D. GET /_security/_authenticate

Solution

1. Step 1: Identify the correct API endpoint for authentication

   The correct endpoint to verify identity is _security/_authenticate with GET method.

2. Step 2: Check HTTP method correctness

   Authentication check uses GET, not POST or PUT.

3. Final Answer:

   GET /_security/_authenticate -> Option D

4. Quick Check:

   Use GET on _security/_authenticate [OK]

Hint: Use GET method on _security/_authenticate [OK]

Common Mistakes:

• Using POST or PUT instead of GET
• Calling wrong API like _search or _cluster
• Misspelling the endpoint path

3. What will be the result of this curl command if the credentials are correct?

curl -u elastic:changeme -X GET "localhost:9200/_security/_authenticate"

medium

A. An error message saying 'Unauthorized'

B. A JSON response with user details and roles

C. A list of all indices in the cluster

D. A blank response with status 200

Solution

1. Step 1: Understand the curl command

   The command uses basic auth with username 'elastic' and password 'changeme' to call the authenticate API.

2. Step 2: Predict the API response on correct credentials

   If credentials are correct, the API returns JSON with user info and roles, not errors or unrelated data.

3. Final Answer:

   A JSON response with user details and roles -> Option B

4. Quick Check:

   Correct credentials = user info JSON [OK]

Hint: Correct credentials return user info JSON [OK]

Common Mistakes:

• Expecting an error with correct credentials
• Confusing authenticate API with index listing
• Assuming blank response means success

4. You run this command but get an 'Unauthorized' error:

curl -X GET "localhost:9200/_security/_authenticate"

What is the most likely cause?

medium

A. You forgot to include authentication credentials

B. The Elasticsearch cluster is down

C. The API endpoint is incorrect

D. The curl command syntax is invalid

Solution

1. Step 1: Analyze the curl command

   The command calls the authenticate API but does not provide any credentials.

2. Step 2: Understand why 'Unauthorized' occurs

   Without credentials, Elasticsearch denies access, causing 'Unauthorized' error.

3. Final Answer:

   You forgot to include authentication credentials -> Option A

4. Quick Check:

   Missing credentials cause Unauthorized error [OK]

Hint: Always include credentials for secure APIs [OK]

Common Mistakes:

• Assuming cluster is down without checking
• Thinking API endpoint is wrong
• Believing curl syntax is incorrect

5. You want to create an API key for authentication in Elasticsearch using this request:

POST /_security/api_key
{"name": "my-key", "role_descriptors": {"my-role": {"cluster": ["all"]}}}

What is the correct way to authenticate this request?

hard

A. Use basic authentication with a user having the 'manage_api_key' privilege

B. No authentication is needed to create API keys

C. Use the API key itself in the request header

D. Use anonymous access enabled in Elasticsearch

Solution

1. Step 1: Understand API key creation requirements

   Creating API keys requires authentication with a user having 'manage_api_key' privilege.

2. Step 2: Identify correct authentication method

   Basic authentication with such a user is needed; API key or anonymous access won't work for creation.

3. Final Answer:

   Use basic authentication with a user having the 'manage_api_key' privilege -> Option A

4. Quick Check:

   API key creation requires privileged user auth [OK]

Hint: API key creation needs privileged user auth [OK]

Common Mistakes:

• Trying to create API key without authentication
• Using API key before it exists
• Assuming anonymous access allows API key creation