Hi friends, Koha should support authenticated access to Elasticsearch, at the very minimum https://www.elastic.co/guide/en/elasticsearch/reference/current/http-clients.html and https://www.elastic.co/guide/en/elasticsearch/reference/current/token-authentication-services.html We'd need a place to stash our ES configuration information much like we used to for Zebra. koha-conf.xml is probably fine? Obviously open to discussion from the way smarter people here - this is only to get the discussion started, as Elasticsearch will start creating egregious scary logs for every connection complaining about security, starting with version 7. Liz
For basic authentication, you can put the credentials in the connection details: <server>username:password@localhost:9200</server> It would be nice to have a comment about this in the koha-conf.xml template.
Agreed, let's make the bug "document secure mode" :D
I've been setting up Elasticsearch 7 with a Koha and this is what I used: <!-- Elasticsearch Configuration --> <elasticsearch> <server>localhost:9200</server> <!-- may be repeated to include all servers on your cluster --> <userinfo>elastic:CHANGEME</userinfo> <use_https>1</use_https> The relevant bits above being "userinfo" and "use_https", and I found them by looking at https://metacpan.org/pod/Search::Elasticsearch::Role::Cxn#node and looking around the code a bit. With Elasticsearch 7, to use basic auth you have to use HTTPS as well, but that's a much more complicated topic. We could add commented out "userinfo" and "use_https" elements in koha-conf.xml though to get people on the right track.
Created attachment 167053 [details] [review] Bug 33563: Add comments for Elasticsearch security config This patch adds some commented Elasticsearch security configuration, which shows how to use username/password with HTTPS. Test plan: 0. Apply patch 1. cp debian/templates/koha-conf-site.xml.in /etc/koha/koha-conf-site.xml.in 2. koha-create --create-db test 3. vi /etc/koha/sites/test/koha-conf.xml 4. Note that the comments for userinfo and use_https are in the koha-conf.xml
I helped out Magnus on Mattermost with setting this up for Opensearch, so I thought it was timely to just write a patch and get it in. Note that the comment asserts that if you're using authentication then you will need to use HTTPS. That's really the key part. -- Opensearch comes with self-signed certs out of the box, so it's very easy to use HTTPS with it. With Elasticsearch, you have to set up your own self-signed certs, but I think that's outside the scope of this bug. You can consult Elasticsearch's documentation for setting up the server-side for HTTPS.
Now I'm second guessing my comment... I thought that you had to use HTTPS if you were using authentication with ES... But in koha-testing-docker we don't have HTTPS enabled for Elasticsearch, but if you add userinfo and no use_https "koha-elasticsearch -v -b --rebuild kohadev" will work...
Created attachment 167066 [details] [review] Bug 33563: Add comments for Elasticsearch security config This patch adds some commented Elasticsearch security configuration, which shows how to use username/password with HTTPS. Test plan: 0. Apply patch 1. cp debian/templates/koha-conf-site.xml.in /etc/koha/koha-conf-site.xml.in 2. koha-create --create-db test 3. vi /etc/koha/sites/test/koha-conf.xml 4. Note that the comments for userinfo and use_https are in the koha-conf.xml Signed-off-by: Magnus Enger <magnus@libriotech.no> Works as advertised.
The patch does what it says on the tin, but I have not looked into the question of auth with or without https.
(In reply to Magnus Enger from comment #8) > The patch does what it says on the tin, but I have not looked into the > question of auth with or without https. I suppose at the very least it's handy to have the commented out fields there
Created attachment 168093 [details] [review] Bug 33563: Add comments for Elasticsearch security config This patch adds some commented Elasticsearch security configuration, which shows how to use username/password with HTTPS. Test plan: 0. Apply patch 1. cp debian/templates/koha-conf-site.xml.in /etc/koha/koha-conf-site.xml.in 2. koha-create --create-db test 3. vi /etc/koha/sites/test/koha-conf.xml 4. Note that the comments for userinfo and use_https are in the koha-conf.xml Signed-off-by: Magnus Enger <magnus@libriotech.no> Works as advertised. Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Always love documentation :)
Pushed for 24.11! Well done everyone, thank you!
Backported to 24.05.x for upcoming 24.05.02
Pushed to 23.11.x for 23.11.07
Not backporting to 23.05.x unless requested
I tested that it works and updated the Koha installation instructions in wiki: https://wiki.koha-community.org/wiki/Koha_on_Debian#Elasticsearch On that note it'd be nice if ktd used security by default to test for regressions...
(In reply to Michał from comment #16) > I tested that it works and updated the Koha installation instructions in > wiki: https://wiki.koha-community.org/wiki/Koha_on_Debian#Elasticsearch > > On that note it'd be nice if ktd used security by default to test for > regressions... Agreed In my ktd, I have security turned on by default, although I have to manually update my koha-conf.xml every time, which is a bit annoying.