Search Guard is a security plugin for Elasticsearch that provides transport layer security (TLS) and REST layer security to encrypt data in transit. It uses node, admin, and client certificates to authenticate nodes and users. When a request is made, Search Guard extracts and validates credentials, fetches roles, maps users to roles, and evaluates permissions to implement access controls before executing the request in Elasticsearch. The Search Guard configuration is stored in an Elasticsearch index for hot-reloading without configuration files on nodes.

1. © 2018 floragunn GmbH - All Rights Reserved
SEARCH GUARD
ARCHITECTURE
& REQUEST FLOW
DOCUMENTS

2. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
01.
SEARCH GUARD TLS
Search Guard uses TLS on transport and REST layer
Data encryption: No one can spy on your data
Data integrity: No on can alter your data
Cluster integrity: Only trusted nodes can join the cluster
TLS on transport layer:
Protects data travelling between the nodes
Mandatory, cannot be switched off
TLS on REST layer:
Adds HTTPS support

3. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Quickstart and first steps
ENCRYPTION IN TRANSIT
Search Guard Search Guard
Search Guard Search GuardNode 1 Node 2
TLS
Secured
TLS
Secured
RESTLayerTRANSPORTLayer
TLS
Secured
https://example.com:9200

4. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
02.
TLS CERTIFICATES
Search Guard uses three types of certificates
Node certificates
Used for inter-node traffic
Only nodes with a valid certificate can join the cluster
Admin certificates
Grant root access to the cluster
Client certificates
Can be used for client authentication and authorisation

5. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Quickstart and first steps
TLS CERTIFICATES
Search GuardNode 1 Node 2
TLS
Secured
RESTLayerTRANSPORTLayer
Search GuardNode
Certificate
Node
Certificate
Client
Certificate
Search GuardSearch Guard
https://example.com:9200
Admin
Certificate

6. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
03.
SEARCH GUARD REQUEST FLOW
Applies to REST and transport layer likewise
TLS certificate validation
E.g. for transport traffic, validate the certificate of the peer node
Extract and validate user credentials
Depends on the configured authentication domains
Assign Search Guard roles and evaluate permissions
Apply index-, document- and field-level access control
Apply audit and compliance logging
Execute the request in Elasticsearch

7. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Quickstart and first steps
SEARCH GUARD REQUEST FLOW
• JSON web token
• Kerberos / SPNEGO
• PKI
• Proxy
• SAML
• OpenID
• Actice Directory
• LDAP
• Internal User Database
• HTTP Basic
SSO Non - SSO
Audit trails of
security and
compliance
relevant events
Index-,
document-
and field level
access control
Audit and
compliance
logging
Authentication
/ Authorisation
TLS on REST
and Transport
Hot-reloadable
Search Guard
configuration
PEM certificates
Keystores
PKCS #12
Elasticsearch
REST client
TRANSPORT client

8. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
04.
SEARCH GUARD AUTHENTICATION FLOW
Extract user credentials from request
E.g. HTTP Basic, JSON web token, Kerberos ticket
Validate provided credentials
E.g. LDAP authentication, JWT signature checks
Fetch backend roles for the authenticated user
E.g. LDAP groups, JWT claims, SAML assertions
Map user to Search Guard role(s)
Using username, backend roles or hosts
Evaluate the permissions assigned to the roles

9. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Quickstart and first steps
AUTHENTICATION FLOW
https://example.com:9200
Extract and
validate
credentials
Fetch
roles
Map user
to Search
Guard roles
Evaluate
Permissions
Elasticsearch
user:john
pass:doe
Userverified
Active
Directory /
LDAP
Active
Directory /
LDAP
user:john
Roles:devops
Role
Mappings
Roles and
Permissions
devops
sg_operations
sg_operations
Permissions

10. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
05.
SEARCH GUARD CONFIGURATION INDEX
Search Guard configuration is stored in an Elasticsearch index
Hot-reloadable
Changes take effect immediately
No configuration files necessary on nodes
Accessible only with TLS admin certificate
Configuration changes can be applied by
sgadmin command line tool
REST API
Kibana configuration GUI

11. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Quickstart and first steps
SEARCH GUARD CONFIGURATION INDEX
Node 1
Search Guard
Index
Primary
Shard
Node 2
Search Guard
Index
Replica
Shard
Config
files
sgadmin.sh

12. © 2018 floragunn GmbH - All Rights Reserved Search Guard – Architecture & Request flow
06.
RESOURCES
Search Guard website
https://search-guard.com/
Documentation
https://docs.search-guard.com
Community Forum
https://groups.google.com/d/forum/search-guard
GitHub
https://github.com/floragunncom

13. © 2018 floragunn GmbH - All Rights Reserved
WE LOOK FORWARD
TO YOUR MESSAGE
CONTACT US:
info@search-guard.com

14. © 2018 floragunn GmbH - All Rights Reserved
floragunn GmbH
Tempelhofer Ufer 16
D-10963 Berlin, Germany
E-Mail: info@search-guard.com
Web: search-guard.com
Managing Directors: Claudia Kressin, Jochen Kressin
Registergericht: Amtsgericht Charlottenburg
Registernummer: HRB 147010 B E-Mail: info@floragunn.com
Search Guard is a trademark of floragunn GmbH, registered in the U.S. and in other countries.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries.
floragunn GmbH is not affiliated with Elasticsearch BV.
Search Guard is an independent implementation of a security access layer for Elasticsearch.
It is completely independent from Elasticsearch own products.