SearchGuard社区版是否具备Rest API？无API时如何管理用户角色？

Hey there! Let's tackle your two questions about SearchGuard Community Edition clearly:

Does SearchGuard Community Edition offer a REST API for management? #

Short answer: No, it doesn't. The official REST API for managing internal users, roles, role mappings, and other security objects is exclusive to SearchGuard's commercial tiers (Enterprise and Platinum editions). The Community Edition doesn't include this set of API endpoints for administrative operations.

How to manage internal users/roles without relying on a REST API? #

If you're on the Community Edition, you have a few reliable options to handle user and role management without a REST API:

• File-based configuration (YAML files)
  This is the default method for Community Edition. You'll work with core configuration files in your SearchGuard setup directory:

  • sg_users.yml: Stores user accounts and their hashed passwords (you can generate the hash using the included hash.sh script, e.g., ./hash.sh your_secure_password).
  • sg_roles.yml: Defines roles with specific cluster/index permissions (like read/write access, cluster admin rights).
  • sg_role_mappings.yml: Maps users, groups, or backend roles to the roles you've defined.
    After editing these files, you'll need to restart your Elasticsearch nodes to apply the changes.

• sgadmin command-line tool
  Included with the Community Edition, sgadmin lets you upload your local configuration files to the Elasticsearch cluster without restarting nodes. This is great for quicker updates or automation. A basic command looks like:

  ./sgadmin.sh -cd ../sgconfig/ -ks your-keystore.jks -ts your-truststore.jks -nhnv
  

  The -cd flag points to your config directory, -ks/-ts reference your SSL keystore/truststore, and -nhnv skips hostname verification (use cautiously in production).

• Integrate with LDAP/Active Directory
  If your organization uses LDAP or AD, you can configure SearchGuard Community Edition to authenticate users against these external systems. This shifts user/role management to your existing LDAP/AD infrastructure, so you don't have to maintain local YAML files. You'll set this up in sg_authc.yml (authentication) and sg_authz.yml (authorization) to map LDAP groups to SearchGuard roles.

内容的提问来源于stack exchange，提问作者Palmer