# Partial `authc` and `authz` sections for
# /etc/wazuh-indexer/opensearch-security/config.yml
# Active Directory / LDAP authentication and authorisation over LDAPS.
#
# Source: the 5.0-beta Active Directory and LDAP integration guide,
# https://documentation.wazuh.com/5.0-beta/user-manual/user-administration/ldap.html
#
# FRAGMENT. Merge into the existing sections.
# Back up first:
#   /usr/share/wazuh-indexer/bin/indexer-security-init.sh \
#     --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"
#
# Ports: 389 for LDAP, 636 for LDAPS.
# pemtrustedcas_filepath is required when enable_ssl is true. If you do not
# have the CA file, capture it with:
#   echo -n | openssl s_client -connect <FQDN_LDAP_SERVER>:636 \
#     | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ldapcacert.pem
#   mv ldapcacert.pem /etc/wazuh-indexer/opensearch-security/
#   chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/ldapcacert.pem
#
# The attribute names below are from a Microsoft Active Directory schema.
# Replace them to match your own directory.

authc:
  ldap:
    description: "Authenticate via LDAP or Active Directory"
    http_enabled: true
    transport_enabled: false
    order: 1
    http_authenticator:
      type: basic
      challenge: false
    authentication_backend:
      type: ldap
      config:
        enable_ssl: true
        pemtrustedcas_filepath: /etc/wazuh-indexer/opensearch-security/ldapcacert.pem
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: true
        hosts:
          - <FQDN_LDAP_SERVER>:636
        bind_dn: cn=ldap,ou=people,dc=example,dc=org
        password: <PASSWORD>
        userbase: 'ou=people,dc=example,dc=org'
        usersearch: (sAMAccountName={0})
        username_attribute: cn

authz:
  roles_from_myldap:
    description: "Authorize via LDAP or Active Directory"
    http_enabled: true
    transport_enabled: false
    authorization_backend:
      type: ldap
      config:
        enable_ssl: true
        pemtrustedcas_filepath: /etc/wazuh-indexer/opensearch-security/ldapcacert.pem
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: true
        hosts:
          - <FQDN_LDAP_SERVER>:636
        bind_dn: cn=ldap,ou=people,dc=example,dc=org
        password: <PASSWORD>
        rolebase: ou=groups,dc=example,dc=org
        rolesearch: '(member={0})'
        userrolename: memberof
        username_attribute: cn
        rolename: cn
        resolve_nested_roles: true
        userbase: 'ou=people,dc=example,dc=org'
        usersearch: (sAMAccountName={0})
        # Keep the platform's own accounts out of directory lookups. Without
        # this, a directory outage takes the dashboard service account with it.
        skip_users:
          - admin
          - kibanaserver

# The group CNs found here (for example wazuh-admins, wazuh-readonly) become
# backend_roles. Map them in roles_mapping.yml exactly as SAML backend roles
# are mapped: see roles_mapping.fragment.yml in this folder.