Skip to main content

Elasticsearch CORS with basic authentication setup

This is a short "recipe" article explaining how to configure remote ElasticSearch instance to support CORS requests and basic authentication using Apache HTTP Server 2.4.

Proxy
To start with, we need to configure Apache to proxy requests to the Elasticsearch instance. By default, Elasticsearch is running on the port 9200: 
ProxyPass /elastic http://localhost:9200/
ProxyPassReverse /elastic http://localhost:9200/

Basic authentication
Enabling basic authentication is easy. By default, Apache checks the user credentials against the local file which you can create using the following command: 
/path/to/htpasswd -c /usr/local/apache/password/.htpasswd_elasticsearch elasticsearchuser
Then you'll need to use the following directives to allow only authenticated users to access your content: 
AuthType Basic
AuthName "Elastic Server"
AuthUserFile /usr/local/apache/password/.htpasswd_elasticsearch
Require valid-user
For more complex setups such as LDAP-based authentication and restricting access by user group or other criterias, see official howto.

CORS
When you want to add support of CORS requests to your server, you should configure it to set proper response headers starting with Access-Control-Allow-Origin. To make it work with basic authentication, you will need the following headers: 
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials: "*"
Header set Access-Control-Allow-Headers: "Authorization, Content-Type, X-Requested-With"
If you need to support HTTP PUT requests or want to see more detailed explanations with examples, check Using CORS tutorial.
The above configuration is still not enough to make basic authentication work as the HTTP OPTIONS pre-flight request is sent without Authorization header. So we need to allow such requests non password-protected:
<LimitExcept OPTIONS>
 Require valid-user
</LimitExcept>

Final configuration
Let's move the complete configuration inside a Location directive now: 
<Location /elastic>
 ProxyPass http://localhost:9200/
 ProxyPassReverse http://localhost:9200/

 Header set Access-Control-Allow-Origin "*"
 Header set Access-Control-Allow-Credentials: "*"
 Header set Access-Control-Allow-Headers: "Authorization, Content-Type, X-Requested-With"

 AuthType Basic
 AuthName "Elastic Server PROD"
 AuthUserFile /usr/local/apache/password/.htpasswd_elasticsearch

 <LimitExcept OPTIONS>
  Require valid-user
 </LimitExcept>
</Location>
Labels:

Comments

Post a Comment

Popular posts from this blog

Connection to Amazon Neptune endpoint from EKS during development

This small article will describe how to connect to Amazon Neptune database endpoint from your PC during development. Amazon Neptune is a fully managed graph database service from Amazon. Due to security reasons direct connections to Neptune are not allowed, so it's impossible to attach a public IP address or load balancer to that service. Instead access is restricted to the same VPC where Neptune is set up, so applications should be deployed in the same VPC to be able to access the database. That's a great idea for Production however it makes it very difficult to develop, debug and test applications locally. The instructions below will help you to create a tunnel towards Neptune endpoint considering you use Amazon EKS - a managed Kubernetes service from Amazon. As a side note, if you don't use EKS, the same idea of creating a tunnel can be implemented using a Bastion server . In Kubernetes we'll create a dedicated proxying pod. Prerequisites. Setting up a tunnel.
Post a Comment
Read more

Notes on upgrade to JSF 2.1, Servlet 3.0, Spring 4.0, RichFaces 4.3

This article is devoted to an upgrade of a common JSF Spring application. Time flies and there is already Java EE 7 platform out and widely used. It's sometimes said that Spring framework has become legacy with appearance of Java EE 6. But it's out of scope of this post. Here I'm going to provide notes about the minimal changes that I found required for the upgrade of the application from JSF 1.2 to 2.1, from JSTL 1.1.2 to 1.2, from Servlet 2.4 to 3.0, from Spring 3.1.3 to 4.0.5, from RichFaces 3.3.3 to 4.3.7. It must be mentioned that the latest final RichFaces release 4.3.7 depends on JSF 2.1, JSTL 1.2 and Servlet 3.0.1 that dictated those versions. This post should not be considered as comprehensive but rather showing how I did the upgrade. See the links for more details. Jetty & Tomcat. JSTL. JSF & Facelets. Servlet. Spring framework. RichFaces. Jetty & Tomcat First, I upgraded the application to run with the latest servlet container versio
1 comment
Read more

Extracting XML comments with XQuery

I've just discovered that it's possible to process comment nodes using XQuery. Ideally it should not be the case if you take part in designing your data formats, then you should simply store valuable data in plain xml. But I have to deal with OntoML data source that uses a bit peculiar format while export to XML, i.e. some data fields are stored inside XML comments. So here is an example how to solve this problem. XML example This is an example stub of one real xml with irrelevant data omitted. There are several thousands of xmls like this stored in Sedna XML DB collection. Finally, I need to extract the list of pairs for the complete collection: identifier (i.e. SOT1209 ) and saved timestamp (i.e. 2012-12-12 23:58:13.118 GMT ). <?xml version="1.0" standalone="yes"?> <!--EXPORT_PROGRAM:=eptos-iso29002-10-Export-V10--> <!--File saved on: 2012-12-12 23:58:13.118 GMT--> <!--XML Schema used: V099--> <cat:catalogue xmlns:cat=
Post a Comment
Read more