html/server/6.6/beats-basic-auth.html

<!DOCTYPE html>
<html lang="en-us">
  <head>
    
<meta charset="UTF-8">
<title>Configure authentication credentials | APM Server Reference [6.6] | Elastic</title>
<meta class="elastic" name="content" content="Configure authentication credentials | APM Server Reference [6.6]">

<link rel="home" href="index.html" title="APM Server Reference [6.6]"/>
<link rel="up" href="securing-beats.html" title="Configure APM Server to use X-Pack security"/>
<link rel="prev" href="securing-beats.html" title="Configure APM Server to use X-Pack security"/>
<link rel="next" href="beats-user-access.html" title="Grant users access to APM Server indices"/>
<meta class="elastic" name="product_version" content="6.6"/>
<meta class="elastic" name="product_name" content="APM"/>
<meta class="elastic" name="website_area" content="documentation"/>
<meta name="DC.type" content="Learn/Docs/APM Server/Reference/6.6"/>
<meta name="DC.subject" content="APM"/>
<meta name="DC.identifier" content="6.6"/>
<meta name="robots" content="noindex,nofollow"/>

    <meta http-equiv="content-type" content="text/html; charset=utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd" />
    <meta name="yandex-verification" content="d8a47e95d0972434" />
    <meta name="localized" content="true" />
    <meta name="st:robots" content="follow,index" />
    <meta property="og:image" content="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt280217a63b82a734/6202d3378b1f312528798412/elastic-logo.svg" />
    <meta property="og:image:width" content="500" />
    <meta property="og:image:height" content="172" />
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles-v1.css" />
  </head>

  <!--© 2015-2025 Elasticsearch B.V. -->
  <!-- All Elastic documentation is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. -->
  <!-- http://creativecommons.org/licenses/by-nc-nd/4.0/ -->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!-- Google Tag Manager for GA4 -->
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-KNJMG2M');</script>
    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KNJMG2M" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <!-- End Google Tag Manager for GA4-->

    <div id='elastic-nav' style="display:none;"></div>
    <script src='https://www.elastic.co/elastic-nav.js'></script>

    <div class="main-container">
      <section id="content" >
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container-fluid">
              <div class="row pb-3">
                <div class="col-12 order-2 col-md-4 order-md-1 col-lg-3 h-almost-full-md sticky-top-md" id="left_col">
                  <!-- The TOC is appended here -->
                </div>

                <div class="col-12 order-1 col-md-8 order-md-2 col-lg-7 order-lg-2 guide-section" id="middle_col">
                  <!-- start body -->
                  
<div class="page_header">
A newer version is available. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div class="navheader">
<span class="prev">
<a href="securing-beats.html">« Configure APM Server to use X-Pack security</a>
</span>
<span class="next">
<a href="beats-user-access.html">Grant users access to APM Server indices »</a>
</span>
</div>
<div class="book" lang="en">
<div class="titlepage">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="/guide/">Elastic Docs</a></span>
<span class="chevron-right">›</span><span class="breadcrumb-link">
  <div id="related-products" class="dropdown">
  <div class="related-products-title">APM:</div>
  <div class="dropdown-anchor" tabindex="0">Server Reference<span class="dropdown-icon"></span></div>
  <div class="dropdown-content">
  <ul>
  <li class="dropdown-category">APM</li>
  <ul>
  <li><a href="/guide/en/observability/current/apm.html">Observability › APM</a></li>
  </ul>
  <li class="dropdown-category">APM agents</li>
  <ul>
  <li><a href="/guide/en/apm/agent/android/current/intro.html">Android Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/go/current/introduction.html">Go Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/swift/current/intro.html">iOS Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/java/current/intro.html">Java Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/dotnet/current/intro.html">.NET Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/nodejs/current/intro.html">Node.js Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/php/current/intro.html">PHP Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/python/current/getting-started.html">Python Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/ruby/current/introduction.html">Ruby Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/rum-js/current/intro.html">Real User Monitoring JavaScript Agent Reference</a></li>
  </ul>
  <li class="dropdown-category">APM extensions</li>
  <ul>
  <li><a href="/guide/en/apm/lambda/current/aws-lambda-arch.html">AWS Lambda extension</a></li>
  <li><a href="/guide/en/apm/attacher/current/apm-attacher.html">Attacher</a></li>
  </ul>
  </ul>
  </div>
  </div>
<span class="chevron-right">›</span><span class="breadcrumb-link"><a href="securing-apm-server.html">Securing APM Server</a></span>
<span class="chevron-right">›</span><span class="breadcrumb-link"><a href="securing-beats.html">Configure APM Server to use X-Pack security</a></span>
</div>
<div>
<div><h1 class="title"><a id="id-1"></a>Configure authentication credentials</h1><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/6.6/docs/copied-from-beats/security/basic-auth.asciidoc">edit</a></div>
</div>
<!--EXTRA-->
</div>
<div id="content">
<div id="url-to-v3" class="version-warning">
    <strong>IMPORTANT</strong>: This documentation is no longer updated. Refer to <a href="https://www.elastic.co/support/eol">Elastic's version policy</a> and the <a href="https://www.elastic.co/docs">latest documentation</a>.
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<div class="position-relative"><h2 class="title"><a id="beats-basic-auth"></a>Configure authentication credentials<a class="xpack_tag" href="/subscriptions"></a></h2><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/6.6/docs/copied-from-beats/security/basic-auth.asciidoc">edit</a></div>
</div></div></div>
<p>When sending data to a secured cluster through the <code class="literal">elasticsearch</code>
output, APM Server must either provide basic authentication credentials
or present a client certificate.</p>
<p>To configure authentication credentials for APM Server:</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>Create a writer role that has the following privileges:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<span class="strong strong"><strong>Cluster</strong></span>: <code class="literal">manage_index_templates</code> and <code class="literal">monitor</code>
</li>
<li class="listitem">
<span class="strong strong"><strong>Index</strong></span>: <code class="literal">write</code> and <code class="literal">create_index</code> on the APM Server indices
</li>
</ul>
</div>
<p>You can create roles from the <span class="strong strong"><strong>Management / Roles</strong></span> UI in Kibana or through the
<code class="literal">role</code> API. For example, the following request creates a role named
<code class="literal">apm_writer</code>:</p>
<div class="pre_wrapper lang-sh">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-sh">POST _xpack/security/role/apm_writer
{
  "cluster": ["manage_index_templates","monitor"],
  "indices": [
    {
      "names": [ "apm-*" ], <a id="CO5-1"></a><i class="conum" data-value="1"></i>
      "privileges": ["write","create_index"]
    }
  ]
}</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO5-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>If you use a custom APM Server index pattern, specify that pattern
instead of the default <code class="literal">apm-*</code> pattern.</p>
</td>
</tr>
</table>
</div>
</li>
<li class="listitem">
<p>Assign the writer role to the user that APM Server will use to connect to
Elasticsearch. If you plan to load the pre-built Kibana dashboards, also assign the
<code class="literal">kibana_user</code> role.</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>To authenticate as a native user, create a user for APM Server to use
internally and assign it the writer role, plus any other roles that are
needed.</p>
<p>You can create users from the <span class="strong strong"><strong>Management / Users</strong></span> UI in Kibana or through the
<code class="literal">user</code> API. For example, following request creates a user
named <code class="literal">apm_internal</code> that has the
<code class="literal">apm_writer</code> and <code class="literal">kibana_user</code> roles:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">POST /_xpack/security/user/apm_internal
{
  "password" : "YOUR_PASSWORD",
  "roles" : [ "apm_writer","kibana_user"],
  "full_name" : "Internal APM Server User"
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1.console"></div>
</li>
<li class="listitem">
<p>To use PKI authentication, assign the writer role, plus any other roles that are
needed, in the <code class="literal">role_mapping.yml</code> configuration file. Specify the user by the
distinguished name that appears in its certificate:</p>
<div class="pre_wrapper lang-yaml">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-yaml">apm_writer:
  - "cn=Internal APM Server User,ou=example,o=com"
kibana_user:
  - "cn=Internal APM Server User,ou=example,o=com"</pre>
</div>
<p>For more information, see
<a href="/guide/en/x-pack/6.2/mapping-roles.html#mapping-roles-file" class="ulink" target="_top">Using Role Mapping Files</a>.</p>
</li>
</ol>
</div>
</li>
<li class="listitem">
<p>In the APM Server configuration file, specify authentication credentials
for the <code class="literal">elasticsearch</code> output:</p>
<div class="olist orderedlist">
<ol class="orderedlist">
<li class="listitem">
<p>To use basic authentication, configure the <code class="literal">username</code> and <code class="literal">password</code> settings.
For example, the following APM Server output configuration uses the native
<code class="literal">apm_internal</code> user to connect to Elasticsearch:</p>
<div class="pre_wrapper lang-js">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-js">output.elasticsearch:
  hosts: ["localhost:9200"]
  username: "apm_internal" <a id="CO6-1"></a><i class="conum" data-value="1"></i>
  password: "YOUR_PASSWORD" <a id="CO6-2"></a><i class="conum" data-value="2"></i></pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO6-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>You created this user earlier.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO6-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>The example shows a hard-coded password, but you should store sensitive
values in the <a class="xref" href="keystore.html" title="Secrets keystore for secure settings">secrets keystore</a>.</p>
</td>
</tr>
</table>
</div>
</li>
<li class="listitem">
<p>To use PKI authentication, configure the <code class="literal">certificate</code> and <code class="literal">key</code> settings:</p>
<div class="pre_wrapper lang-js">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-js">output.elasticsearch:
  hosts: ["localhost:9200"]
  ssl.certificate: "/etc/pki/client/cert.pem" <a id="CO7-1"></a><i class="conum" data-value="1"></i>
  ssl.key: "/etc/pki/client/cert.key"</pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO7-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The distinguished name (DN) in the certificate must be mapped to
the <code class="literal">apm_writer</code> and <code class="literal">kibana_user</code> roles in the
<code class="literal">role_mapping.yml</code> configuration file on each node in the Elasticsearch cluster.</p>
</td>
</tr>
</table>
</div>
</li>
</ol>
</div>
</li>
</ol>
</div>
</div>
</div>
</div><div class="navfooter">
<span class="prev">
<a href="securing-beats.html">« Configure APM Server to use X-Pack security</a>
</span>
<span class="next">
<a href="beats-user-access.html">Grant users access to APM Server indices »</a>
</span>
</div>

                  <!-- end body -->
                </div>

                <div class="col-12 order-3 col-lg-2 order-lg-3 h-almost-full-lg sticky-top-lg" id="right_col">
                  <div id="sticky_content">
                    <!-- The OTP is appended here -->
                    <div class="row">
                      <div class="col-0 col-md-4 col-lg-0" id="bottom_left_col"></div>
                      <div class="col-12 col-md-8 col-lg-12">
                        <div id="rtpcontainer">
                          <div class="mktg-promo" id="most-popular">
                            <p class="aside-heading">Most Popular</p>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/getting-started-elasticsearch?page=docs&placement=top-video">
                                <p class="mb-0">Get Started with Elasticsearch</p>
                              </a>
                            </div>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/getting-started-kibana?page=docs&placement=top-video">
                                <p class="mb-0">Intro to Kibana</p>
                              </a>
                            </div>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/introduction-elk-stack?page=docs&placement=top-video">
                                <p class="mb-0">ELK for Logs & Metrics</p>
                              </a>
                            </div>
                          </div>
                        </div>

                        <!-- Feedback widget -->
                        <div id="feedbackWidgetContainer"></div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


        <div id='elastic-footer'></div>
        <script src='https://www.elastic.co/elastic-footer.js'></script>
        <!-- Footer Section end-->

      </section>
    </div>

    <!-- Feedback modal -->
    <div id="feedbackModalContainer"></div>

    <script src="/guide/static/jquery.js"></script>
    <script type="text/javascript" src="/guide/static/docs-v1.js"></script>
    <script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>