You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This page is the migrated and refined version of [this original
doc](https://www.elastic.co/guide/en/kibana/current/secure-reporting.html).
I had to change a few things to make the flow better. Certain
configuration steps are only applicable to self-managed deployments,
while others are applicable to all deployment types. Probably I'll need
review and guidance here for the `applies_to` tags and how to address
that part.
---------
Co-authored-by: shainaraskas <[email protected]>
Copy file name to clipboardExpand all lines: deploy-manage/deploy/self-managed/configure-kibana.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Refer to the following documentation to learn how to perform key configuration t
37
37
38
38
*[Configure SSL certificates](/deploy-manage/security/set-up-basic-security-plus-https.md#encrypt-kibana-browser) to encrypt traffic between client browsers and {{kib}}
39
39
*[Enable authentication providers](/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication.md) for {{kib}}
40
-
* Configure the {{kib}} [reporting feature](/deploy-manage/deploy/kibana-reporting-configuration.md)
40
+
* Configure the {{kib}} [reporting feature](/deploy-manage/kibana-reporting-configuration.md)
41
41
* Use [Spaces](/deploy-manage/manage-spaces.md) to organize content in {{kib}}, and restrict access to this content to specific users
42
42
* Use [Connectors](/deploy-manage/manage-connectors.md) to manage connection information between {{es}}, {{kib}}, and third-party systems
43
43
* Present a [user access agreement](/deploy-manage/users-roles/cluster-or-deployment-auth/access-agreement.md) when logging on to {{kib}}
# Configure reporting in {{kib}} [secure-reporting]
13
+
% this anchor belongs to `kibana reporting production considerations doc`
14
+
$$$reporting-chromium-sandbox$$$
6
15
16
+
# Configure Kibana reporting [secure-reporting]
7
17
8
-
::::{note}
9
-
Kibana PNG/PDF Reporting uses a custom binary of headless Chromium, and support comes with special caveats:
18
+
{{kib}}'s reporting functionality offers multiple ways to share **Discover** sessions, dashboards, **Visualize Library** visualizations, and **Canvas** workpads.
19
+
20
+
This section covers the necessary configuration to ensure reporting works correctly in your deployment. For guidance on using {{report-features}} effectively, refer to [](/explore-analyze/report-and-share.md).
21
+
22
+
::::{admonition} Note for self-managed deployments
23
+
Kibana PNG/PDF reporting uses a custom binary of headless Chromium, and support comes with special caveats:
10
24
11
25
* The functionality requires special OS dependencies which may not be available for all distributions and configurations of Linux.
12
26
* It is subject to system resource configurations such as the limited number of file descriptors, allowed processes, and types of processes.
13
27
* Linux versions that are in end-of-life phase are not supported.
14
-
* Linux systems with SELinux or fapolicyd are not supported.
15
-
16
-
Before upgrading Kibana in a production environment, we encourage you to test your screenshotting use cases in a pre-production environment to make sure your hosts support our latest build of Chromium. For the most reliable configuration of PDF/PNG {{report-features}}, consider installing {{kib}} using [Docker](../../../deploy-manage/deploy/self-managed/install-kibana-with-docker.md), or using [Elastic Cloud](https://cloud.elastic.co).
28
+
* Linux systems with `SELinux` or `fapolicyd` are not supported.
17
29
30
+
Before upgrading Kibana in a production environment, we encourage you to test your screenshotting use cases in a pre-production environment to make sure your hosts support our latest build of Chromium. For the most reliable configuration of PDF/PNG {{report-features}}, consider installing {{kib}} using [Docker](/deploy-manage/deploy/self-managed/install-kibana-with-docker.md), or using [Elastic Cloud](https://cloud.elastic.co).
18
31
::::
19
32
33
+
## Configuration overview
34
+
35
+
To secure {{report-features}}, you must grant users access to reporting functionality and protect the reporting endpoints with TLS/SSL encryption. Additionally, you can install graphical packages on the operating system to enable screenshot capabilities in the {{kib}} server.
36
+
37
+
Configuring reporting in your environment involves two main areas:
38
+
39
+
### Granting users access to {{report-features}}
20
40
21
-
For security, you grant users access to the {{report-features}} and secure the reporting endpoints with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system to enable the {{kib}} server to have screenshotting capabilities.
41
+
Depending on your license, the type of users, and whether you prefer using the {{kib}} UI or API, there are multiple ways to [grant access to reporting functionality](#grant-user-access).
22
42
23
-
*[Grant users access to reporting](../../../explore-analyze/report-and-share.md#grant-user-access)
24
-
*[Grant access with the role API](../../../explore-analyze/report-and-share.md#reporting-roles-user-api)
25
-
*[Grant users access with a Basic license](../../../explore-analyze/report-and-share.md#grant-user-access-basic)
26
-
*[Grant access using an external provider](../../../explore-analyze/report-and-share.md#grant-user-access-external-provider)
27
-
*[Secure the reporting endpoints](../../../explore-analyze/report-and-share.md#securing-reporting)
28
-
*[Install the dependencies for the headless browser](../../../explore-analyze/report-and-share.md#install-reporting-packages)
29
-
*[Set the `server.host` for the headless browser](../../../explore-analyze/report-and-share.md#set-reporting-server-host)
The following configurations are required at {{es}}, {{kib}}, and OS levels to support {{report-features}}.
46
+
47
+
::::{important}
48
+
These steps apply only to **self-managed deployments**. Orchestrated deployments include this configuration by default. For more details on different deployment options, refer to [](/deploy-manage/deploy.md).
49
+
::::
50
+
51
+
*[Secure the reporting endpoints](#securing-reporting)
52
+
*[Install the dependencies for the headless browser](#install-reporting-packages)
53
+
*[Set the `server.host` for the headless browser](#set-reporting-server-host)
## Grant users access to reporting [grant-user-access]
57
+
```yaml {applies_to}
58
+
deployment:
59
+
self: all
60
+
ece: all
61
+
eck: all
62
+
ess: all
63
+
```
64
+
65
+
Choose the method that best fits your use case.
66
+
67
+
:::::{tab-set}
34
68
35
-
When security is enabled, you grant users access to {{report-features}} with [{{kib}} application privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md), which allow you to create custom roles that control the spaces and applications where users generate reports.
69
+
::::{tab-item} Using {{kib}} UI
70
+
71
+
When security is enabled, you grant users access to {{report-features}} with [{{kib}} application privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md), which allow you to create custom roles that control the spaces and applications where users generate reports.
36
72
37
73
1. Create the reporting role.
38
74
@@ -46,12 +82,11 @@ When security is enabled, you grant users access to {{report-features}} with [{{
46
82
47
83
Access to data is an index-level privilege. For each index that contains the data you want to include in reports, add a line, then give each index `read` and `view_index_metadata` privileges.
48
84
49
-
::::{note}
85
+
:::{note}
50
86
If you use index aliases, you must also grant `read` and `view_index_metadata` privileges to underlying indices to generate CSV reports.
51
-
::::
52
-
87
+
:::
53
88
54
-
For more information, refer to [Security privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md).
89
+
For more information, refer to [Security privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md).
55
90
56
91
3. Add the {{kib}} privileges.
57
92
@@ -60,19 +95,19 @@ When security is enabled, you grant users access to {{report-features}} with [{{
60
95
3. Click **Customize**, then click **Analytics**.
61
96
4. For each application, select **All**, or to customize the privileges, select **Read** and **Customize sub-feature privileges**.
62
97
63
-
::::{note}
64
-
If you have a Basic license, sub-feature privileges are unavailable. For details, check out [Grant users access with a Basic license](../../../explore-analyze/report-and-share.md#grant-user-access-basic).
65
-
::::
98
+
:::{note}
99
+
If you have a Basic license, sub-feature privileges are unavailable.
:alt: Kibana privileges with Reporting options, Gold or higher license
70
105
:screenshot:
71
106
:::
72
107
73
-
::::{note}
108
+
:::{note}
74
109
If the **Reporting** options for application features are unavailable, and the cluster license is higher than Basic, contact your administrator.
75
-
::::
110
+
:::
76
111
77
112
5. Click **Add {{kib}} privilege**.
78
113
@@ -88,34 +123,35 @@ When security is enabled, you grant users access to {{report-features}} with [{{
88
123
Granting the privilege to generate reports also grants the user the privilege to view their reports in **Stack Management > Reporting**. Users can only access their own reports.
89
124
90
125
91
-
### Grant access with the role API [reporting-roles-user-api]
126
+
::::
127
+
128
+
::::{tab-item} Using role API
92
129
93
-
With [{{kib}} application privileges](../../../explore-analyze/report-and-share.md#grant-user-access), you can use the [role APIs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-roles) to grant access to the {{report-features}}, using **All** privileges, or sub-feature privileges.
130
+
With [{{kib}} application privileges](#grant-user-access), you can use the [role APIs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-roles) to grant access to the {{report-features}}, using **All** privileges, or sub-feature privileges.
94
131
95
-
::::{note}
132
+
:::{note}
96
133
This API request needs to be run against the [Kibana API endpoint](https://www.elastic.co/guide/en/kibana/current/api.html).
97
-
::::
98
-
134
+
:::
99
135
100
136
```console
101
137
PUT <kibana host>:<port>/api/security/role/custom_reporting_user
102
138
{
103
-
"elasticsearch": {
104
-
"cluster": [],
105
-
"indices": [],
106
-
"run_as": []
107
-
},
108
-
"kibana": [{
109
-
"spaces": ["*"],
110
-
"base": [],
111
-
"feature": {
112
-
"dashboard_v2": ["generate_report", <1>
139
+
"elasticsearch": {
140
+
"cluster": [],
141
+
"indices": [],
142
+
"run_as": []
143
+
},
144
+
"kibana": [{
145
+
"spaces": ["*"],
146
+
"base": [],
147
+
"feature": {
148
+
"dashboard_v2": ["generate_report", <1>
113
149
"download_csv_report"], <2>
114
150
"discover_v2": ["generate_report"], <3>
115
-
"canvas": ["generate_report"], <4>
116
-
"visualize_v2": ["generate_report"] <5>
117
-
}
118
-
}]
151
+
"canvas": ["generate_report"], <4>
152
+
"visualize_v2": ["generate_report"] <5>
153
+
}
154
+
}]
119
155
}
120
156
```
121
157
@@ -124,19 +160,35 @@ PUT <kibana host>:<port>/api/security/role/custom_reporting_user
124
160
3. Grants access to generate CSV reports from saved Discover sessions in **Discover**.
125
161
4. Grants access to generate PDF reports in **Canvas**.
126
162
5. Grants access to generate PNG and PDF reports in **Visualize Library**.
163
+
::::
127
164
165
+
::::{tab-item} External providers
128
166
167
+
If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in [`config/role_mapping.yml`](/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles.md).
129
168
130
-
## Grant users access with a Basic license [grant-user-access-basic]
169
+
For example, assign the `kibana_admin` and `reporting_user` roles to the Bill Murray user:
170
+
171
+
```yaml
172
+
kibana_admin:
173
+
- "cn=Bill Murray,dc=example,dc=com"
174
+
reporting_user:
175
+
- "cn=Bill Murray,dc=example,dc=com"
176
+
```
177
+
178
+
::::
179
+
180
+
::::{tab-item} Basic license
181
+
182
+
With a Basic license, sub-feature [application privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) are unavailable, requiring you to select **All** privileges for the applications where users can create reports. You can grant users access through the Kibana UI or role API.
131
183
132
-
With a Basic license, you can grant users access with custom roles to {{report-features}} with [{{kib}} application privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md). However, with a Basic license, sub-feature privileges are unavailable. [Create a role](../../../explore-analyze/report-and-share.md#grant-user-access), then select **All** privileges for the applications where users can create reports.
:alt: Kibana privileges with Reporting options, Basic license
136
188
:screenshot:
137
189
:::
138
190
139
-
With a Basic license, sub-feature application privileges are unavailable, but you can use the [role API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-put-role) to grant access to CSV {{report-features}}:
191
+
Example using [role API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-roles) to grant access to CSV {{report-features}}:
140
192
141
193
```console
142
194
PUT localhost:5601/api/security/role/custom_reporting_user
@@ -155,28 +207,24 @@ PUT localhost:5601/api/security/role/custom_reporting_user
155
207
"metadata": {} <3>
156
208
}
157
209
```
158
-
159
210
1. Grants access to generate CSV reports from saved Discover sessions in **Discover**.
160
211
2. Grants access to generate CSV reports from saved Discover session panels in **Dashboard**.
161
212
3. Optional
162
213
214
+
::::
163
215
216
+
:::::
164
217
165
-
### Grant access using an external provider [grant-user-access-external-provider]
166
-
167
-
If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in [`config/role_mapping.yml`](../../../deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles.md).
168
-
169
-
For example, assign the `kibana_admin` and `reporting_user` roles to the Bill Murray user:
170
-
171
-
```yaml
172
-
kibana_admin:
173
-
- "cn=Bill Murray,dc=example,dc=com"
174
-
reporting_user:
175
-
- "cn=Bill Murray,dc=example,dc=com"
218
+
## System configuration
219
+
```yaml {applies_to}
220
+
deployment:
221
+
self: all
176
222
```
223
+
The following configurations are required at {{es}}, {{kib}}, and OS levels to support reporting features.
177
224
225
+
These steps apply only to **self-managed deployments**. Orchestrated deployments include this configuration by default. For more details on different deployment options, refer to [](/deploy-manage/deploy.md).
178
226
179
-
## Secure the reporting endpoints [securing-reporting]
227
+
### Secure the reporting endpoints [securing-reporting]
180
228
181
229
To automatically generate reports with {{watcher}}, you must configure {{watcher}} to trust the {{kib}} server certificate.
182
230
@@ -205,10 +253,10 @@ To automatically generate reports with {{watcher}}, you must configure {{watcher
205
253
Once you’ve enabled SSL for {{kib}}, all requests to the reporting endpoints must include valid credentials.
206
254
207
255
208
-
For more information on sharing reports, direct links, and more, refer to [Reporting and sharing](../../../explore-analyze/report-and-share.md).
256
+
For more information on sharing reports, direct links, and more, refer to [Reporting and sharing](/explore-analyze/report-and-share.md).
209
257
210
258
211
-
## Install the dependencies for the headless browser [install-reporting-packages]
259
+
### Install the dependencies for the headless browser [install-reporting-packages]
212
260
213
261
If using PNG/PDF {{report-features}}, make sure the {{kib}} server operating system has the appropriate packages installed for the distribution.
214
262
@@ -230,15 +278,15 @@ If you are using Ubuntu/Debian systems, install the following packages:
230
278
* `libfontconfig1`
231
279
* `libnss3`
232
280
233
-
The screenshotting plugin used for {{report-features}} has a built-in utility to check for common issues, such as missing dependencies. See [Reporting diagnostics](../../../explore-analyze/report-and-share/reporting-troubleshooting-pdf.md#reporting-diagnostics) for more information.
281
+
The screenshotting plugin used for {{report-features}} has a built-in utility to check for common issues, such as missing dependencies. See [Reporting diagnostics](/explore-analyze/report-and-share/reporting-troubleshooting-pdf.md#reporting-diagnostics) for more information.
234
282
235
283
236
-
## Set the `server.host` for the headless browser [set-reporting-server-host]
284
+
### Set the `server.host` for the headless browser [set-reporting-server-host]
237
285
238
286
If using PNG/PDF {{report-features}} in a production environment, it is preferred to use the setting of `server.host: 0.0.0.0` in the `kibana.yml` configuration file. This allows the headless browser used for PDF/PNG reporting to reach {{kib}} over a local interface, while also allowing the {{kib}} server to listen on outward-facing network interfaces, as it makes the {{kib}} server accessible from any network interface on the machine. Make sure that no firewall rules or other routing rules prevent local services from accessing this address.
Reporting relies on {{es}} to install a mapping template for the data stream that stores reports. Ensure that {{es}} allows built-in templates to be installed by keeping the `stack.templates.enabled` setting at the default value of `true`. For more information, see [Index management settings](elasticsearch://reference/elasticsearch/configuration-reference/index-management-settings.md#stack-templates-enabled).
0 commit comments