elasticsearch-authn

Authenticate to an Elasticsearch cluster using any supported authentication realm and manage the full API key lifecycle. It covers native username/password, file-based users, external LDAP and Active Directory, PKI / mutual-TLS client certificates, SAML, OIDC, JWT bearer tokens, and Kerberos, and assumes the target realms are already configured. For roles and role mappings it points to a companion elasticsearch-authz skill.

Elasticsearch evaluates realms in a configured order called the realm chain, and the first realm that can authenticate a request wins; internal realms (native, file) are managed by Elasticsearch while external realms delegate to enterprise identity systems. Many external realms send an identical _authenticate request and are simply routed by the chain. The skill maps typical jobs to be done — verifying who is currently authenticated, connecting with an API key bearer token, creating scoped API keys for automation, rotating or invalidating keys, granting keys on behalf of other users, and setting up service-account tokens.

A strong operational theme is secret hygiene: it instructs never to ask the user to paste passwords, keys, or tokens into the chat, and to reference environment variables such as ELASTICSEARCH_URL, ELASTICSEARCH_API_KEY, and ELASTICSEARCH_USERNAME/PASSWORD, preferring a project .env file over terminal exports because sandboxed agent shells may not inherit the user's environment. Each realm entry notes deployment compatibility, since not every realm is available across self-managed, Elastic Cloud Hosted, and Serverless deployments — for example file, LDAP, AD, and Kerberos are self-managed only, and SAML/OIDC rely on browser-redirect flows better suited to Kibana than to REST clients. Concrete curl examples accompany each method, and detailed endpoints live in a referenced api-reference file.