Setup Elasticsearch 8 authentication with LDAP and Active Directory integration

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
LDAP_URL=""
BIND_DN=""
USER_BASE_DN=""
GROUP_BASE_DN=""
DOMAIN=""

# Usage message
usage() {
    echo "Usage: $0 --ldap-url <ldap://domain.com> --bind-dn <cn=bind,dc=domain,dc=com> --user-base-dn <ou=users,dc=domain,dc=com> --group-base-dn <ou=groups,dc=domain,dc=com> --domain <domain.com>"
    echo ""
    echo "Example: $0 --ldap-url ldap://ad.company.com --bind-dn 'cn=elasticsearch,cn=Users,dc=company,dc=com' --user-base-dn 'ou=Users,dc=company,dc=com' --group-base-dn 'ou=Groups,dc=company,dc=com' --domain company.com"
    exit 1
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --ldap-url)
            LDAP_URL="$2"
            shift 2
            ;;
        --bind-dn)
            BIND_DN="$2"
            shift 2
            ;;
        --user-base-dn)
            USER_BASE_DN="$2"
            shift 2
            ;;
        --group-base-dn)
            GROUP_BASE_DN="$2"
            shift 2
            ;;
        --domain)
            DOMAIN="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            ;;
    esac
done

# Validate required arguments
if [[ -z "$LDAP_URL" || -z "$BIND_DN" || -z "$USER_BASE_DN" || -z "$GROUP_BASE_DN" || -z "$DOMAIN" ]]; then
    echo -e "${RED}All arguments are required${NC}"
    usage
fi

# Cleanup function
cleanup() {
    echo -e "${RED}Installation failed. Cleaning up...${NC}"
    systemctl stop elasticsearch 2>/dev/null || true
    if [[ "$PKG_MGR" == "apt" ]]; then
        apt remove -y elasticsearch 2>/dev/null || true
    else
        $PKG_INSTALL remove elasticsearch 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}[1/8] Detecting distribution...${NC}"

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            JAVA_PKG="openjdk-11-jdk"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            JAVA_PKG="java-11-openjdk-devel"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            JAVA_PKG="java-11-openjdk-devel"
            ;;
        *) 
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

echo -e "${GREEN}Detected: $PRETTY_NAME (Package manager: $PKG_MGR)${NC}"

echo -e "${GREEN}[2/8] Updating system packages...${NC}"
$PKG_UPDATE

echo -e "${GREEN}[3/8] Installing Java and dependencies...${NC}"
$PKG_INSTALL $JAVA_PKG curl wget gnupg

echo -e "${GREEN}[4/8] Adding Elasticsearch repository...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
    echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" > /etc/apt/sources.list.d/elastic-8.x.list
    apt update
else
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
    cat > /etc/yum.repos.d/elasticsearch.repo << 'EOF'
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md
EOF
fi

echo -e "${GREEN}[5/8] Installing Elasticsearch...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL elasticsearch
else
    $PKG_INSTALL --enablerepo=elasticsearch elasticsearch
fi

echo -e "${GREEN}[6/8] Configuring Elasticsearch LDAP authentication...${NC}"

# Backup original config
cp /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml.backup

# Configure Elasticsearch with LDAP
cat >> /etc/elasticsearch/elasticsearch.yml << EOF

# LDAP Authentication Configuration
xpack.security.enabled: true
xpack.security.enrollment.enabled: true

xpack.security.authc.realms.ldap.ldap1:
  order: 0
  url: "$LDAP_URL"
  bind_dn: "$BIND_DN"
  user_search:
    base_dn: "$USER_BASE_DN"
    filter: "(cn={0})"
  group_search:
    base_dn: "$GROUP_BASE_DN"
    filter: "(member={0})"
  files:
    role_mapping: "/etc/elasticsearch/role_mapping.yml"
  unmapped_groups_as_roles: false
EOF

# Create role mapping file
cat > /etc/elasticsearch/role_mapping.yml << EOF
superuser:
  - "cn=elasticsearch_admin,${GROUP_BASE_DN}"
  - "cn=domain admins,${GROUP_BASE_DN}"

kibana_admin:
  - "cn=elasticsearch_kibana,${GROUP_BASE_DN}"

monitoring_user:
  - "cn=elasticsearch_monitoring,${GROUP_BASE_DN}"

viewer:
  - "cn=elasticsearch_read,${GROUP_BASE_DN}"
EOF

# Set proper permissions
chown root:elasticsearch /etc/elasticsearch/elasticsearch.yml
chown root:elasticsearch /etc/elasticsearch/role_mapping.yml
chmod 660 /etc/elasticsearch/elasticsearch.yml
chmod 660 /etc/elasticsearch/role_mapping.yml

echo -e "${GREEN}[7/8] Starting and enabling Elasticsearch...${NC}"
systemctl daemon-reload
systemctl enable elasticsearch
systemctl start elasticsearch

# Wait for Elasticsearch to start
echo -e "${YELLOW}Waiting for Elasticsearch to start...${NC}"
for i in {1..30}; do
    if curl -s http://localhost:9200 >/dev/null 2>&1; then
        break
    fi
    sleep 2
    if [[ $i -eq 30 ]]; then
        echo -e "${RED}Elasticsearch failed to start within 60 seconds${NC}"
        exit 1
    fi
done

echo -e "${GREEN}[8/8] Configuring firewall...${NC}"
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
    ufw allow 9200/tcp
    ufw allow 9300/tcp
elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active firewalld >/dev/null 2>&1; then
    firewall-cmd --permanent --add-port=9200/tcp
    firewall-cmd --permanent --add-port=9300/tcp
    firewall-cmd --reload
fi

echo -e "${GREEN}Installation completed successfully!${NC}"
echo ""
echo -e "${YELLOW}Important notes:${NC}"
echo "1. Set the bind user password in the keystore:"
echo "   sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.authc.realms.ldap.ldap1.secure_bind_password"
echo ""
echo "2. Create the following groups in your LDAP/AD:"
echo "   - elasticsearch_admin (full access)"
echo "   - elasticsearch_kibana (Kibana access)"
echo "   - elasticsearch_monitoring (monitoring access)"
echo "   - elasticsearch_read (read-only access)"
echo ""
echo "3. Restart Elasticsearch after setting the password:"
echo "   sudo systemctl restart elasticsearch"
echo ""
echo "4. Test the configuration:"
echo "   curl -u username:password http://localhost:9200/_cluster/health"
echo ""
echo "Configuration files:"
echo "- Main config: /etc/elasticsearch/elasticsearch.yml"
echo "- Role mapping: /etc/elasticsearch/role_mapping.yml"
echo "- Logs: /var/log/elasticsearch/"