Shield defines a known set of users in order to authenticate users that make requests. These sets of users are defined with an abstraction called a realm. A realm is a user database configured for the use of the Shield plugin. The supported realms are native, file, LDAP, Active Directory, PKI.
In the native realm, users are stored and distributed with the Elasticsearch cluster. With the native realm, the administrator manages users with the API for user management, and all the user operations occur within the Elasticsearch cluster. Users authenticate with a username and password pair.
In the file realm, users exist in files stored on each node of the Elasticsearch cluster. With the file realm, the administrator manages users with tools provided by Elasticsearch, and all the user operations occur within the Elasticsearch cluster. Users authenticate with a username and password pair.
In the Active Directory realm, the administrator manages users within Active Directory. Elasticsearch authenticates users using the LDAP protocol to Active Directory. Users authenticate with a username and password pair. Shield also enables mapping Active Directory security groups to roles in Shield.
In the PKI realm, the administrator manages users with tools for X.509 certificate management. Elasticsearch authenticates users by validating that their X.509 certificate has been signed by a trusted authority. Users authenticate by presenting their PKI certificate during TLS communication and Shield maps the subject to the appropriate roles.
Your application can be a user in a Shield realm. Elasticsearch Clients authenticate to the cluster by providing a username and password pair (a.k.a Authentication Token) with each request. To learn more on how different clients can authenticate, see Configuring Clients and Integrations.
For more information on how to secure nodes see Securing Communications with Encryption and IP Filtering.