Set up authentication and authorization

Enable and require user-based authentication when using the Kapacitor HTTP API. Kapacitor can either store user roles and permissions locally or use InfluxDB Enterprise authorizations to authenticate requests.

Kapacitor authentication configuration options

The following authentication-related configuration options are available in the kapacitor.conf and can also be set with environment variables:

• [http]
  • auth-enabled: Enable and enforce basic authentication on the Kapacitor HTTP API.
• [auth]
  • enabled: Enable the Kapacitor authentication service.
  • cache-expiration: How long a consumer service can hold a credential document in its cache.
  • bcrypt-cost: The number of iterations used when hashing the password using the bcrypt algorithm. Higher values generate hashes more resilient to brute force cracking attempts, but lead to marginally longer resolution times.
  • * meta-addr: The address of the InfluxDB Enterprise meta node to connect to for accessing the user and permission store.
  • * meta-use-tls: Use TLS when communicating with the InfluxDB Enterprise meta node.
  • * meta-ca: Path to the certificate authority file for the InfluxDB Enterprise meta node.
  • * meta-cert: Path to the PEM encoded certificate file.
  • * meta-key: Path to the PEM encoded certificate private key.
  • * meta-insecure-skip-verify: Skip chain and host verification when connecting via TLS. Set to true when using a self-signed TLS certificate.

Example authentication settings in the kapacitor.conf

[http]
  # ...
  auth-enabled = true
  # ...

[auth]
  # Enable authentication for Kapacitor.
  enabled = false
  # User permissions cache expiration time.
  cache-expiration = "10m"
  # Cost to compute bcrypt password hashes.
  # bcrypt rounds = 2^cost
  bcrypt-cost = 10
  # Address of an InfluxDB Enterprise meta server.
  # If empty, InfluxDB Enterprise meta nodes are not used as a user store.
  # host:port
  meta-addr = "172.17.0.2:8091"
  meta-use-tls = false
  # Absolute path to PEM encoded Certificate Authority (CA) file.
  # A CA can be provided without a key/certificate pair.
  meta-ca = "/etc/kapacitor/ca.pem"
  # Absolute paths to PEM encoded private key and server certificate files.
  meta-cert = "/etc/kapacitor/cert.pem"
  meta-key = "/etc/kapacitor/key.pem"
  meta-insecure-skip-verify = false