Manage Security Settings

The basic settings for Couchbase security, available to Full and Security administrators, allow configuration of the following:

These areas are described below.

To start managing Couchbase Server security-settings, within Couchbase Web Console, access the Security screen, by means of the Security tab, on the left-hand navigation bar:

This brings up the Security screen, which appears as follows:

Note the tabs that run from left to right, along the upper, horizontal control-bar. These are Users & Groups, Certificates, Audit, Log Redaction, and Other Settings. To display the corresponding screen-content for each, left-click on the tab:

Note also that the upper area of the screen displays notices regarding the enablement-status of LDAP, which can be used in support of external user-authentication. See Authentication Domains, for an overview.

The Users & Groups display (shown above) lists users and groups currently registered on the cluster. The display can be toggled, to provide information for either users or groups.

Each user has a username and (optionally) a full name; and can have one or more roles associated with them. These roles are themselves associated with privileges that permit access to specified system-resources. The auth domain for each user can be Local or External. To add users and, in so doing, assign them roles, administrators use the ADD USER button, at the upper right. Additionally, each user can be made a member of a defined group.

Each defined group has a group name and (optionally) a description; and can have one or more roles assigned to it. If a user becomes a member of a group, the user inherts all the group’s assigned roles. A group can also be assigned a mapping to an LDAP group that is maintained on a remote, LDAP server. For information on how Native LDAP Support can be used to support mappings, see Authorization.

A full account of adding and editing users and groups is provided in Manage Users, Groups, and Roles.

This displays a screen featuring two panels. The panel to the left features the root CA certificates that have been defined for the cluster:

Initially, before any administrator-driven configuration has occurred, this panel contains a single, system-generated, self-signed certificate. To increase system-security, a new X.509 certificate should be created: once this has been done, the new, uploaded certificate is displayed beneath the original, system-generated certificate; as shown here.

See Configure Server Certificates, for further information.

Note that the procedures for securing Cross Data Center Replication (XDCR) may involve use of the root certificate: if so, the certificate can be copied from this screen. See Secure a Replication for details.

The right-hand panel features settings for the cluster’s handling of certificates that are presented by clients attempting access:

The user interface allows the handling of client certificates to be enabled, and optionally to be made mandatory. Note that such handling is disabled by default. The Path, Prefix, and Delimiter fields allow the specification of which details within the client certificate are to be used by the server for client-identification.

An explanation of how to use this interface is provided in Enable Client-Certificate Handling. A detailed account of establishing client-certificate settings is provided in Configure Client Certificates.

This displays the audit options for the cluster:

The options permit selection of the directory within which the audit log file is to be saved, and the frequency with which it will be rotated. Specific events can also be included in the audit process, or excluded from it.

For further information, see Manage Auditing.

The Other Settings panel provides settings for Log Redaction, Session Timeout, and Cluster Encryption.