Agent skill

Elasticsearch Authn

Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms.

Install Elasticsearch Authn

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .claude/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .claude/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .claude/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .agents/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .agents/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .agents/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .cursor/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .cursor/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/aspectrr/deer.git --path deer-cli/internal/skill/defaults/elasticsearch-authn

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .gemini/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .gemini/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .github/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .github/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .github/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aspectrr/deer --skill elasticsearch-authn -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install aspectrr/deer elasticsearch-authn --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aspectrr/deer.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/deer-cli/internal/skill/defaults/elasticsearch-authn .opencode/skills/elasticsearch-authn && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "elasticsearch-authn" agent skill from https://github.com/aspectrr/deer/tree/main/deer-cli/internal/skill/defaults/elasticsearch-authn into .opencode/skills/elasticsearch-authn/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "elasticsearch-authn", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: elasticsearch-authn
GitHub stars: 405
Token cost: ~1.2k tokens
SKILL.md length: 344 words
Files: 1
Skills in repo: 14
Repo updated: Apr 21, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms.

Connecting with credentials
SKILL.md covers Critical principles, Authentication Realms, Manage API Keys and Deployment Compatibility, plus 1 more section
Calls curl; needs ELASTICSEARCH_PASSWORD and FILE_PASSWORD
Choosing a realm

What it does

Elasticsearch Authn is an agent skill from aspectrr/deer. Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys.

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Authentication, Search implementation and OAuth and OpenID Connect. It works with Elasticsearch. The repository describes itself as: 🦌 The AI Elasticsearch Engineer. The licence is MIT.

When your agent uses it

Connecting with credentials
Choosing a realm
Managing API keys

Example prompts

“/elasticsearch-authn”

Requirements

A credential in CLIENT_KEY
A credential in JWT_TOKEN

What it can do on your machine

Read from SKILL.md and the folder at commit e4f9845. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- curl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- ELASTICSEARCH_PASSWORD
- FILE_PASSWORD
- LDAP_PASSWORD
- CLIENT_KEY
- JWT_TOKEN
- ELASTICSEARCH_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Elasticsearch Authn loads about 1.2k tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 344 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~53
When it runs · the whole SKILL.md, loaded when a task matches: ~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NoteMentions a .env fileSKILL.md:23

s.** Instruct the user to set them in a `.env` file in the project root.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aspectrr/deer at commit e4f9845, republished under its MIT licence (© aspectrr). 344 words, ~1,230 tokens.

Download SKILL.mdSave it as .claude/skills/elasticsearch-authn/SKILL.md (or your agent's skills folder).

name: elasticsearch-authn
description: Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys.
metadata.author: elastic
metadata.version: 0.1.0
metadata.source: elastic/agent-skills//skills/elasticsearch/elasticsearch-authn

Elasticsearch Authentication

Authenticate to an Elasticsearch cluster using any supported authentication realm that is already configured. Covers all built-in realms, credential verification, and the full API key lifecycle.

For roles, users, role assignment, and role mappings, see the elasticsearch-authz skill.

Critical principles

Never ask for credentials in chat. Secrets must not appear in conversation history.
Always use environment variables. Instruct the user to set them in a .env file in the project root.

Authentication Realms

Elasticsearch evaluates realms in a configured order (the realm chain). The first realm that can authenticate the request wins.

Internal realms

Native (username and password)

bash

curl -u "${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"

File

Users defined in flat files on each cluster node. Always active regardless of license state. Self-managed only.

bash

curl -u "${FILE_USER}:${FILE_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"

External realms

LDAP / Active Directory

Self-managed only. Combined with role mappings to translate LDAP/AD groups to Elasticsearch roles.

bash

curl -u "${LDAP_USER}:${LDAP_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"

PKI (TLS client certificates)

Requires PKI realm and TLS on HTTP layer.

bash

curl --cert "${CLIENT_CERT}" --key "${CLIENT_KEY}" --cacert "${CA_CERT}" \
  "${ELASTICSEARCH_URL}/_security/_authenticate"

SAML / OIDC

Primarily for Kibana SSO. Browser-based redirect flow, not for REST clients. Configure another realm alongside for programmatic API access.

JWT

Accepts JWTs as bearer tokens.

bash

curl -H "Authorization: Bearer ${JWT_TOKEN}" "${ELASTICSEARCH_URL}/_security/_authenticate"

Kerberos

Self-managed only. Requires KDC infrastructure, DNS, and time synchronization.

bash

kinit "${KERBEROS_PRINCIPAL}"
curl --negotiate -u : "${ELASTICSEARCH_URL}/_security/_authenticate"

API keys

Preferred for programmatic and automated access.

bash

curl -H "Authorization: ApiKey ${ELASTICSEARCH_API_KEY}" "${ELASTICSEARCH_URL}/_security/_authenticate"

Manage API Keys

Create an API key

bash

curl -X POST "${ELASTICSEARCH_URL}/_security/api_key" \
  <auth_flags> \
  -H "Content-Type: application/json" \
  -d '{
    "name": "'"${KEY_NAME}"'",
    "expiration": "30d",
    "role_descriptors": {
      "'"${ROLE_NAME}"'": {
        "cluster": [],
        "indices": [
          {
            "names": ["'"${INDEX_PATTERN}"'"],
            "privileges": ["read"]
          }
        ]
      }
    }
  }'

The response contains id, api_key, and encoded. Store encoded securely — it cannot be retrieved again.

Limitation: An API key cannot create another API key with privileges. Use POST /_security/api_key/grant with user credentials instead.

Get and invalidate API keys

bash

curl "${ELASTICSEARCH_URL}/_security/api_key?name=${KEY_NAME}" <auth_flags>
curl -X DELETE "${ELASTICSEARCH_URL}/_security/api_key" \
  <auth_flags> \
  -H "Content-Type: application/json" \
  -d '{"name": "'"${KEY_NAME}"'"}'

Deployment Compatibility

Realm	Self-managed	ECH	Serverless
Native	Yes	Yes	Not available
File	Yes	Not available	Not available
LDAP / AD	Yes	Not available	Not available
PKI	Yes	Limited	Not available
SAML	Yes	Yes (deployment config)	Organization-level
OIDC	Yes	Yes (deployment config)	Not available
JWT	Yes	Yes (deployment config)	Not available
Kerberos	Yes	Not available	Not available
API keys	Yes	Yes	Yes

Guidelines

Prefer API keys for automated workflows — they support fine-grained scoping and independent expiration.
Never use the elastic superuser for day-to-day operations.
Always set expiration on API keys. Avoid indefinite keys in production.
Never receive, echo, or log passwords, API keys, or any credentials in chat.

Files

Just SKILL.md in deer-cli/internal/skill/defaults/elasticsearch-authn of aspectrr/deer.

Open the folder on GitHubat commit e4f9845

Compare with similar skills

Elasticsearch Authn next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Elasticsearch Authn compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Elasticsearch Authn this skillaspectrr/deer	405	—	~1.2k	Automated safety check: Notes	MIT	5 mo ago
Fortify Developmentcoollabsio/coolify	63k	4 repos	~1.9k	Automated safety check: Pass	MIT	today
Cognitoitsmostafa/aws-agent-skills	1.2k	1 repos	~2.3k	Automated safety check: Pass	MIT	4 days ago
Stripe Best Practiceskanchengw/cnllm	175	2 repos	~925	Automated safety check: Pass	Apache-2.0	3 mo ago
Product Full-Text Searchlobehub/lobehub	83k	—	~4.1k	Automated safety check: Pass	Custom licence	today
Security Reviewdoorkeeper-gem/doorkeeper	5.5k	—	~1.4k	Automated safety check: Pass	MIT	2 days ago

Similar skills

Fortify Development
coollabsio/coolify
ACTIVATE when the user works on authentication in Laravel. An agent skill from coollabsio/coolify.
63k GitHub starsUsed in 4 repos~1.9k tokens
Backend & APIsAuto-check passed
Cognito
itsmostafa/aws-agent-skills
AWS Cognito user authentication and authorization service. An agent skill from itsmostafa/aws-agent-skills.
1.2k GitHub starsUsed in 1 repo~2.3k tokens
Backend & APIsAuto-check passed
Stripe Best Practices
kanchengw/cnllm
Guides Stripe integration decisions — API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, Treasury financial…
175 GitHub starsUsed in 2 repos~925 tokens
Backend & APIsAuto-check passed
Product Full-Text Search
lobehub/lobehub
Guides work on LobeHub's own product search: the shared search repository, provider choice, Elasticsearch mappings, change syncing and reindexing.
83k GitHub stars~4.1k tokensUpdated today
Backend & APIsAuto-check passed
Security Review
doorkeeper-gem/doorkeeper
Verify that code changes do not introduce OAuth security vulnerabilities.
5.5k GitHub stars~1.4k tokensUpdated 2 days ago
Backend & APIsAuto-check passed
OAuth Account Setup
spinabot/brigade
Connects an OAuth 2.0 account such as Gmail with the built-in oauth_authorize tool: an authorization link, automatic code capture and sealed token storage.
11k GitHub stars~878 tokensUpdated yesterday
Backend & APIsAuto-check passed

Questions about Elasticsearch Authn

What does Elasticsearch Authn do?

Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Elasticsearch Authn is an agent skill from aspectrr/deer. Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms.

When should I use Elasticsearch Authn?

Elasticsearch Authn fits situations like: connecting with credentials; choosing a realm; managing API keys.

How do I install Elasticsearch Authn in Claude Code?

Run `npx skills add aspectrr/deer --skill elasticsearch-authn -a claude-code`. Or copy the skill folder (deer-cli/internal/skill/defaults/elasticsearch-authn in aspectrr/deer) into .claude/skills/elasticsearch-authn in your project. Claude Code loads it when a task matches its description.

How do I install Elasticsearch Authn in Codex?

Run `npx skills add aspectrr/deer --skill elasticsearch-authn -a codex`. Or copy the skill folder (deer-cli/internal/skill/defaults/elasticsearch-authn in aspectrr/deer) into .agents/skills/elasticsearch-authn in your project. Codex loads it when a task matches its description.

Can I use Elasticsearch Authn in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aspectrr/deer --skill elasticsearch-authn -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/elasticsearch-authn, .gemini/skills/elasticsearch-authn, .github/skills/elasticsearch-authn and .opencode/skills/elasticsearch-authn in your project.

What does Elasticsearch Authn need to run?

Going by SKILL.md and its folder, Elasticsearch Authn needs the command-line tools its instructions call (curl) and credentials named ELASTICSEARCH_PASSWORD, FILE_PASSWORD, LDAP_PASSWORD and CLIENT_KEY. Our summary lists: A credential in CLIENT_KEY; A credential in JWT_TOKEN.

Does Elasticsearch Authn access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Elasticsearch Authn safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Elasticsearch Authn use?

Elasticsearch Authn is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Elasticsearch Authn use?

About 1.2k tokens (SKILL.md is roughly 4.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Elasticsearch Authn?

Skills that share tags, products or a category with Elasticsearch Authn: Fortify Development (coollabsio/coolify, 63k stars), Cognito (itsmostafa/aws-agent-skills, 1.2k stars), Stripe Best Practices (kanchengw/cnllm, 175 stars) and Product Full-Text Search (lobehub/lobehub, 83k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Elasticsearch Authn?

aspectrr (a GitHub user) maintains it in aspectrr/deer, which has 405 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on April 21, 2026.

Source: aspectrr/deer on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Elasticsearch Authn

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Elasticsearch Authentication

Critical principles

Authentication Realms

Internal realms

Native (username and password)

File

External realms

LDAP / Active Directory

PKI (TLS client certificates)

SAML / OIDC

JWT

Kerberos

API keys

Manage API Keys

Create an API key

Get and invalidate API keys

Deployment Compatibility

Guidelines

Files

Compare with similar skills

Similar skills

More from aspectrr/deer

Related

Questions about Elasticsearch Authn