# authentication failed through jwt **URL:** \ **Category:** Search Guard\ **Created:** [January 23, 2018, 8:01am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747 "2018-01-23T08:01:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Johnson\_C](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Johnson\_C](https://forum.search-guard.com/u/Johnson_C)\ **Post date:** [January 23, 2018, 8:01am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/1 "2018-01-23T08:01:38Z")
When asking questions, please provide the following information: - Search Guard and Elasticsearch version - Installed and used enterprise modules, if any - JVM version and operating system version - Search Guard configuration files - Elasticsearch log messages on debug level - Other installed Elasticsearch or Kibana plugins, if any Version Info: Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; JVM version: 1.8.0\_131, Win 10; Problem: With some help form this group, finally I enabled the jwt\_auth\_domain. But i still can’t login kibana through jwt, below is my configuration. [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/0/0b72e4699971ac0db073a5b36060e05715e98f23.png)](https://forum.search-guard.com/uploads/short-url/1Dhph1PXTkd1QuhQj8peH7WOEHF.png) **elasticsearch.yml:** ######## Start Search Guard Demo Configuration ######## > **···** > > * * * > > ######## End Search Guard Demo Configuration ######## > > searchguard.cache.ttl\_minutes: 0 > > **kibana.yml:** > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > searchguard.jwt.enabled: true > > searchguard.jwt.url\_param: jwtparam > > searchguard.jwt.header: jwtheader > > **sg\_config.yml:** > > jwt\_auth\_domain: > > ``` > enabled: true > > http_enabled: true > > transport_enabled: true > > order: 0 > > http_authenticator: > > type: jwt > > challenge: false > > config: > > signing_key: "key..." > > jwt_header: "jwtheader" > > jwt_url_parameter: "Authorization" > > roles_key: null > > subject_key: null > > authentication_backend: > > type: noop > > ``` > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/5/568079854323f19c170af89ac6974263434b7636.png)](https://forum.search-guard.com/uploads/short-url/clejJcM4cKiUwSa3hQqb63fkhRI.png) > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/d/df0c051bd14bfe8b941ba193c40ad3fc890a0dd4.png)](https://forum.search-guard.com/uploads/short-url/vPaeax1CoGi7NTa0MXRdjCgiCOM.png) > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/1/14ecc5daea12f1bd49dd94c5676fb79940f27443.png)](https://forum.search-guard.com/uploads/short-url/2Z6PDQyBYe1lZPRB2s5bQgIq9I7.png) > > Login failed for both ElasticSearch and Kibana, here is three method which I’ve tried. > > 1. [https://localhost:9200/?authorization=](https://localhost:9200/?authorization=) > > 2. [http://localhost:5601/?jwtparam=](http://localhost:5601/?jwtparam=) > > 3. [http://localhost:5601](http://localhost:5601) with header > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/6/663ef6504bee54c7ffc40132e00f71042d14b1ef.png)](https://forum.search-guard.com/uploads/short-url/eAvB3VQ1ljfAiPE4qV7j3zaTdZJ.png) ---
**Author:** ![Johnson\_C](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Johnson\_C](https://forum.search-guard.com/u/Johnson_C)\ **Post date:** [January 24, 2018, 2:17am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/2 "2018-01-24T02:17:52Z")
Login by Authorization header to ES, I got this error. [2018-01-24T10:15:12,353][WARN][c.f.s.h.HTTPBasicAuthenticator] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ [2018-01-24T10:15:12,353][WARN][c.f.s.a.BackendRegistry] Authentication finally failed for null > **···** > > On Tuesday, January 23, 2018 at 4:01:38 PM UTC+8, Johnson C wrote: > > > When asking questions, please provide the following information: > > > - Search Guard and Elasticsearch version > > > - Installed and used enterprise modules, if any > > > - JVM version and operating system version > > > - Search Guard configuration files > > > - Elasticsearch log messages on debug level > > > - Other installed Elasticsearch or Kibana plugins, if any > > > Version Info: > > > Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; > > > JVM version: 1.8.0\_131, Win 10; > > > > > > Problem: > > > > > > With some help form this group, finally I enabled the jwt\_auth\_domain. > > > But i still can’t login kibana through jwt, below is my configuration. > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/0/0b72e4699971ac0db073a5b36060e05715e98f23.png)](https://forum.search-guard.com/uploads/short-url/1Dhph1PXTkd1QuhQj8peH7WOEHF.png) > > > **elasticsearch.yml:** > > > ######## Start Search Guard Demo Configuration ######## > > > * * * > > > ######## End Search Guard Demo Configuration ######## > > > searchguard.cache.ttl\_minutes: 0 > > > > > > **kibana.yml:** > > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > > searchguard.jwt.enabled: true > > > searchguard.jwt.url\_param: jwtparam > > > searchguard.jwt.header: jwtheader > > > > > > > > > **sg\_config.yml:** > > > jwt\_auth\_domain: > > > ``` > > enabled: true > > > > ``` > > > ``` > > http_enabled: true > > > > ``` > > > ``` > > transport_enabled: true > > > > ``` > > > ``` > > order: 0 > > > > ``` > > > ``` > > http_authenticator: > > > > ``` > > > ``` > > type: jwt > > > > ``` > > > ``` > > challenge: false > > > > ``` > > > ``` > > config: > > > > ``` > > > ``` > > signing_key: "key..." > > > > ``` > > > ``` > > jwt_header: "jwtheader" > > > > ``` > > > ``` > > jwt_url_parameter: "Authorization" > > > > ``` > > > ``` > > roles_key: null > > > > ``` > > > ``` > > subject_key: null > > > > ``` > > > ``` > > authentication_backend: > > > > ``` > > > ``` > > type: noop > > > > ``` > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/5/568079854323f19c170af89ac6974263434b7636.png)](https://forum.search-guard.com/uploads/short-url/clejJcM4cKiUwSa3hQqb63fkhRI.png) > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/d/df0c051bd14bfe8b941ba193c40ad3fc890a0dd4.png)](https://forum.search-guard.com/uploads/short-url/vPaeax1CoGi7NTa0MXRdjCgiCOM.png) > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/1/14ecc5daea12f1bd49dd94c5676fb79940f27443.png)](https://forum.search-guard.com/uploads/short-url/2Z6PDQyBYe1lZPRB2s5bQgIq9I7.png) > > > > > > Login failed for both ElasticSearch and Kibana, here is three method which I’ve tried. > > > 1. [https://localhost:9200/?authorization=](https://localhost:9200/?authorization=) > > > 1. [http://localhost:5601/?jwtparam=](http://localhost:5601/?jwtparam=) > > > 1. [http://localhost:5601](http://localhost:5601) with header > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/6/663ef6504bee54c7ffc40132e00f71042d14b1ef.png)](https://forum.search-guard.com/uploads/short-url/eAvB3VQ1ljfAiPE4qV7j3zaTdZJ.png) > > > > > > > > > ---
**Author:** ![Johnson\_C](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Johnson\_C](https://forum.search-guard.com/u/Johnson_C)\ **Post date:** [January 24, 2018, 2:22am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/3 "2018-01-24T02:22:55Z")
After changing Bearer to Baisc, I got this error: Authentication finally failed for {“alg” I think this is the header of this jwt token, but why? ES don’t support jwt authorization? > **···** > > On Wednesday, January 24, 2018 at 10:17:52 AM UTC+8, Johnson C wrote: > > > Login by Authorization header to ES, I got this error. > > > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.h.HTTPBasicAuthenticator] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ > > > [2018-01-24T10:15:12,353][WARN][c.f.s.a.BackendRegistry] Authentication finally failed for null > > > > > > On Tuesday, January 23, 2018 at 4:01:38 PM UTC+8, Johnson C wrote: > > > > When asking questions, please provide the following information: > > > > - Search Guard and Elasticsearch version > > > > - Installed and used enterprise modules, if any > > > > - JVM version and operating system version > > > > - Search Guard configuration files > > > > - Elasticsearch log messages on debug level > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > Version Info: > > > > Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; > > > > JVM version: 1.8.0\_131, Win 10; > > > > > > > > Problem: > > > > > > > > With some help form this group, finally I enabled the jwt\_auth\_domain. > > > > But i still can’t login kibana through jwt, below is my configuration. > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/0/0b72e4699971ac0db073a5b36060e05715e98f23.png)](https://forum.search-guard.com/uploads/short-url/1Dhph1PXTkd1QuhQj8peH7WOEHF.png) > > > > **elasticsearch.yml:** > > > > ######## Start Search Guard Demo Configuration ######## > > > > * * * > > > > ######## End Search Guard Demo Configuration ######## > > > > searchguard.cache.ttl\_minutes: 0 > > > > > > > > **kibana.yml:** > > > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > > > searchguard.jwt.enabled: true > > > > searchguard.jwt.url\_param: jwtparam > > > > searchguard.jwt.header: jwtheader > > > > > > > > > > > > **sg\_config.yml:** > > > > jwt\_auth\_domain: > > > > ``` > > > enabled: true > > > > > > ``` > > > > ``` > > > http_enabled: true > > > > > > ``` > > > > ``` > > > transport_enabled: true > > > > > > ``` > > > > ``` > > > order: 0 > > > > > > ``` > > > > ``` > > > http_authenticator: > > > > > > ``` > > > > ``` > > > type: jwt > > > > > > ``` > > > > ``` > > > challenge: false > > > > > > ``` > > > > ``` > > > config: > > > > > > ``` > > > > ``` > > > signing_key: "key..." > > > > > > ``` > > > > ``` > > > jwt_header: "jwtheader" > > > > > > ``` > > > > ``` > > > jwt_url_parameter: "Authorization" > > > > > > ``` > > > > ``` > > > roles_key: null > > > > > > ``` > > > > ``` > > > subject_key: null > > > > > > ``` > > > > ``` > > > authentication_backend: > > > > > > ``` > > > > ``` > > > type: noop > > > > > > ``` > > > > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/5/568079854323f19c170af89ac6974263434b7636.png)](https://forum.search-guard.com/uploads/short-url/clejJcM4cKiUwSa3hQqb63fkhRI.png) > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/d/df0c051bd14bfe8b941ba193c40ad3fc890a0dd4.png)](https://forum.search-guard.com/uploads/short-url/vPaeax1CoGi7NTa0MXRdjCgiCOM.png) > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/1/14ecc5daea12f1bd49dd94c5676fb79940f27443.png)](https://forum.search-guard.com/uploads/short-url/2Z6PDQyBYe1lZPRB2s5bQgIq9I7.png) > > > > > > > > Login failed for both ElasticSearch and Kibana, here is three method which I’ve tried. > > > > 1. [https://localhost:9200/?authorization=](https://localhost:9200/?authorization=) > > > > 1. [http://localhost:5601/?jwtparam=](http://localhost:5601/?jwtparam=) > > > > 1. [http://localhost:5601](http://localhost:5601) with header > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/6/663ef6504bee54c7ffc40132e00f71042d14b1ef.png)](https://forum.search-guard.com/uploads/short-url/eAvB3VQ1ljfAiPE4qV7j3zaTdZJ.png) > > > > > > > > > > > > ---
**Author:** ![Johnson\_C](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Johnson\_C](https://forum.search-guard.com/u/Johnson_C)\ **Post date:** [January 24, 2018, 2:52am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/4 "2018-01-24T02:52:31Z")
After enable error log in ES, it turns out signature not right > **[TLS troubleshooting](https://docs.search-guard.com/latest/troubleshooting-tls)** > > Step-by-step instructions to troubleshoot Search Guard TLS and certificates issues Add the following lines in `config/log4j2.properties` and restart your node: ```auto logger.searchguard.name = com.floragunn logger.searchguard.level = debug ``` This will already print out a lot if helpful information in your log file. If this information is not sufficient, you can also set the log level to `trace`. > **···** > > On Wednesday, January 24, 2018 at 10:22:55 AM UTC+8, Johnson C wrote: > > > After changing Bearer to Baisc, I got this error: > > Authentication finally failed for {“alg” > > > I think this is the header of this jwt token, but why? > > > ES don’t support jwt authorization? > > > On Wednesday, January 24, 2018 at 10:17:52 AM UTC+8, Johnson C wrote: > > > > > Login by Authorization header to ES, I got this error. > > > > > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.h.HTTPBasicAuthenticator] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.a.BackendRegistry] Authentication finally failed for null > > > > > > > > On Tuesday, January 23, 2018 at 4:01:38 PM UTC+8, Johnson C wrote: > > > > > When asking questions, please provide the following information: > > > > > - Search Guard and Elasticsearch version > > > > > - Installed and used enterprise modules, if any > > > > > - JVM version and operating system version > > > > > - Search Guard configuration files > > > > > - Elasticsearch log messages on debug level > > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > > Version Info: > > > > > Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; > > > > > JVM version: 1.8.0\_131, Win 10; > > > > > > > > > > Problem: > > > > > > > > > > With some help form this group, finally I enabled the jwt\_auth\_domain. > > > > > But i still can’t login kibana through jwt, below is my configuration. > > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/0/0b72e4699971ac0db073a5b36060e05715e98f23.png)](https://forum.search-guard.com/uploads/short-url/1Dhph1PXTkd1QuhQj8peH7WOEHF.png) > > > > > **elasticsearch.yml:** > > > > > ######## Start Search Guard Demo Configuration ######## > > > > > * * * > > > > > ######## End Search Guard Demo Configuration ######## > > > > > searchguard.cache.ttl\_minutes: 0 > > > > > > > > > > **kibana.yml:** > > > > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > > > > searchguard.jwt.enabled: true > > > > > searchguard.jwt.url\_param: jwtparam > > > > > searchguard.jwt.header: jwtheader > > > > > > > > > > > > > > > **sg\_config.yml:** > > > > > jwt\_auth\_domain: > > > > > ``` > > > > enabled: true > > > > > > > > ``` > > > > > ``` > > > > http_enabled: true > > > > > > > > ``` > > > > > ``` > > > > transport_enabled: true > > > > > > > > ``` > > > > > ``` > > > > order: 0 > > > > > > > > ``` > > > > > ``` > > > > http_authenticator: > > > > > > > > ``` > > > > > ``` > > > > type: jwt > > > > > > > > ``` > > > > > ``` > > > > challenge: false > > > > > > > > ``` > > > > > ``` > > > > config: > > > > > > > > ``` > > > > > ``` > > > > signing_key: "key..." > > > > > > > > ``` > > > > > ``` > > > > jwt_header: "jwtheader" > > > > > > > > ``` > > > > > ``` > > > > jwt_url_parameter: "Authorization" > > > > > > > > ``` > > > > > ``` > > > > roles_key: null > > > > > > > > ``` > > > > > ``` > > > > subject_key: null > > > > > > > > ``` > > > > > ``` > > > > authentication_backend: > > > > > > > > ``` > > > > > ``` > > > > type: noop > > > > > > > > ``` > > > > > > > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/5/568079854323f19c170af89ac6974263434b7636.png)](https://forum.search-guard.com/uploads/short-url/clejJcM4cKiUwSa3hQqb63fkhRI.png) > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/d/df0c051bd14bfe8b941ba193c40ad3fc890a0dd4.png)](https://forum.search-guard.com/uploads/short-url/vPaeax1CoGi7NTa0MXRdjCgiCOM.png) > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/1/14ecc5daea12f1bd49dd94c5676fb79940f27443.png)](https://forum.search-guard.com/uploads/short-url/2Z6PDQyBYe1lZPRB2s5bQgIq9I7.png) > > > > > > > > > > Login failed for both ElasticSearch and Kibana, here is three method which I’ve tried. > > > > > 1. [https://localhost:9200/?authorization=](https://localhost:9200/?authorization=) > > > > > 1. [http://localhost:5601/?jwtparam=](http://localhost:5601/?jwtparam=) > > > > > 1. [http://localhost:5601](http://localhost:5601) with header > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/6/663ef6504bee54c7ffc40132e00f71042d14b1ef.png)](https://forum.search-guard.com/uploads/short-url/eAvB3VQ1ljfAiPE4qV7j3zaTdZJ.png) > > > > > > > > > > > > > > > ---
**Author:** ![Johnson\_C](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Johnson\_C](https://forum.search-guard.com/u/Johnson_C)\ **Post date:** [January 24, 2018, 6:23am UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/5 "2018-01-24T06:23:42Z")
Finnaly, I logined by jwt, if you want to use jwt in kibana, you need to disable basic\_auth: elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] searchguard.basicauth.enabled: false searchguard.jwt.enabled: true searchguard.jwt.url\_param: jwtparam searchguard.jwt.header: jwtheader But I got another odd problem: If i logined by admin: ```auto {"message":"no permissions for [indices:data/read/search] and User [name=admin, roles=[sg_all_access], requestedTenant=null]: [security_exception] no permissions for [indices:data/read/search] and User [name=admin, roles=[sg_all_access], requestedTenant=null]","statusCode":403,"error":"Forbidden"} ``` ```auto ``` ```auto If i logined by kibanaserver: ``` ```auto Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[sg_all_access], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[sg_all_access], requestedTenant=null]"},"status":403} at http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:650116 at Function.Promise.try (http://localhost:5601/bundles/commons.bundle.js?v=16350:56:19076) at http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18464 at Array.map () at Function.Promise.map (http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18422) at callResponseHandlers (http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:649694) at http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:639054 at processQueue (http://localhost:5601/bundles/commons.bundle.js?v=16350:35:132456) at http://localhost:5601/bundles/commons.bundle.js?v=16350:35:133349 at Scope.$digest (http://localhost:5601/bundles/commons.bundle.js?v=16350:35:144239) ``` ```auto ``` > **···** > > On Wednesday, January 24, 2018 at 10:52:32 AM UTC+8, Johnson C wrote: > > > After enable error log in ES, it turns out signature not right > > > > > > [http://docs.search-guard.com/latest/troubleshooting-tls](http://docs.search-guard.com/latest/troubleshooting-tls) > > > Add the following lines in `config/log4j2.properties` and restart your node: > > > ```auto > > [logger.searchguard.name](http://logger.searchguard.name) = com.floragunn > > logger.searchguard.level = debug > > > > ``` > > > > This will already print out a lot if helpful information in your log file. If this information is not sufficient, you can also set the log level to `trace`. > > > On Wednesday, January 24, 2018 at 10:22:55 AM UTC+8, Johnson C wrote: > > > > > After changing Bearer to Baisc, I got this error: > > > Authentication finally failed for {“alg” > > > > I think this is the header of this jwt token, but why? > > > > ES don’t support jwt authorization? > > > > On Wednesday, January 24, 2018 at 10:17:52 AM UTC+8, Johnson C wrote: > > > > > > > Login by Authorization header to ES, I got this error. > > > > > > > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.h.HTTPBasicAuthenticator] No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’ > > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.a.BackendRegistry] Authentication finally failed for null > > > > > > > > > > On Tuesday, January 23, 2018 at 4:01:38 PM UTC+8, Johnson C wrote: > > > > > > When asking questions, please provide the following information: > > > > > > - Search Guard and Elasticsearch version > > > > > > - Installed and used enterprise modules, if any > > > > > > - JVM version and operating system version > > > > > > - Search Guard configuration files > > > > > > - Elasticsearch log messages on debug level > > > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > > > Version Info: > > > > > > Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; > > > > > > JVM version: 1.8.0\_131, Win 10; > > > > > > > > > > > > Problem: > > > > > > > > > > > > With some help form this group, finally I enabled the jwt\_auth\_domain. > > > > > > But i still can’t login kibana through jwt, below is my configuration. > > > > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/0/0b72e4699971ac0db073a5b36060e05715e98f23.png)](https://forum.search-guard.com/uploads/short-url/1Dhph1PXTkd1QuhQj8peH7WOEHF.png) > > > > > > **elasticsearch.yml:** > > > > > > ######## Start Search Guard Demo Configuration ######## > > > > > > * * * > > > > > > ######## End Search Guard Demo Configuration ######## > > > > > > searchguard.cache.ttl\_minutes: 0 > > > > > > > > > > > > **kibana.yml:** > > > > > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > > > > > searchguard.jwt.enabled: true > > > > > > searchguard.jwt.url\_param: jwtparam > > > > > > searchguard.jwt.header: jwtheader > > > > > > > > > > > > > > > > > > **sg\_config.yml:** > > > > > > jwt\_auth\_domain: > > > > > > ``` > > > > > enabled: true > > > > > > > > > > ``` > > > > > > ``` > > > > > http_enabled: true > > > > > > > > > > ``` > > > > > > ``` > > > > > transport_enabled: true > > > > > > > > > > ``` > > > > > > ``` > > > > > order: 0 > > > > > > > > > > ``` > > > > > > ``` > > > > > http_authenticator: > > > > > > > > > > ``` > > > > > > ``` > > > > > type: jwt > > > > > > > > > > ``` > > > > > > ``` > > > > > challenge: false > > > > > > > > > > ``` > > > > > > ``` > > > > > config: > > > > > > > > > > ``` > > > > > > ``` > > > > > signing_key: "key..." > > > > > > > > > > ``` > > > > > > ``` > > > > > jwt_header: "jwtheader" > > > > > > > > > > ``` > > > > > > ``` > > > > > jwt_url_parameter: "Authorization" > > > > > > > > > > ``` > > > > > > ``` > > > > > roles_key: null > > > > > > > > > > ``` > > > > > > ``` > > > > > subject_key: null > > > > > > > > > > ``` > > > > > > ``` > > > > > authentication_backend: > > > > > > > > > > ``` > > > > > > ``` > > > > > type: noop > > > > > > > > > > ``` > > > > > > > > > > > > > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/5/568079854323f19c170af89ac6974263434b7636.png)](https://forum.search-guard.com/uploads/short-url/clejJcM4cKiUwSa3hQqb63fkhRI.png) > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/d/df0c051bd14bfe8b941ba193c40ad3fc890a0dd4.png)](https://forum.search-guard.com/uploads/short-url/vPaeax1CoGi7NTa0MXRdjCgiCOM.png) > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/1/14ecc5daea12f1bd49dd94c5676fb79940f27443.png)](https://forum.search-guard.com/uploads/short-url/2Z6PDQyBYe1lZPRB2s5bQgIq9I7.png) > > > > > > > > > > > > Login failed for both ElasticSearch and Kibana, here is three method which I’ve tried. > > > > > > 1. [https://localhost:9200/?authorization=](https://localhost:9200/?authorization=) > > > > > > 1. [http://localhost:5601/?jwtparam=](http://localhost:5601/?jwtparam=) > > > > > > 1. [http://localhost:5601](http://localhost:5601) with header > > > > > > [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/6/663ef6504bee54c7ffc40132e00f71042d14b1ef.png)](https://forum.search-guard.com/uploads/short-url/eAvB3VQ1ljfAiPE4qV7j3zaTdZJ.png) > > > > > > > > > > > > > > > > > > ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [February 1, 2018, 9:16pm UTC](https://forum.search-guard.com/t/authentication-failed-through-jwt/747/6 "2018-02-01T21:16:05Z")
i guess you got confused with backendroles and search guard roles. User [name=admin, roles=[sg\_all\_access] -\> sg\_all\_access is a backendrole here, not a search guard role. see [Mapping users to Search Guard roles | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/mapping-users-roles#map-users-backend-roles-and-hosts-to-search-guard-roles) and [Role mapping modes | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/role-mapping-modes#mode-backendroles_only) > **···** > > > Am 24.01.2018 um 07:23 schrieb Johnson C \: > > > > Finnaly, I logined by jwt, if you want to use jwt in kibana, you need to disable basic\_auth: > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > searchguard.basicauth.enabled: false > > searchguard.jwt.enabled: true > > searchguard.jwt.url\_param: jwtparam > > searchguard.jwt.header: jwtheader > > > > But I got another odd problem: > > > > If i logined by admin: > > {"message":"no permissions for [indices:data/read/search] and User [name=admin, roles=[sg\_all\_access], requestedTenant=null]: [security\_exception] no permissions for [indices:data/read/search] and User [name=admin, roles=[sg\_all\_access], requestedTenant=null]","statusCode":403,"error":"Forbidden"} > > > > If i logined by kibanaserver: > > Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"security\_exception","reason":"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[sg\_all\_access], requestedTenant=null]"}],"type":"security\_exception","reason":"no permissions for [indices:data/read/search] and User [name=kibanaserver, roles=[sg\_all\_access], requestedTenant=null]"},"status":403} > >     at > > [http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:650116](http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:650116) > > > >     at Function.Promise.try ( > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:56:19076](http://localhost:5601/bundles/commons.bundle.js?v=16350:56:19076) > > ) > >     at > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18464](http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18464) > > > >     at Array.map (\) > >     at Function.Promise.map ( > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18422](http://localhost:5601/bundles/commons.bundle.js?v=16350:56:18422) > > ) > >     at callResponseHandlers ( > > [http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:649694](http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:649694) > > ) > >     at > > [http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:639054](http://localhost:5601/bundles/kibana.bundle.js?v=16350:61:639054) > > > >     at processQueue ( > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:35:132456](http://localhost:5601/bundles/commons.bundle.js?v=16350:35:132456) > > ) > >     at > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:35:133349](http://localhost:5601/bundles/commons.bundle.js?v=16350:35:133349) > > > >     at Scope.$digest ( > > [http://localhost:5601/bundles/commons.bundle.js?v=16350:35:144239\](http://localhost:5601/bundles/commons.bundle.js?v=16350:35:144239%5C)) > > > > On Wednesday, January 24, 2018 at 10:52:32 AM UTC+8, Johnson C wrote: > > After enable error log in ES, it turns out signature not right > > > > [TLS help | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/troubleshooting-tls) > > Add the following lines in config/log4j2.properties and restart your node: > > > > logger.searchguard.name > > = com.floragunn > > logger.searchguard.level = debug > > > > This will already print out a lot if helpful information in your log file. If this information is not sufficient, you can also set the log level to trace. > > > > On Wednesday, January 24, 2018 at 10:22:55 AM UTC+8, Johnson C wrote: > > After changing Bearer to Baisc, I got this error: > > Authentication finally failed for {"alg" > > I think this is the header of this jwt token, but why? > > ES don't support jwt authorization? > > > > On Wednesday, January 24, 2018 at 10:17:52 AM UTC+8, Johnson C wrote: > > Login by Authorization header to ES, I got this error. > > > > [2018-01-24T10:15:12,353][WARN][c.f.s.h.HTTPBasicAuthenticator] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic' > > [2018-01-24T10:15:12,353][WARN][c.f.s.a.BackendRegistry] Authentication finally failed for null > > > > On Tuesday, January 23, 2018 at 4:01:38 PM UTC+8, Johnson C wrote: > > When asking questions, please provide the following information: > > > > \* Search Guard and Elasticsearch version > > \* Installed and used enterprise modules, if any > > \* JVM version and operating system version > > \* Search Guard configuration files > > \* Elasticsearch log messages on debug level > > \* Other installed Elasticsearch or Kibana plugins, if any > > > > Version Info: > > Elasticsearch version:6.1.1-20.1, Search Guard Version: 6.1.1; Kibana: 6.1.1; > > JVM version: 1.8.0\_131, Win 10; > > > > Problem: > > > > With some help form this group, finally I enabled the jwt\_auth\_domain. > > But i still can't login kibana through jwt, below is my configuration. > > > > elasticsearch.yml: > > ######## Start Search Guard Demo Configuration ######## > > \*\*\* > > ######## End Search Guard Demo Configuration ######## > > searchguard.cache.ttl\_minutes: 0 > > > > kibana.yml: > > elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] > > searchguard.jwt.enabled: true > > searchguard.jwt.url\_param: jwtparam > > searchguard.jwt.header: jwtheader > > > > sg\_config.yml: > > jwt\_auth\_domain: > >         enabled: true > >         http\_enabled: true > >         transport\_enabled: true > >         order: 0 > >         http\_authenticator: > >           type: jwt > >           challenge: false > >           config: > >             signing\_key: "key..." > >             jwt\_header: "jwtheader" > >             jwt\_url\_parameter: "Authorization" > >             roles\_key: null > >             subject\_key: null > >         authentication\_backend: > >           type: noop > > > > Login failed for both ElasticSearch and Kibana, here is three method which I've tried. > > > > 1. [https://localhost:9200/?authorization=<token>](https://localhost:9200/?authorization=<token>); > > > > 2. [http://localhost:5601/?jwtparam=<token>](http://localhost:5601/?jwtparam=<token>); > > > > 3. [http://localhost:5601](http://localhost:5601) with header > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/bd8f6913-00ea-4576-a2f9-89395d27853d%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/bd8f6913-00ea-4576-a2f9-89395d27853d%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).