# Basic realm="Authorization Required" after successful authentication

**URL:** <https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639>\
**Category:** Search Guard\
**Created:** [October 12, 2017, 12:56pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639 "2017-10-12T12:56:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pierre\_de\_Soyres](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@Pierre\_de\_Soyres](https://forum.search-guard.com/u/Pierre_de_Soyres)\
**Post date:** [October 12, 2017, 12:56pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639/1 "2017-10-12T12:56:07Z")

</div>

Hi,

I’m experiencing a strange behaviour when using Search guard on elasticsearch and kibana. I’m using

- Elasticsearch 5.5.0 with SearchGuard plugin 5.5.0-16

- Kibana 5.5.0 with SearchGuard plugin 5.5.0-4

To start exploring the searchguard capabilities, I followed the instructions and installed the provided demo (auto signed certificat and default users/password/roles) :

- run plugins/search-guard-5/tools/install\_demo\_configuration.sh

- start elasticsearch

- run sgadmin\_demo.sh

- run kibana

When I connect to elasticsearch, I am asked to enter user/password, and everything works as expected : receiving right errors when authenticated user hasn’t got rights for certain actions, etc…

When I connect to kibana, I am redirected to the SearchGuard login page. I enter the user/password (kibanaro/kibanaro or admin/admin), and for now all is ok.

But then comes my problem, I’m again asked to enter user/password with the browser built-in authentication popup. And there, I cannot authenticate with any password (admin/admin nor kibanaro/kibanaro nor kibanaserver/kibanaserver)

I used tcpdump and wireshark to see what’s going on, and I could see that :

from login page : a POST to [http://localhost:5601/api/v1/auth/login](http://localhost:5601/api/v1/auth/login) returns OK

Then a GET to [http://localhost:5601/](http://localhost:5601/) returns OK and kibana redirects to the default route

Finally the GET to [http://localhost:5601/app/kibana](http://localhost:5601/app/kibana) returns an HTTP 401 with header Basic realm=“Authorization Required”

Is there anything I missed ?

Here are the related informations :

→ sgconfig directory content which is exactlly what is procided by the plugin installation : attached file sgconfig.zip

→ result of a find\_all query on the search\_guard index : attached file searchguard.json

→ the elasticsearch conf :

> ######## Start Search Guard Demo Configuration ########

> searchguard.ssl.transport.keystore\_filepath: keystore.jks

> searchguard.ssl.transport.truststore\_filepath: truststore.jks

> searchguard.ssl.transport.enforce\_hostname\_verification: false

> searchguard.ssl.http.enabled: true

> searchguard.ssl.http.keystore\_filepath: keystore.jks

> searchguard.ssl.http.truststore\_filepath: truststore.jks

> searchguard.authcz.admin\_dn:

> - CN=kirk,OU=client,O=client,L=test, C=de

> 

> cluster.name: searchguard\_demo

> network.host: 0.0.0.0

> ######## End Search Guard Demo Configuration ########

→ the kibana conf :

> searchguard.multitenancy.enabled: true

> elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]

> elasticsearch.username: “kibanaserver”

> elasticsearch.password: “kibanaserver”

> elasticsearch.url: “[https://localhost:9200](https://localhost:9200)”

> elasticsearch.ssl.verificationMode: none

Any help would be appreciate.

_Pierre_

[sgconfig.zip](https://forum.search-guard.com/uploads/short-url/to4KQTLAdTpDJDC85DR1OYYjFmY.zip) (9.13 KB)

[searchguard.json](https://forum.search-guard.com/uploads/short-url/hTZKa6SPzKVlhld8LMBgVl2Q0Zn.json) (11.8 KB)

---

<div class="post-metadata">

**Author:** ![Pierre\_de\_Soyres](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@Pierre\_de\_Soyres](https://forum.search-guard.com/u/Pierre_de_Soyres)\
**Post date:** [October 12, 2017, 12:58pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639/2 "2017-10-12T12:58:47Z")

</div>

I attach also the tcpdump wireskark export.

[search\_guard\_tcpdump.pcap](https://forum.search-guard.com/uploads/short-url/icauTS3mhpKM9c8DBrdGMu8ITIy.pcap) (60.1 KB)

> **···**
>
> Le jeudi 12 octobre 2017 14:56:07 UTC+2, Pierre de Soyres a écrit :
> 
> > Hi,
> 
> > I’m experiencing a strange behaviour when using Search guard on elasticsearch and kibana. I’m using
> 
> > - Elasticsearch 5.5.0 with SearchGuard plugin 5.5.0-16
> 
> > - Kibana 5.5.0 with SearchGuard plugin 5.5.0-4
> 
> > 
> 
> > To start exploring the searchguard capabilities, I followed the instructions and installed the provided demo (auto signed certificat and default users/password/roles) :
> 
> > - run plugins/search-guard-5/tools/install\_demo\_configuration.sh
> 
> > - start elasticsearch
> 
> > - run sgadmin\_demo.sh
> 
> > - run kibana
> 
> > 
> 
> > When I connect to elasticsearch, I am asked to enter user/password, and everything works as expected : receiving right errors when authenticated user hasn’t got rights for certain actions, etc…
> 
> > When I connect to kibana, I am redirected to the SearchGuard login page. I enter the user/password (kibanaro/kibanaro or admin/admin), and for now all is ok.
> 
> > But then comes my problem, I’m again asked to enter user/password with the browser built-in authentication popup. And there, I cannot authenticate with any password (admin/admin nor kibanaro/kibanaro nor kibanaserver/kibanaserver)
> 
> > 
> 
> > I used tcpdump and wireshark to see what’s going on, and I could see that :
> 
> > from login page : a POST to [http://localhost:5601/api/v1/auth/login](http://localhost:5601/api/v1/auth/login) returns OK
> 
> > Then a GET to [http://localhost:5601/](http://localhost:5601/) returns OK and kibana redirects to the default route
> 
> > Finally the GET to [http://localhost:5601/app/kibana](http://localhost:5601/app/kibana) returns an HTTP 401 with header Basic realm=“Authorization Required”
> 
> > 
> 
> > Is there anything I missed ?
> 
> > 
> 
> > Here are the related informations :
> 
> > → sgconfig directory content which is exactlly what is procided by the plugin installation : attached file sgconfig.zip
> 
> > → result of a find\_all query on the search\_guard index : attached file searchguard.json
> 
> > 
> 
> > → the elasticsearch conf :
> 
> > > ######## Start Search Guard Demo Configuration ########
> 
> > > searchguard.ssl.transport.keystore\_filepath: keystore.jks
> 
> > > searchguard.ssl.transport.truststore\_filepath: truststore.jks
> 
> > > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > > searchguard.ssl.http.enabled: true
> 
> > > searchguard.ssl.http.keystore\_filepath: keystore.jks
> 
> > > searchguard.ssl.http.truststore\_filepath: truststore.jks
> 
> > > searchguard.authcz.admin\_dn:
> 
> > > - CN=kirk,OU=client,O=client,L=test, C=de
> 
> > >
> 
> > > [cluster.name](http://cluster.name): searchguard\_demo
> 
> > > network.host: 0.0.0.0
> 
> > > ######## End Search Guard Demo Configuration ########
> 
> > 
> 
> > 
> 
> > → the kibana conf :
> 
> > > searchguard.multitenancy.enabled: true
> 
> > > elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]
> 
> > > elasticsearch.username: “kibanaserver”
> 
> > > elasticsearch.password: “kibanaserver”
> 
> > > elasticsearch.url: “[https://localhost:9200](https://localhost:9200)”
> 
> > > elasticsearch.ssl.verificationMode: none
> 
> > 
> 
> > 
> 
> > Any help would be appreciate.
> 
> > 
> 
> > _Pierre_

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [October 13, 2017, 1:43pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639/3 "2017-10-13T13:43:05Z")

</div>

The problem here is this line kibana.yml:

elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]

The whitelist if Kibana contains the “Authorization” header by default. However, if one manually changes the white list, “Authorization” is not added by default again, so you need to manually add it like:

elasticsearch.requestHeadersWhitelist: [“Authorization”, “sg\_tenant”]

then it should work. Sorry if the docs are not clear enough here, we’ll fix this.

> **···**
>
> On Thursday, October 12, 2017 at 2:58:47 PM UTC+2, Pierre de Soyres wrote:
> 
> > I attach also the tcpdump wireskark export.
> > 
> > Le jeudi 12 octobre 2017 14:56:07 UTC+2, Pierre de Soyres a écrit :
> > 
> > > Hi,
> 
> > > I’m experiencing a strange behaviour when using Search guard on elasticsearch and kibana. I’m using
> 
> > > - Elasticsearch 5.5.0 with SearchGuard plugin 5.5.0-16
> 
> > > - Kibana 5.5.0 with SearchGuard plugin 5.5.0-4
> 
> > >
> 
> > > To start exploring the searchguard capabilities, I followed the instructions and installed the provided demo (auto signed certificat and default users/password/roles) :
> 
> > > - run plugins/search-guard-5/tools/install\_demo\_configuration.sh
> 
> > > - start elasticsearch
> 
> > > - run sgadmin\_demo.sh
> 
> > > - run kibana
> 
> > >
> 
> > > When I connect to elasticsearch, I am asked to enter user/password, and everything works as expected : receiving right errors when authenticated user hasn’t got rights for certain actions, etc…
> 
> > > When I connect to kibana, I am redirected to the SearchGuard login page. I enter the user/password (kibanaro/kibanaro or admin/admin), and for now all is ok.
> 
> > > But then comes my problem, I’m again asked to enter user/password with the browser built-in authentication popup. And there, I cannot authenticate with any password (admin/admin nor kibanaro/kibanaro nor kibanaserver/kibanaserver)
> 
> > >
> 
> > > I used tcpdump and wireshark to see what’s going on, and I could see that :
> 
> > > from login page : a POST to [http://localhost:5601/api/v1/auth/login](http://localhost:5601/api/v1/auth/login) returns OK
> 
> > > Then a GET to [http://localhost:5601/](http://localhost:5601/) returns OK and kibana redirects to the default route
> 
> > > Finally the GET to [http://localhost:5601/app/kibana](http://localhost:5601/app/kibana) returns an HTTP 401 with header Basic realm=“Authorization Required”
> 
> > >
> 
> > > Is there anything I missed ?
> 
> > >
> 
> > > Here are the related informations :
> 
> > > → sgconfig directory content which is exactlly what is procided by the plugin installation : attached file sgconfig.zip
> 
> > > → result of a find\_all query on the search\_guard index : attached file searchguard.json
> 
> > >
> 
> > > → the elasticsearch conf :
> 
> > > > ######## Start Search Guard Demo Configuration ########
> 
> > > > searchguard.ssl.transport.keystore\_filepath: keystore.jks
> 
> > > > searchguard.ssl.transport.truststore\_filepath: truststore.jks
> 
> > > > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > > > searchguard.ssl.http.enabled: true
> 
> > > > searchguard.ssl.http.keystore\_filepath: keystore.jks
> 
> > > > searchguard.ssl.http.truststore\_filepath: truststore.jks
> 
> > > > searchguard.authcz.admin\_dn:
> 
> > > > - CN=kirk,OU=client,O=client,L=test, C=de
> 
> > > >
> 
> > > > [cluster.name](http://cluster.name): searchguard\_demo
> 
> > > > network.host: 0.0.0.0
> 
> > > > ######## End Search Guard Demo Configuration ########
> 
> > >
> 
> > >
> 
> > > → the kibana conf :
> 
> > > > searchguard.multitenancy.enabled: true
> 
> > > > elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]
> 
> > > > elasticsearch.username: “kibanaserver”
> 
> > > > elasticsearch.password: “kibanaserver”
> 
> > > > elasticsearch.url: “[https://localhost:9200](https://localhost:9200)”
> 
> > > > elasticsearch.ssl.verificationMode: none
> 
> > >
> 
> > >
> 
> > > Any help would be appreciate.
> 
> > >
> 
> > > _Pierre_

---

<div class="post-metadata">

**Author:** ![Pierre\_de\_Soyres](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@Pierre\_de\_Soyres](https://forum.search-guard.com/u/Pierre_de_Soyres)\
**Post date:** [October 13, 2017, 3:06pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639/4 "2017-10-13T15:06:25Z")

</div>

I confirm that it works when adding “Authorization” to the requestHeadersWhitelist.

Thank you for helping.

_Pierre_

> **···**
>
> 2017-10-13 15:43 GMT+02:00 Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com):
> 
> > The problem here is this line kibana.yml:
> 
> > elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]
> 
> > 
> 
> > The whitelist if Kibana contains the “Authorization” header by default. However, if one manually changes the white list, “Authorization” is not added by default again, so you need to manually add it like:
> 
> > 
> 
> > elasticsearch.requestHeadersWhitelist: [“Authorization”, “sg\_tenant”]
> 
> > 
> 
> > then it should work. Sorry if the docs are not clear enough here, we’ll fix this.
> 
> > On Thursday, October 12, 2017 at 2:58:47 PM UTC+2, Pierre de Soyres wrote:
> > 
> > > I attach also the tcpdump wireskark export.
> > > 
> > > Le jeudi 12 octobre 2017 14:56:07 UTC+2, Pierre de Soyres a écrit :
> > > 
> > > > Hi,
> 
> > > > I’m experiencing a strange behaviour when using Search guard on elasticsearch and kibana. I’m using
> 
> > > > - Elasticsearch 5.5.0 with SearchGuard plugin 5.5.0-16
> 
> > > > - Kibana 5.5.0 with SearchGuard plugin 5.5.0-4
> 
> > > >
> 
> > > > To start exploring the searchguard capabilities, I followed the instructions and installed the provided demo (auto signed certificat and default users/password/roles) :
> 
> > > > - run plugins/search-guard-5/tools/install\_demo\_configuration.sh
> 
> > > > - start elasticsearch
> 
> > > > - run sgadmin\_demo.sh
> 
> > > > - run kibana
> 
> > > >
> 
> > > > When I connect to elasticsearch, I am asked to enter user/password, and everything works as expected : receiving right errors when authenticated user hasn’t got rights for certain actions, etc…
> 
> > > > When I connect to kibana, I am redirected to the SearchGuard login page. I enter the user/password (kibanaro/kibanaro or admin/admin), and for now all is ok.
> 
> > > > But then comes my problem, I’m again asked to enter user/password with the browser built-in authentication popup. And there, I cannot authenticate with any password (admin/admin nor kibanaro/kibanaro nor kibanaserver/kibanaserver)
> 
> > > >
> 
> > > > I used tcpdump and wireshark to see what’s going on, and I could see that :
> 
> > > > from login page : a POST to [http://localhost:5601/api/v1/auth/login](http://localhost:5601/api/v1/auth/login) returns OK
> 
> > > > Then a GET to [http://localhost:5601/](http://localhost:5601/) returns OK and kibana redirects to the default route
> 
> > > > Finally the GET to [http://localhost:5601/app/kibana](http://localhost:5601/app/kibana) returns an HTTP 401 with header Basic realm=“Authorization Required”
> 
> > > >
> 
> > > > Is there anything I missed ?
> 
> > > >
> 
> > > > Here are the related informations :
> 
> > > > → sgconfig directory content which is exactlly what is procided by the plugin installation : attached file sgconfig.zip
> 
> > > > → result of a find\_all query on the search\_guard index : attached file searchguard.json
> 
> > > >
> 
> > > > → the elasticsearch conf :
> 
> > > > > ######## Start Search Guard Demo Configuration ########
> 
> > > > > searchguard.ssl.transport.keystore\_filepath: keystore.jks
> 
> > > > > searchguard.ssl.transport.truststore\_filepath: truststore.jks
> 
> > > > > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > > > > searchguard.ssl.http.enabled: true
> 
> > > > > searchguard.ssl.http.keystore\_filepath: keystore.jks
> 
> > > > > searchguard.ssl.http.truststore\_filepath: truststore.jks
> 
> > > > > searchguard.authcz.admin\_dn:
> 
> > > > > - CN=kirk,OU=client,O=client,L=test, C=de
> 
> > > > >
> 
> > > > > [cluster.name](http://cluster.name): searchguard\_demo
> 
> > > > > network.host: 0.0.0.0
> 
> > > > > ######## End Search Guard Demo Configuration ########
> 
> > > >
> 
> > > >
> 
> > > > → the kibana conf :
> 
> > > > > searchguard.multitenancy.enabled: true
> 
> > > > > elasticsearch.requestHeadersWhitelist: [“sg\_tenant”]
> 
> > > > > elasticsearch.username: “kibanaserver”
> 
> > > > > elasticsearch.password: “kibanaserver”
> 
> > > > > elasticsearch.url: “[https://localhost:9200](https://localhost:9200)”
> 
> > > > > elasticsearch.ssl.verificationMode: none
> 
> > > >
> 
> > > >
> 
> > > > Any help would be appreciate.
> 
> > > >
> 
> > > > _Pierre_
> 
> > –
> > 
> > You received this message because you are subscribed to a topic in the Google Groups “Search Guard Community Forum” group.
> > 
> > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/search-guard/19HekgPSVsE/unsubscribe](https://groups.google.com/d/topic/search-guard/19HekgPSVsE/unsubscribe).
> > 
> > To unsubscribe from this group and all its topics, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com).
> > 
> > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com).
> 
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/8ff9dd2e-7f53-480b-a075-218696a1e8c0%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/8ff9dd2e-7f53-480b-a075-218696a1e8c0%40googlegroups.com?utm_medium=email&utm_source=footer).
> > 
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\
**Post date:** [November 2, 2018, 1:38pm UTC](https://forum.search-guard.com/t/basic-realm-authorization-required-after-successful-authentication/639/5 "2018-11-02T13:38:45Z")

</div>

hey,

I am facing same issues n i dont know what to do.

as you have mentioned i updated elasticsearch.requestHeadersWhitelist: [“Authorization”, “sg\_tenant”] in kibana.yml

still on every login i am redirected to the same kibana dashboard.

and when i curl the same it says 401 Authorization Required.

can you please help me with this.