# Can Kibana read the authoriztion header through Nginx? **URL:** \ **Category:** Search Guard\ **Created:** [March 1, 2019, 12:25pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345 "2019-03-01T12:25:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Worapoj\_Chokeanankun](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/worapoj_chokeanankun/32/485_2.png) [@Worapoj\_Chokeanankun](https://forum.search-guard.com/u/Worapoj_Chokeanankun)\ **Post date:** [March 1, 2019, 12:25pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/1 "2019-03-01T12:25:30Z")
Hi, I’m testing Nginx, Kibana and Elasticsearch. Elasticsearch and Kibana install Search-Guard plugin. I already configure the new user to login the Kibana through Kibana GUI. The user can log-in. I’m using Nginx to check the authentication of my company authentication application. If the user login successfully, I will add the authorization header to the HTTP header and re-direct to Kibana. Kibana will not prompt to the login page again with the authorization header set. That is what I think. I tried to curl Kibana URL, it returns the HTML page with Search Guard login. curl -u : http://[10.0.0.1:5601/kibana](http://10.0.0.1:5601/kibana) `` What am I missing here? It seems Kibana with Search Guard does not look at the Authorization header. I found this document, [Kibana Basic Auth | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/kibana-authentication-http-basic#session-management). Is there a way to set the active session by API or script to pass through the login page? When asking questions, please provide the following information: - Search Guard and Elasticsearch version 6.6.1 and 6.6.1 - Installed and used enterprise modules, if any No - JVM version and operating system version 1.8 - Search Guard configuration files Demo certificate - Elasticsearch log messages on debug level n/a - Other installed Elasticsearch or Kibana plugins, if any n/a ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 4, 2019, 11:46pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/2 "2019-03-04T23:46:47Z")
Please attach your sg\_config.yml, kibana.yml and elasticsearch.yml (as files) > **···** > > > Am 01.03.2019 um 01:58 schrieb Worapoj Chokeanankun \: > > > > Hi, > > > > I'm testing Nginx, Kibana and Elasticsearch. Elasticsearch and Kibana install Search-Guard plugin. > > I already configure the new user to login the Kibana through Kibana GUI. The user can log-in. > > > > I'm using Nginx to check the authentication of my company authentication application. > > If the user login successfully, I will add the authorization header to the HTTP header and re-direct to Kibana. > > > > I tried to curl Kibana URL, it returns the HTML page with Search Guard login. > > curl -u \:\ [http://10.0.0.1:5601/kibana](http://10.0.0.1:5601/kibana) > > > > What am I missing here? It seems Kibana with Search Guard does not look at the Authorization header. > > > > When asking questions, please provide the following information: > > > > \* Search Guard and Elasticsearch version > > 6.6.1 and 6.6.1 > > \* Installed and used enterprise modules, if any > > No > > \* JVM version and operating system version > > 1.8 > > \* Search Guard configuration files > > Demo certificate > > \* Elasticsearch log messages on debug level > > n/a > > \* Other installed Elasticsearch or Kibana plugins, if any > > n/a > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Worapoj\_Chokeanankun](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/worapoj_chokeanankun/32/485_2.png) [@Worapoj\_Chokeanankun](https://forum.search-guard.com/u/Worapoj_Chokeanankun)\ **Post date:** [March 5, 2019, 4:30am UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/3 "2019-03-05T04:30:47Z")
I have attached the configuration files. My test user id is 8015996. [kibana.yml](https://forum.search-guard.com/uploads/short-url/zky1tR42rUJO7mO1dVwH4cXi4iO.yml) (5.09 KB) [sg\_roles.yml](https://forum.search-guard.com/uploads/short-url/hJXzqDN3JJd89LCWcFpfwqSToXc.yml) (6.88 KB) [elasticsearch.yml](https://forum.search-guard.com/uploads/short-url/dLk1vZJm9DUYYf6pBrkUhuoulGu.yml) (3.97 KB) [sg\_action\_groups.yml](https://forum.search-guard.com/uploads/short-url/6xqsSpzIXYQXWdM0wKfNdmoumcr.yml) (2.27 KB) [sg\_config.yml](https://forum.search-guard.com/uploads/short-url/28LXDrLKb5qXSS2XPJhFivwVlgH.yml) (9.4 KB) [sg\_internal\_users.yml](https://forum.search-guard.com/uploads/short-url/6yQtEQUj5cOBy8Vv2uRYqaK1sxF.yml) (1.05 KB) [sg\_roles\_mapping.yml](https://forum.search-guard.com/uploads/short-url/z7T84Z8ivptGZJjd79NltKtEBsI.yml) (548 Bytes) > **···** > > On Tuesday, 5 March 2019 06:46:52 UTC+7, Search Guard wrote: > > > Please attach your sg\_config.yml, kibana.yml and elasticsearch.yml (as files) > > > > > Am 01.03.2019 um 01:58 schrieb Worapoj Chokeanankun [wora...@gmail.com](mailto:wora...@gmail.com): > > > > > Hi, > > > > > I’m testing Nginx, Kibana and Elasticsearch. Elasticsearch and Kibana install Search-Guard plugin. > > > > > I already configure the new user to login the Kibana through Kibana GUI. The user can log-in. > > > > > I’m using Nginx to check the authentication of my company authentication application. > > > > > If the user login successfully, I will add the authorization header to the HTTP header and re-direct to Kibana. > > > > > I tried to curl Kibana URL, it returns the HTML page with Search Guard login. > > > > > curl -u : [http://10.0.0.1:5601/kibana](http://10.0.0.1:5601/kibana) > > > > > What am I missing here? It seems Kibana with Search Guard does not look at the Authorization header. > > > > > When asking questions, please provide the following information: > > > > > - Search Guard and Elasticsearch version > > > > > 6.6.1 and 6.6.1 > > > > > - Installed and used enterprise modules, if any > > > > > No > > > > > - JVM version and operating system version > > > > > 1.8 > > > > > - Search Guard configuration files > > > > > Demo certificate > > > > > - Elasticsearch log messages on debug level > > > > > n/a > > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > > n/a > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 5, 2019, 8:41pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/4 "2019-03-05T20:41:36Z")
You need to configure proxy based authentication like described here > **[Quick Start](https://docs.search-guard.com/latest/proxy-authentication)** > > Use Search Guard's Proxy authentication feature to connect Elasticsearch to any third-party identity provider. > **···** > > > Am 04.03.2019 um 20:30 schrieb Worapoj Chokeanankun \: > > > > I have attached the configuration files. My test user id is 8015996. > > > > On Tuesday, 5 March 2019 06:46:52 UTC+7, Search Guard wrote: > > Please attach your sg\_config.yml, kibana.yml and elasticsearch.yml (as files) > > > > \> Am 01.03.2019 um 01:58 schrieb Worapoj Chokeanankun \: > > \> > > \> Hi, > > \> > > \> I'm testing Nginx, Kibana and Elasticsearch. Elasticsearch and Kibana install Search-Guard plugin. > > \> I already configure the new user to login the Kibana through Kibana GUI. The user can log-in. > > \> > > \> I'm using Nginx to check the authentication of my company authentication application. > > \> If the user login successfully, I will add the authorization header to the HTTP header and re-direct to Kibana. > > \> > > \> I tried to curl Kibana URL, it returns the HTML page with Search Guard login. > > \> curl -u \:\ [http://10.0.0.1:5601/kibana](http://10.0.0.1:5601/kibana) > > \> > > \> What am I missing here? It seems Kibana with Search Guard does not look at the Authorization header. > > \> > > \> When asking questions, please provide the following information: > > \> > > \> \* Search Guard and Elasticsearch version > > \> 6.6.1 and 6.6.1 > > \> \* Installed and used enterprise modules, if any > > \> No > > \> \* JVM version and operating system version > > \> 1.8 > > \> \* Search Guard configuration files > > \> Demo certificate > > \> \* Elasticsearch log messages on debug level > > \> n/a > > \> \* Other installed Elasticsearch or Kibana plugins, if any > > \> n/a > > \> > > \> > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/b115e7a5-e218-4e4b-9deb-206764e0e99f%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/b115e7a5-e218-4e4b-9deb-206764e0e99f%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \\\\\\\ ---
**Author:** ![Worapoj\_Chokeanankun](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/worapoj_chokeanankun/32/485_2.png) [@Worapoj\_Chokeanankun](https://forum.search-guard.com/u/Worapoj_Chokeanankun)\ **Post date:** [March 12, 2019, 12:35pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/5 "2019-03-12T12:35:49Z")
It works! Thanks > **···** > > On Wednesday, 6 March 2019 03:41:40 UTC+7, Search Guard wrote: > > > You need to configure proxy based authentication like described here > > > > [https://docs.search-guard.com/latest/proxy-authentication](https://docs.search-guard.com/latest/proxy-authentication) > > > > > Am 04.03.2019 um 20:30 schrieb Worapoj Chokeanankun [wora...@gmail.com](mailto:wora...@gmail.com): > > > > > I have attached the configuration files. My test user id is 8015996. > > > > > On Tuesday, 5 March 2019 06:46:52 UTC+7, Search Guard wrote: > > > > > Please attach your sg\_config.yml, kibana.yml and elasticsearch.yml (as files) > > > > > > > Am 01.03.2019 um 01:58 schrieb Worapoj Chokeanankun [wora...@gmail.com](mailto:wora...@gmail.com): > > > > > > > > Hi, > > > > > > > > I’m testing Nginx, Kibana and Elasticsearch. Elasticsearch and Kibana install Search-Guard plugin. > > > > I already configure the new user to login the Kibana through Kibana GUI. The user can log-in. > > > > > > > > I’m using Nginx to check the authentication of my company authentication application. > > > > If the user login successfully, I will add the authorization header to the HTTP header and re-direct to Kibana. > > > > > > > > I tried to curl Kibana URL, it returns the HTML page with Search Guard login. > > > > curl -u : [http://10.0.0.1:5601/kibana](http://10.0.0.1:5601/kibana) > > > > > > What am I missing here? It seems Kibana with Search Guard does not look at the Authorization header. > > > > > > > > When asking questions, please provide the following information: > > > > > > > > - Search Guard and Elasticsearch version > > > > 6.6.1 and 6.6.1 > > > > - Installed and used enterprise modules, if any > > > > No > > > > - JVM version and operating system version > > > > 1.8 > > > > - Search Guard configuration files > > > > Demo certificate > > > > - Elasticsearch log messages on debug level > > > > n/a > > > > - Other installed Elasticsearch or Kibana plugins, if any > > > > n/a > > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/44abedcc-6254-4857-a359-0faa36c3a8b5%40googlegroups.com). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/b115e7a5-e218-4e4b-9deb-206764e0e99f%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/b115e7a5-e218-4e4b-9deb-206764e0e99f%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > > \\\\\\\ ---
**Author:** ![boringtechnology1](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/boringtechnology1/32/1427_2.png) [@boringtechnology1](https://forum.search-guard.com/u/boringtechnology1)\ **Post date:** [November 9, 2022, 3:18pm UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/6 "2022-11-09T15:18:17Z")
For anyone that could not get Kibana working with this way, I have [written a post](https://boringtechnology1.github.io/jekyll/update/2022/11/05/secured-kibana-dashboard-with-angular-and-spring-boot.html) about Spring Boot, Angular and nginx example with authentication with cookie that you get on backend. I think it is more flexible and secure way in some situations. ---
**Author:** ![marc](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@marc](https://forum.search-guard.com/u/marc)\ **Post date:** [November 11, 2022, 12:08am UTC](https://forum.search-guard.com/t/can-kibana-read-the-authoriztion-header-through-nginx/1345/7 "2022-11-11T00:08:40Z")
> When it comes to easy and affordable security for Elasticsearch, you might be tempted to rely on a “roll-your-own” security infrastructure based on proxies. This article shows why this is a bad idea, and why you should not use this approach for securing your sensitive data in production. > **[404 - Page not found](https://search-guard.com/elasticsearch-proxy-security/)** > > The page you tried to access could not be found.