# Creating generic user **URL:** \ **Category:** Search Guard\ **Created:** [May 16, 2016, 8:18pm UTC](https://forum.search-guard.com/t/creating-generic-user/168 "2016-05-16T20:18:08Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [May 16, 2016, 8:18pm UTC](https://forum.search-guard.com/t/creating-generic-user/168/1 "2016-05-16T20:18:08Z")
Hello, I’m trying to figure out how I can have a generic read only user pass through for kibana. I’ve added the following that I got from the latest commits for SG-2-2.3.2.0-beta2 sg\_roles.yml: sg\_users: indices: ‘\*’: ‘\*’: - READ sg\_roles\_mapping.yml sg\_public: users: - ‘\*’ I even tried ensuring the sg\_\* name was the same in both files, but I keep getting blocked when I try to log in to kibana with an undefined user. Along with trying to simply curl the ES cluster. Not sure if i’m doing this wrong, but i’m stuck and any help would be appreciated. ---
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [May 16, 2016, 10:08pm UTC](https://forum.search-guard.com/t/creating-generic-user/168/2 "2016-05-16T22:08:57Z")
Ahh nevermind. See I have to edit the sg\_config and enable the domain\_proxy section. Though, kibana keeps making me do basic auth after I’ve logged in using google sso. Even though I can just pass it a random user/pass combo. ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [May 17, 2016, 1:12pm UTC](https://forum.search-guard.com/t/creating-generic-user/168/3 "2016-05-17T13:12:40Z")
can you share you configs? > **···** > > > Am 17.05.2016 um 00:08 schrieb djtecha \: > > > > Ahh nevermind. See I have to edit the sg\_config and enable the domain\_proxy section. Though, kibana keeps making me do basic auth after I've logged in using google sso. Even though I can just pass it a random user/pass combo. > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [May 18, 2016, 4:40pm UTC](https://forum.search-guard.com/t/creating-generic-user/168/4 "2016-05-18T16:40:44Z")
**sg\_config:** searchguard: dynamic: http: xff: enabled: false internalProxies: 192.168.0.10|192.168.0.11 remoteIpHeader: “x-forwarded-for” proxiesHeader: “x-forwarded-by” trustedProxies: “proxy1|proxy2” authenticator: type: com.floragunn.searchguard.http.HTTPBasicAuthenticator authcz: authentication\_domain\_basic\_internal: enabled: true order: 0 authentication\_backend: type: com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend authorization\_backend: type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend #authentication\_ldap: #enabled: true #order: 1 #authentication\_backend: #type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthenticationBackend #config: #host: [“”,“”] #authorization\_backend: #type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend authentication\_domain\_proxy: enabled: true order: 1 authentication\_backend: type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend authorization\_backend: type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend **sg\_roles.yml** sg\_public: cluster: - CLUSTER\_ALL indices: ‘\*’: ‘\*’: - ALL **sg\_roles\_mapping.yml** sg\_public\*\*:\*\* users: - ‘\*’ That should let any user see all indices regardless of if they have a login. > **···** > > On Tuesday, May 17, 2016 at 6:12:39 AM UTC-7, SG wrote: > > > can you share you configs? > > > > > Am 17.05.2016 um 00:08 schrieb djtecha [djt...@gmail.com](mailto:djt...@gmail.com): > > > > > Ahh nevermind. See I have to edit the sg\_config and enable the domain\_proxy section. Though, kibana keeps making me do basic auth after I’ve logged in using google sso. Even though I can just pass it a random user/pass combo. > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [May 19, 2016, 3:33pm UTC](https://forum.search-guard.com/t/creating-generic-user/168/5 "2016-05-19T15:33:38Z")
i suggest searchguard:   dynamic:     http:       anonymous\_auth\_enabled: true       xff:         enabled: false         internalProxies: 192\.168\.0\.10|192\.168\.0\.11         remoteIpHeader: "x-forwarded-for"         proxiesHeader: "x-forwarded-by"         trustedProxies: "proxy1|proxy2"       authenticator:         type: basic     authcz:       authentication\_domain\_proxy:         enabled: true         order: 1         authentication\_backend:           type: intern         authorization\_backend:           type: noop > **···** > > > Am 18.05.2016 um 18:40 schrieb djtecha \: > > > > sg\_config: > > searchguard: > >   dynamic: > >     http: > >       xff: > >         enabled: false > >         internalProxies: 192\.168\.0\.10|192\.168\.0\.11 > >         remoteIpHeader: "x-forwarded-for" > >         proxiesHeader: "x-forwarded-by" > >         trustedProxies: "proxy1|proxy2" > >       authenticator: > >         type: com.floragunn.searchguard.http.HTTPBasicAuthenticator > >     authcz: > >       authentication\_domain\_basic\_internal: > >         enabled: true > >         order: 0 > >         authentication\_backend: > >           type: com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend > >         authorization\_backend: > >           type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend > >       #authentication\_ldap: > >         #enabled: true > >         #order: 1 > >         #authentication\_backend: > >           #type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthenticationBackend > >           #config: > >             #host: ["",""] > >         #authorization\_backend: > >           #type: com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend > >       authentication\_domain\_proxy: > >         enabled: true > >         order: 1 > >         authentication\_backend: > >           type: com.floragunn.searchguard.auth.internal.NoOpAuthenticationBackend > >         authorization\_backend: > >           type: com.floragunn.searchguard.auth.internal.NoOpAuthorizationBackend > > > > sg\_roles.yml > > sg\_public: > >   cluster: > >     - CLUSTER\_ALL > >   indices: > >     '\*': > >       '\*': > >         - ALL > > > > sg\_roles\_mapping.yml > > sg\_public: > >   users: > >     - '\*' > > > > That should let any user see all indices regardless of if they have a login. > > > > On Tuesday, May 17, 2016 at 6:12:39 AM UTC-7, SG wrote: > > can you share you configs? > > > > \> Am 17.05.2016 um 00:08 schrieb djtecha \: > > \> > > \> Ahh nevermind. See I have to edit the sg\_config and enable the domain\_proxy section. Though, kibana keeps making me do basic auth after I've logged in using google sso. Even though I can just pass it a random user/pass combo. > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/310ba11f-713b-4498-94e6-c0d3fbe39a2f%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/64ad6081-106e-44c8-b4fc-1969b3f4c61c%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/64ad6081-106e-44c8-b4fc-1969b3f4c61c%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).