# \[ELK 6.5.3 - SG 23.2\] Issue when log in Kibana

**URL:** <https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250>\
**Category:** Search Guard\
**Created:** [December 15, 2018, 9:19am UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250 "2018-12-15T09:19:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![plaz300664](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@plaz300664](https://forum.search-guard.com/u/plaz300664)\
**Post date:** [December 15, 2018, 9:19am UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250/1 "2018-12-15T09:19:30Z")

</div>

Hi,

I have a new issue when i try to log in Kibana. It seems to be an basic auth. request.

Could you help me please ?

Thank you.

==[Configuration:]==

ELK\_VERSION=6.5.3 (Basic Licence)

SG\_VERSION=23.2

SG\_VERSION\_KIBANA=16

No Enterprise Module installed ths is the CE edition

Operting system : CENTOS 7x64 - SELinux=Permissive

OS[Linux/3.10.0-862.14.4.el7.x86\_64/amd64],

JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13]

==[Issue]==

Step 1) Screencopy 001:

From Search-Guard login screen, I fill-in my account: “admin”, password: “admin”

A new form appears to fill-in again my login and password, and i fill-in again with “admin/admin”

Then I log out.

Step 2) Screencopy 002

When disconnected, from Search-Guard login screen, I fill-in with another account: “readall”, and password: “readall”

Step 3) Screencopy 003

Then after the step 2) above, I am logged in Kibana, but with the user filled-in step 1) which is “admin” and not the one filled-in step 2) which is “readall”.

Do you have any idea to where can be the issue ?

Thank you for your support.

[sg\_action\_groups.yml](https://forum.search-guard.com/uploads/short-url/b0ox1HTe4soefFukYfgqNfOd8zw.yml) (2.31 KB)

[sg\_config.yml](https://forum.search-guard.com/uploads/short-url/28LXDrLKb5qXSS2XPJhFivwVlgH.yml) (9.4 KB)

[sg\_internal\_users.yml](https://forum.search-guard.com/uploads/short-url/6yQtEQUj5cOBy8Vv2uRYqaK1sxF.yml) (1.05 KB)

[sg\_roles.yml](https://forum.search-guard.com/uploads/short-url/9TJu1nbuq220i4nmkyu7fz3tzfU.yml) (6.9 KB)

[sg\_roles\_mapping.yml](https://forum.search-guard.com/uploads/short-url/z7T84Z8ivptGZJjd79NltKtEBsI.yml) (548 Bytes)

 ![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/378871a9f5f088abd6d44e049c1a6a2d9dd32cdf.png)

![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/8ed675dd187da75019eb6d9c90fccf58b2300301.png)

 ![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/f0acd465fbd2c1ed2e93fdb95860810ad01dfe75.png)

[ELASTIC\_Dockerfile](https://forum.search-guard.com/uploads/short-url/uhD2e87qE08kNURKXfnsAHKLuwi) (550 Bytes)

[KIBANA\_Dockerfile](https://forum.search-guard.com/uploads/short-url/ve7CPzf7xiBTH6DuaORSV4ZQ4gN) (460 Bytes)

[LOGSTASH\_Dockerfile](https://forum.search-guard.com/uploads/short-url/vtcQ08HvxNarnwcMP7Koby088ry) (218 Bytes)

[elasticsearch.yml](https://forum.search-guard.com/uploads/short-url/4wlUmvKuDgiRN7i0YqmKoy7fcif.yml) (1.01 KB)

[kibana.yml](https://forum.search-guard.com/uploads/short-url/hoJ4zod3g9YI1jAJa8KsRhQyvbU.yml) (545 Bytes)

[logstash.yml](https://forum.search-guard.com/uploads/short-url/qw6JhgM7ix7cNDs1bAFqPtyppcb.yml) (36 Bytes)

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [December 15, 2018, 2:26pm UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250/2 "2018-12-15T14:26:02Z")

</div>

Did you disable spaces? If not you have to (at the moment).

> **[Search Guard Documentation 404](https://docs.search-guard.com/latest/404.html)**
>
> Seems like the page you are looking for does not exist. We deeply and humbly apologize.

> **[Installing the Plugin](https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin)**
>
> How to install the Search Guard Kibana plugin which adds authentication, multi-tenancy and the configuration UI.

Next Kibana Plugin release will indeed support spaces, its expected to be released next week.

> **···**
>
> > Am 15.12.2018 um 09:31 schrieb plaz300664@gmail.com:
> > 
> > ==[Configuration:]==  
> > ELK\_VERSION=6.5.3 (Basic Licence)  
> > SG\_VERSION=23.2  
> > SG\_VERSION\_KIBANA=16
> > 
> > No Enterprise Module installed ths is the CE edition  
> > Operting system : CENTOS 7x64 - SELinux=Permissive
> > 
> > OS[Linux/3.10.0-862.14.4.el7.x86\_64/amd64],  
> > JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13]
> > 
> > ==[Issue]==
> > 
> > Step 1) Screencopy 001:  
> > From Search-Guard login screen, I fill-in my account: "admin", password: "admin"  
> > A new form appears to fill-in again my login and password, and i fill-in again with "admin/admin"  
> > Then I log out.
> > 
> > Step 2) Screencopy 002  
> > When disconnected, from Search-Guard login screen, I fill-in with another account: "readall", and password: "readall"
> > 
> > Step 3) Screencopy 003  
> > Then after the step 2) above, I am logged in Kibana, but with the user filled-in step 1) which is "admin" and not the one filled-in step 2) which is "readall".
> > 
> > Do you have any idea to where can be the issue ?
> > 
> > Thank you for your support.
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).  
> > \<sg\_action\_groups.yml\>\<sg\_config.yml\>\<sg\_internal\_users.yml\>\<sg\_roles.yml\>\<sg\_roles\_mapping.yml\>\<screencopy\_001.png\>\<ecreencopy\_002.png\>\<screencopy\_003.png\>\<ELASTIC\_Dockerfile\>\<KIBANA\_Dockerfile\>\<LOGSTASH\_Dockerfile\>\<elasticsearch.yml\>\<kibana.yml\>\<logstash.yml\>

---

<div class="post-metadata">

**Author:** ![plaz300664](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@plaz300664](https://forum.search-guard.com/u/plaz300664)\
**Post date:** [December 17, 2018, 2:32pm UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250/3 "2018-12-17T14:32:05Z")

</div>

Hello,

Thank you for your reply. I think that i also tested it but to be honest I am not 100% sure.

In the meantime I reverted to the version 6.4.3. I will try again and come back to you asap.

Thank you !

> **···**
>
> Le samedi 15 décembre 2018 15:26:04 UTC+1, Search Guard a écrit :
> 
> > Did you disable spaces? If not you have to (at the moment).
> > 
> > [https://docs.search-guard.com/latest/upgrading-560#kibana-spaces](https://docs.search-guard.com/latest/upgrading-560#kibana-spaces)
> > 
> > [https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin](https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin)
> > 
> > Next Kibana Plugin release will indeed support spaces, its expected to be released next week.
> > 
> > > Am 15.12.2018 um 09:31 schrieb [plaz3...@gmail.com](mailto:plaz3...@gmail.com):
> > 
> > > ==[Configuration:]==
> > 
> > > ELK\_VERSION=6.5.3 (Basic Licence)
> > 
> > > SG\_VERSION=23.2
> > 
> > > SG\_VERSION\_KIBANA=16
> > 
> > > No Enterprise Module installed ths is the CE edition
> > 
> > > Operting system : CENTOS 7x64 - SELinux=Permissive
> > 
> > > OS[Linux/3.10.0-862.14.4.el7.x86\_64/amd64],  
> > > JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13]
> > 
> > > ==[Issue]==
> > 
> > > Step 1) Screencopy 001:
> > 
> > > From Search-Guard login screen, I fill-in my account: “admin”, password: “admin”
> > 
> > > A new form appears to fill-in again my login and password, and i fill-in again with “admin/admin”
> > 
> > > Then I log out.
> > 
> > > Step 2) Screencopy 002
> > 
> > > When disconnected, from Search-Guard login screen, I fill-in with another account: “readall”, and password: “readall”
> > 
> > > Step 3) Screencopy 003
> > 
> > > Then after the step 2) above, I am logged in Kibana, but with the user filled-in step 1) which is “admin” and not the one filled-in step 2) which is “readall”.
> > 
> > > Do you have any idea to where can be the issue ?
> > 
> > > Thank you for your support.
> > 
> > > –  
> > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > 
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > 
> > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > 
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com).
> > 
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > 
> > > \<sg\_action\_groups.yml\>\<sg\_config.yml\>\<sg\_internal\_users.yml\>\<sg\_roles.yml\>\<sg\_roles\_mapping.yml\>\<screencopy\_001.png\>\<ecreencopy\_002.png\>\<screencopy\_003.png\>\<ELASTIC\_Dockerfile\>\<KIBANA\_Dockerfile\>\<LOGSTASH\_Dockerfile\>\<elasticsearch.yml\>\<kibana.yml\>\<logstash.yml\>

---

<div class="post-metadata">

**Author:** ![posthamster](https://avatars.discourse-cdn.com/v4/letter/p/e274bd/32.png) [@posthamster](https://forum.search-guard.com/u/posthamster)\
**Post date:** [December 21, 2018, 12:13am UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250/4 "2018-12-21T00:13:45Z")

</div>

I had the same issue with 6.5.4, and it turns out I managed to revert to a Kibana config without spaces disabled.

As per the fix above, add

xpack.spaces.enabled: false

to your kibana.yml

> **···**
>
> On Tuesday, 18 December 2018 03:32:05 UTC+13, [plaz3...@gmail.com](mailto:plaz3...@gmail.com) wrote:
> 
> > Hello,
> 
> > Thank you for your reply. I think that i also tested it but to be honest I am not 100% sure.
> 
> > In the meantime I reverted to the version 6.4.3. I will try again and come back to you asap.
> 
> > 
> 
> > Thank you !
> > 
> > Le samedi 15 décembre 2018 15:26:04 UTC+1, Search Guard a écrit :
> > 
> > > Did you disable spaces? If not you have to (at the moment).
> > > 
> > > [https://docs.search-guard.com/latest/upgrading-560#kibana-spaces](https://docs.search-guard.com/latest/upgrading-560#kibana-spaces)
> > > 
> > > [https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin](https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin)
> > > 
> > > Next Kibana Plugin release will indeed support spaces, its expected to be released next week.
> > > 
> > > > Am 15.12.2018 um 09:31 schrieb [plaz3...@gmail.com](mailto:plaz3...@gmail.com):
> > > 
> > > > ==[Configuration:]==
> > > 
> > > > ELK\_VERSION=6.5.3 (Basic Licence)
> > > 
> > > > SG\_VERSION=23.2
> > > 
> > > > SG\_VERSION\_KIBANA=16
> > > 
> > > > No Enterprise Module installed ths is the CE edition
> > > 
> > > > Operting system : CENTOS 7x64 - SELinux=Permissive
> > > 
> > > > OS[Linux/3.10.0-862.14.4.el7.x86\_64/amd64],  
> > > > JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13]
> > > 
> > > > ==[Issue]==
> > > 
> > > > Step 1) Screencopy 001:
> > > 
> > > > From Search-Guard login screen, I fill-in my account: “admin”, password: “admin”
> > > 
> > > > A new form appears to fill-in again my login and password, and i fill-in again with “admin/admin”
> > > 
> > > > Then I log out.
> > > 
> > > > Step 2) Screencopy 002
> > > 
> > > > When disconnected, from Search-Guard login screen, I fill-in with another account: “readall”, and password: “readall”
> > > 
> > > > Step 3) Screencopy 003
> > > 
> > > > Then after the step 2) above, I am logged in Kibana, but with the user filled-in step 1) which is “admin” and not the one filled-in step 2) which is “readall”.
> > > 
> > > > Do you have any idea to where can be the issue ?
> > > 
> > > > Thank you for your support.
> > > 
> > > > –  
> > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > > 
> > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > > 
> > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > > 
> > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com).
> > > 
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > > 
> > > > \<sg\_action\_groups.yml\>\<sg\_config.yml\>\<sg\_internal\_users.yml\>\<sg\_roles.yml\>\<sg\_roles\_mapping.yml\>\<screencopy\_001.png\>\<ecreencopy\_002.png\>\<screencopy\_003.png\>\<ELASTIC\_Dockerfile\>\<KIBANA\_Dockerfile\>\<LOGSTASH\_Dockerfile\>\<elasticsearch.yml\>\<kibana.yml\>\<logstash.yml\>

---

<div class="post-metadata">

**Author:** ![plaz300664](https://avatars.discourse-cdn.com/v4/letter/p/cab0a1/32.png) [@plaz300664](https://forum.search-guard.com/u/plaz300664)\
**Post date:** [December 22, 2018, 3:04pm UTC](https://forum.search-guard.com/t/elk-6-5-3-sg-23-2-issue-when-log-in-kibana/1250/5 "2018-12-22T15:04:16Z")

</div>

Hi CK,

Thank you for the info. I just tried with the latest release of **ELK 6.5.4 SG 24.0 and Kibana 17 and i confirm that everything work fine**.

Thank you for your support.

> **···**
>
> Le vendredi 21 décembre 2018 01:13:46 UTC+1, CK a écrit :
> 
> > I had the same issue with 6.5.4, and it turns out I managed to revert to a Kibana config without spaces disabled.
> 
> > As per the fix above, add
> 
> > 
> 
> > xpack.spaces.enabled: false
> 
> > 
> 
> > to your kibana.yml
> 
> > On Tuesday, 18 December 2018 03:32:05 UTC+13, [plaz3...@gmail.com](mailto:plaz3...@gmail.com) wrote:
> > 
> > > Hello,
> 
> > > Thank you for your reply. I think that i also tested it but to be honest I am not 100% sure.
> 
> > > In the meantime I reverted to the version 6.4.3. I will try again and come back to you asap.
> 
> > >
> 
> > > Thank you !
> > > 
> > > Le samedi 15 décembre 2018 15:26:04 UTC+1, Search Guard a écrit :
> > > 
> > > > Did you disable spaces? If not you have to (at the moment).
> > > > 
> > > > [https://docs.search-guard.com/latest/upgrading-560#kibana-spaces](https://docs.search-guard.com/latest/upgrading-560#kibana-spaces)
> > > > 
> > > > [https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin](https://docs.search-guard.com/latest/kibana-plugin-installation#installing-the-search-guard-kibana-plugin)
> > > > 
> > > > Next Kibana Plugin release will indeed support spaces, its expected to be released next week.
> > > > 
> > > > > Am 15.12.2018 um 09:31 schrieb [plaz3...@gmail.com](mailto:plaz3...@gmail.com):
> > > > 
> > > > > ==[Configuration:]==
> > > > 
> > > > > ELK\_VERSION=6.5.3 (Basic Licence)
> > > > 
> > > > > SG\_VERSION=23.2
> > > > 
> > > > > SG\_VERSION\_KIBANA=16
> > > > 
> > > > > No Enterprise Module installed ths is the CE edition
> > > > 
> > > > > Operting system : CENTOS 7x64 - SELinux=Permissive
> > > > 
> > > > > OS[Linux/3.10.0-862.14.4.el7.x86\_64/amd64],  
> > > > > JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13]
> > > > 
> > > > > ==[Issue]==
> > > > 
> > > > > Step 1) Screencopy 001:
> > > > 
> > > > > From Search-Guard login screen, I fill-in my account: “admin”, password: “admin”
> > > > 
> > > > > A new form appears to fill-in again my login and password, and i fill-in again with “admin/admin”
> > > > 
> > > > > Then I log out.
> > > > 
> > > > > Step 2) Screencopy 002
> > > > 
> > > > > When disconnected, from Search-Guard login screen, I fill-in with another account: “readall”, and password: “readall”
> > > > 
> > > > > Step 3) Screencopy 003
> > > > 
> > > > > Then after the step 2) above, I am logged in Kibana, but with the user filled-in step 1) which is “admin” and not the one filled-in step 2) which is “readall”.
> > > > 
> > > > > Do you have any idea to where can be the issue ?
> > > > 
> > > > > Thank you for your support.
> > > > 
> > > > > –  
> > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > > > 
> > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > > > 
> > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > > > 
> > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e5c0b1aa-3a01-4ee6-8da6-e75af2dcecc2%40googlegroups.com).
> > > > 
> > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > > > 
> > > > > \<sg\_action\_groups.yml\>\<sg\_config.yml\>\<sg\_internal\_users.yml\>\<sg\_roles.yml\>\<sg\_roles\_mapping.yml\>\<screencopy\_001.png\>\<ecreencopy\_002.png\>\<screencopy\_003.png\>\<ELASTIC\_Dockerfile\>\<KIBANA\_Dockerfile\>\<LOGSTASH\_Dockerfile\>\<elasticsearch.yml\>\<kibana.yml\>\<logstash.yml\>