Hi,
I have a kibana installed with searchguard in kubernetes, and a 3 node ES cluster on VMs
I am using the official kibana-oss docker image. There is an kubernetes nginx ingress in front of kibana interface
-
ES cluster works perfectly.
-
Application with the defined usernam/password for them working nicely
-
Curl with any user including kibanaserver works for the role defined things
-
On kibana interface i can login with the username/password of any user defined with sgadmin on the ES cluster
My problem is that i get the following errors
Error from kibana log:
{“type”:“log”,“@timestamp”:“2018-04-18T20:11:53Z”,“tags”:[“status”,“plugin:elasticsearch@6.2.2”,“error”],“pid”:8,“state”:“red”,“message”:“Status changed from yellow to red - Authentication Exception”,“prevState”:“yellow”,“prevMsg”:“Waiting for Elasticsearch”}
Error from ES:
[2018-04-18T20:18:07,559][WARN ][c.f.s.a.BackendRegistry ] Authentication finally failed for null
[2018-04-18T20:18:10,541][WARN ][c.f.s.a.BackendRegistry ] Authentication finally failed for null
How can searchguard login work on the kibana interface if kibana itself can’t connect to the ES cluster where the users are defined?
Versions:
plugin:kibana@6.2.2
Ready
plugin:elasticsearch@6.2.2
Authentication Exception
plugin:timelion@6.2.2
Ready
plugin:searchguard@6.2.2
Search Guard plugin initialised.
plugin:console@6.2.2
Ready
plugin:metrics@6.2.2
Ready
SearchGuard config
sg_config
searchguard:
dynamic:
authc:
basic_internal_auth_domain:
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: internal
clientcert_auth_domain:
transport_enabled: false
order: 1
http_authenticator:
type: clientcert
config:
username_attribute: cn
challenge: false
authentication_backend:
type: noop
sg_internal_user
kibanaserver:
readonly: true
hash: $2y$12$AoboyrVUI2A9y1yxOiyi5yx5Ni68eQLeo2BcSCNK16d6TboO
sg_roles
sg_kibana_server:
readonly: true
cluster:
-
CLUSTER_MONITOR
-
CLUSTER_COMPOSITE_OPS
-
cluster:admin/xpack/monitoring*
-
indices:admin/template*
indices:
‘?kibana’:
‘*’:
- INDICES_ALL
‘?reporting*’:
‘*’:
- INDICES_ALL
‘?monitoring*’:
‘*’:
- INDICES_ALL
sg_roles_mapping
sg_kibana_server:
readonly: true
users:
- kibanaserver
Kibana config:
server.host: “0.0.0.0”
server.name: “gh-kibana-stage.eur.xxx.com”
searchguard.cookie.secure: true
searchguard.cookie.password: “xxxxxxxxxxxx”
logging.verbose: false
elasticsearch.ssl.verificationMode: none
elasticsearch.url: “https://eurwebstageghes01.eurweb.xxx.com:9200”
elasticsearch.username: “kibanaserver”
elasticsearch.password: “xxxxxxxxxxx”
ES config:
network.bind_host: 0.0.0.0
searchguard.enterprise_modules_enabled: false
searchguard.ssl.transport.pemcert_filepath: certs/eurwebstageghes01.pem
searchguard.ssl.transport.pemkey_filepath: certs/eurwebstageghes01.key
searchguard.ssl.transport.pemkey_password: xxxxx
searchguard.ssl.transport.pemtrustedcas_filepath: certs/ca.pem
searchguard.ssl.transport.enforce_hostname_verification: true
searchguard.ssl.transport.resolve_hostname: true
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: certs/eurwebstageghes01.pem
searchguard.ssl.http.pemkey_filepath: certs/eurwebstageghes01.key
searchguard.ssl.http.pemkey_password: xxxxx
searchguard.ssl.http.pemtrustedcas_filepath: certs/ca.pem
searchguard.nodes_dn:
-
CN=eurwebstageghes01.eurweb.xxxx.com,OU=XXX,O=XXX,DC=xxx,DC=com
-
CN=eurwebstageghes02.eurweb.xxxx.com,OU=XXX,O=XXX,DC=xxx,DC=com
-
CN=eurwebstageghes03.eurweb.xxx.com,OU=XXX,O=XXX,DC=xxx,DC=com
searchguard.authcz.admin_dn:
- CN=see-admin,OU=XXXX,O=XXX,DC=xxxx,DC=com
searchguard.roles_mapping_resolution: MAPPING_ONLY
searchguard.restapi.roles_enabled: [“sg_all_access”]
searchguard.audit.enable_rest: true
searchguard.audit.resolve_bulk_requests: true
searchguard.audit.type: internal_elasticsearch