Failed authentication in Kibana

Search Guard
1

If you think it is a bug report or you have a technical issue, please answer the following questions.

Elasticsearch version: 8.19.19

Kibana version (if relevant): 8.19.19

Browser version (if relevant): any

Describe the issue:

Since upgrade to 4.1.2, my reverse proxy authentication is broken on Kibana, but succeed in Elastic, I’m getting the following kibana log, event when logging as administrator, with the role “SGS_ALL_ACCESS”:

“{”“service”“:{”“node”“:{”“roles”“:[”“background_tasks”“,”“ui”“]}},”“ecs”“:{”“version”“:”“8.11.0"”},“”@timestamp"“:”“2026-08-05T19:50:07.941+02:00"”,““message””:““Multitenancy: Could not get tenant info from /. AuthenticationError: authentication_exception””,““log””:{““level””:““ERROR””,““logger””:““plugins.searchguard.searchguard-multitenancy””},““process””:{““pid””:766,““uptime””:3259.285224879},““trace””:{““id””:““322fce0b7bd07ca6bc204997f031012b””},““transaction””:{““id””:““3e3ca1518de8602d””}}"

I didn’t see anything particular in the release notes, can someone could give me some hint about what to check ? What did I miss or some log to check about deprecated features in kibana ?

2

@fbacchella Could you share your kibana.yml file? Do you have any options set in the kibana.keystore?

3

My kibana.yaml

elasticsearch:
    username: "kibana_system"
    hosts:
        - "https://esdev01.prod.exalead.com:9200"
    ssl:
      certificateAuthorities: /data/kibana/1/conf/alldsca.crt
    requestTimeout: 180000
    requestHeadersWhitelist: 
        - "authorization"
        - "x-forwarded-for"
        - "x-forwarded-host"
        - "x-forwarded-server"
        - "x-forwarded-by"
        - "x-proxy-user"
        - "x-proxy-roles"
        - "x-remote-user"
        - "CAS_memberOf"
        - "CAS_sAMAccountName"
        - "sgtenant"
server:
    host: "127.0.0.1"
    port: 5601 
    publicBaseUrl: "https://XXXX:5601"
    ssl:
        enabled: false
csp:
    strict: true
searchguard:
    cookie:
        secure: true
    auth:
        type: "proxy"
        debug: false
    accountinfo:
        enabled: true
logging:
    appenders:
        file:
            type: rolling-file
            fileName: /data/kibana/1/logs/kibana.log
            layout:
                type: pattern
                pattern: "[%date] [%level] [%logger] [%meta] %message"
            policy:
                type: time-interval
                interval: 24h
                modulate: true
        systemd:
            type: console
            layout:
                type: json
    root:
        appenders: [file,systemd]
map:
    includeElasticMapsService: true
newsfeed.enabled: false
monitoring.ui.ccs.enabled: false
path:
    data: /data/kibana/1/var
pid:
    file: /run/kibana1/kibana.pid
xpack:
    screenshotting:
        browser.chromium.disableSandbox: false
telemetry:
    optIn: false
    enabled: false
    allowChangingOptInStatus: false

And for kibana.kstore:

$ sudo -E /usr/share/kibana/bin/kibana-keystore list
elasticsearch.password
searchguard.cookie.password
xpack.reporting.encryptionKey
xpack.encryptedSavedObjects.encryptionKey
xpack.security.encryptionKey

Removing the setting searchguard.auth.type resolve the problem, but now my reverse proxy SSO authentication is broken.

4

@fbacchella I’ve tried to reproduce your issue with 8.19.19-4.1.2, but I couldn’t. I’ve also tested with an upgrade from 8.19.13-4.1.0. The proxy authentication is working with your config.

What exactly do you see in the UI and logs? Do you get passed to the Kibana UI?

5

@fbacchella Could you please take a backup of your current SG FLX configuration and share your sg_authc.yml?

6

I created ticket 1991. It seems that it’s not an obvious mistake.