# Failed authentication in Kibana **URL:** \ **Category:** Search Guard\ **Created:** [August 5, 2026, 6:41pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046 "2026-08-05T18:41:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [August 5, 2026, 6:41pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/1 "2026-08-05T18:41:50Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. **Elasticsearch version:** 8.19.19 **Kibana version (if relevant):** 8.19.19 **Browser version (if relevant): any** **Describe the issue:** Since upgrade to 4.1.2, my reverse proxy authentication is broken on Kibana, but succeed in Elastic, I’m getting the following kibana log, event when logging as administrator, with the role “SGS\_ALL\_ACCESS”: “{”“service”“:{”“node”“:{”“roles”“:[”“background\_tasks”“,”“ui”“]}},”“ecs”“:{”“version”“:”“8.11.0"”},“”@timestamp"“:”“2026-08-05T19:50:07.941+02:00"”,““message””:““Multitenancy: Could not get tenant info from /. AuthenticationError: authentication\_exception””,““log””:{““level””:““ERROR””,““logger””:““plugins.searchguard.searchguard-multitenancy””},““process””:{““pid””:766,““uptime””:3259.285224879},““trace””:{““id””:““322fce0b7bd07ca6bc204997f031012b””},““transaction””:{““id””:““3e3ca1518de8602d””}}" I didn’t see anything particular in the release notes, can someone could give me some hint about what to check ? What did I miss or some log to check about deprecated features in kibana ? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [August 6, 2026, 2:16pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/2 "2026-08-06T14:16:03Z")
@fbacchella Could you share your kibana.yml file? Do you have any options set in the kibana.keystore? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [August 6, 2026, 4:07pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/3 "2026-08-06T16:07:03Z")
My kibana.yaml ```auto elasticsearch: username: "kibana_system" hosts: - "https://esdev01.prod.exalead.com:9200" ssl: certificateAuthorities: /data/kibana/1/conf/alldsca.crt requestTimeout: 180000 requestHeadersWhitelist: - "authorization" - "x-forwarded-for" - "x-forwarded-host" - "x-forwarded-server" - "x-forwarded-by" - "x-proxy-user" - "x-proxy-roles" - "x-remote-user" - "CAS_memberOf" - "CAS_sAMAccountName" - "sgtenant" server: host: "127.0.0.1" port: 5601 publicBaseUrl: "https://XXXX:5601" ssl: enabled: false csp: strict: true searchguard: cookie: secure: true auth: type: "proxy" debug: false accountinfo: enabled: true logging: appenders: file: type: rolling-file fileName: /data/kibana/1/logs/kibana.log layout: type: pattern pattern: "[%date] [%level] [%logger] [%meta] %message" policy: type: time-interval interval: 24h modulate: true systemd: type: console layout: type: json root: appenders: [file,systemd] map: includeElasticMapsService: true newsfeed.enabled: false monitoring.ui.ccs.enabled: false path: data: /data/kibana/1/var pid: file: /run/kibana1/kibana.pid xpack: screenshotting: browser.chromium.disableSandbox: false telemetry: optIn: false enabled: false allowChangingOptInStatus: false ``` And for kibana.kstore: ```auto $ sudo -E /usr/share/kibana/bin/kibana-keystore list elasticsearch.password searchguard.cookie.password xpack.reporting.encryptionKey xpack.encryptedSavedObjects.encryptionKey xpack.security.encryptionKey ``` Removing the setting searchguard.auth.type resolve the problem, but now my reverse proxy SSO authentication is broken. ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [August 10, 2026, 7:41pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/4 "2026-08-10T19:41:02Z")
@fbacchella I’ve tried to reproduce your issue with 8.19.19-4.1.2, but I couldn’t. I’ve also tested with an upgrade from 8.19.13-4.1.0. The proxy authentication is working with your config. What exactly do you see in the UI and logs? Do you get passed to the Kibana UI? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [August 10, 2026, 7:50pm UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/5 "2026-08-10T19:50:06Z")
@fbacchella Could you please take a backup of your current SG FLX configuration and share your sg\_authc.yml? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [August 11, 2026, 7:50am UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/6 "2026-08-11T07:50:15Z")
I created ticket 1991. It seems that it’s not an obvious mistake. ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [September 1, 2026, 7:50am UTC](https://forum.search-guard.com/t/failed-authentication-in-kibana/5046/7 "2026-09-01T07:50:33Z")
Closed on September 1, 2026, 7:50am UTC This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.