# JWT Authentification doesn't work

**URL:** <https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675>\
**Category:** Search Guard\
**Created:** [November 12, 2017, 6:52pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675 "2017-11-12T18:52:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fbo](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@Fbo](https://forum.search-guard.com/u/Fbo)\
**Post date:** [November 12, 2017, 6:52pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675/1 "2017-11-12T18:52:59Z")

</div>

Hi,

I’m using

- Elasticsearch 5.6.3 with SearchGuard plugin 5-5.6.3-16

- jwt module [jar-with-dependencies.jar](http://search.maven.org/remotecontent?filepath=com/floragunn/dlic-search-guard-auth-http-jwt/5.0-6/dlic-search-guard-auth-http-jwt-5.0-6-jar-with-dependencies.jar) 5.0.6

I’m trying to use JWT Authentification but i’m receiving 401 unauthorized errors

My configuration in sg\_config.yml is

basic\_internal\_auth\_domain:

enabled: true

order: 4

http\_authenticator:

type: basic

challenge: true

authentication\_backend:

type: intern

…

jwt\_auth\_domain:

enabled: true

order: 0

http\_authenticator:

type: jwt

challenge: true

config:

signing\_key: “base64 encoded key”

jwt\_header: “Authorization”

jwt\_url\_parameter: null

subject\_key: null

roles\_key: null

In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens.

Is there anything I missed ?

thank you in advance

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [November 13, 2017, 2:59pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675/2 "2017-11-13T14:59:41Z")

</div>

look into the logfiles for errors.  
most likely your signing\_key is not valid (do you use hmac or rsa?)

pls refer also to [https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md](https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md)

> **···**
>
> > Am 12.11.2017 um 19:52 schrieb boulmali.fares@gmail.com:
> > 
> > Hi,  
> > I'm using  
> > - Elasticsearch 5.6.3 with SearchGuard plugin 5-5.6.3-16  
> > - jwt module jar-with-dependencies.jar 5.0.6  
> > I'm trying to use JWT Authentification but i'm receiving 401 unauthorized errors
> > 
> > My configuration in sg\_config.yml is
> > 
> > basic\_internal\_auth\_domain:  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;enabled: true  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;order: 4  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http\_authenticator:  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;type: basic  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;challenge: true  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;authentication\_backend:  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;type: intern
> > 
> > .......
> > 
> > jwt\_auth\_domain:  
> > &nbsp;&nbsp;enabled: true  
> > &nbsp;&nbsp;order: 0  
> > &nbsp;&nbsp;http\_authenticator:  
> > &nbsp;&nbsp;&nbsp;&nbsp;type: jwt  
> > &nbsp;&nbsp;&nbsp;&nbsp;challenge: true  
> > &nbsp;&nbsp;&nbsp;&nbsp;config:  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;signing\_key: "base64 encoded key"  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;jwt\_header: "Authorization"  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;jwt\_url\_parameter: null  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;subject\_key: null  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;roles\_key: null
> > 
> > In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens.
> > 
> > Is there anything I missed ?  
> > thank you in advance
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).

---

<div class="post-metadata">

**Author:** ![Paul\_Azad](https://avatars.discourse-cdn.com/v4/letter/p/ce7236/32.png) [@Paul\_Azad](https://forum.search-guard.com/u/Paul_Azad)\
**Post date:** [November 13, 2017, 8:31pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675/3 "2017-11-13T20:31:12Z")

</div>

Hi

Over the past few weeks i have been working on getting JWT to work, here is what the config to what i have go to today, and what i have learned.

in kibana.yml:

elasticsearch.requestHeadersWhitelist: [authorization, Authorization, jwtheader, jwtparam] ← I tried using Authorization at the begining without any luck. Using jwtheader is what is working for me, technically that is the only header that needs to be whitelisted - but i am giving you what we have got working

searchguard.basicauth.enabled: false

searchguard.jwt.enabled: true

searchguard.jwt.url\_param: jwtparam

searchguard.jwt.header: jwtheader

in sg\_config.yml

authc:

kerberos\_auth\_domain:

enabled: false

order: 6

http\_authenticator:

type: kerberos # NOT FREE FOR COMMERCIAL USE

challenge: true

config:

# If true a lot of kerberos/security related debugging output will be logged to standard out

krb\_debug: false

# If true then the realm will be stripped from the user name

strip\_realm\_from\_principal: true

authentication\_backend:

type: noop

basic\_internal\_auth\_domain:

enabled: true

order: 4

http\_authenticator:

type: basic

challenge: false

authentication\_backend:

type: intern

jwt\_auth\_domain:

enabled: true

order: 0

http\_authenticator:

type: jwt

challenge: false

config:

signing\_key: “”

jwt\_header: “jwtheader”

jwt\_url\_parameter: “Authorization”

roles\_key: roles

subject\_key: name

authentication\_backend:

type: noop

All other auth lines are not enabled.

Then i go to [jwt.io](http://jwt.io) and build the token - that was the easiest way to test it. On the right I leave the header as it is, and put this into the payload:

{

“name”: “test123”,

“roles”: “testing” \<— see note below as this doesn’t get evaluated

}

For the signature i enter in my key , and tick the box under it ‘secret base64 encoded’. You can also put the time/date that the token should expire in this forma:

“exp”: 1300819380

For the URL, i your using kibana use the URL https://KIBANA\_SERVER:5601/?jwtparam= to just login, if you want to load a dashboard directly (cant see why else you would be using tokens to login unless you were), then this is the URL format:

https:/KIBANA\_SERVER:5601/app/kibana?jwtparam=#/dashboard/AV7Mz9jx9L52N7SG5J\_D?embed=true&\_g=(refreshInterval:(display:Off,pause:!f,value:0),…

To get this just go into the Kibana dashboard, click on the share - iframe and copy the url. Remove everything at the front upto and including the ", and everything at the back upto and including the ". Then insert the jwtparam= section between kibana and #/dashboard.

If your using elasticsearch then go to https://ES\_SERVER:9200//?Authorization=

You dont need to touch the sg\_internal\_users.yml file, it took me quite a while to work this out (mainly due to the point i make below). You do however need to map the username you passed to generate the JWT (test123 in my case) to a role in sg\_roles\_mapping.yml, otherwise you will not see any data as your authenticated - but not authorized.

I mentioned that the roles passed in the token are not being evaluated by JWT, i found this after days of troubleshooting why some usernames would show me data, and others would not. I have posted this separately - so lets hope the team at SG can shed some light as to what is causing this.

Hope this helps, it took me weeks to get to this point, but without knowing the issue with the roles not being passed in the token - we are stuck.

Paul

> **···**
>
> On Tuesday, November 14, 2017 at 1:59:43 AM UTC+11, Search Guard wrote:
> 
> > look into the logfiles for errors.
> > 
> > most likely your signing\_key is not valid (do you use hmac or rsa?)
> > 
> > pls refer also to [https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md](https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md)
> > 
> > > Am 12.11.2017 um 19:52 schrieb [boulmal...@gmail.com](mailto:boulmal...@gmail.com):
> > 
> > > Hi,  
> > > I’m using
> > > 
> > > - Elasticsearch 5.6.3 with SearchGuard plugin 5-5.6.3-16
> > 
> > > - jwt module jar-with-dependencies.jar 5.0.6
> > 
> > > I’m trying to use JWT Authentification but i’m receiving 401 unauthorized errors
> > > 
> > > My configuration in sg\_config.yml is
> > 
> > > basic\_internal\_auth\_domain:  
> > > enabled: true
> > 
> > > ```
> > > order: 4
> > > 
> > > ```
> > 
> > > ```
> > > http_authenticator:
> > > 
> > > ```
> > 
> > > ```
> > > type: basic
> > > 
> > > ```
> > 
> > > ```
> > > challenge: true
> > > 
> > > ```
> > 
> > > ```
> > > authentication_backend:
> > > 
> > > ```
> > 
> > > ```
> > > type: intern
> > > 
> > > ```
> > 
> > > …
> > 
> > > jwt\_auth\_domain:
> > 
> > > enabled: true
> > 
> > > order: 0
> > 
> > > http\_authenticator:
> > 
> > > ```
> > > type: jwt
> > > 
> > > ```
> > 
> > > ```
> > > challenge: true
> > > 
> > > ```
> > 
> > > ```
> > > config:
> > > 
> > > ```
> > 
> > > ```
> > > signing_key: "base64 encoded key"
> > > 
> > > ```
> > 
> > > ```
> > > jwt_header: "Authorization"
> > > 
> > > ```
> > 
> > > ```
> > > jwt_url_parameter: null
> > > 
> > > ```
> > 
> > > ```
> > > subject_key: null
> > > 
> > > ```
> > 
> > > ```
> > > roles_key: null
> > > 
> > > ```
> > 
> > > In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens.
> > 
> > > Is there anything I missed ?
> > 
> > > thank you in advance
> > 
> > > –  
> > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > 
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > 
> > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > 
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com).
> > 
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Fbo](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@Fbo](https://forum.search-guard.com/u/Fbo)\
**Post date:** [November 15, 2017, 1:22pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675/4 "2017-11-15T13:22:45Z")

</div>

Thank you for your response,  
yes i use HMAC.

> **···**
>
> Le lundi 13 novembre 2017 15:59:43 UTC+1, Search Guard a écrit :
> 
> > look into the logfiles for errors.
> > 
> > most likely your signing\_key is not valid (do you use hmac or rsa?)
> > 
> > pls refer also to [https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md](https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md)
> > 
> > > Am 12.11.2017 um 19:52 schrieb [boulmal...@gmail.com](mailto:boulmal...@gmail.com):
> > 
> > > Hi,  
> > > I’m using
> > > 
> > > - Elasticsearch 5.6.3 with SearchGuard plugin 5-5.6.3-16
> > 
> > > - jwt module jar-with-dependencies.jar 5.0.6
> > 
> > > I’m trying to use JWT Authentification but i’m receiving 401 unauthorized errors
> > > 
> > > My configuration in sg\_config.yml is
> > 
> > > basic\_internal\_auth\_domain:  
> > > enabled: true
> > 
> > > ```
> > > order: 4
> > > 
> > > ```
> > 
> > > ```
> > > http_authenticator:
> > > 
> > > ```
> > 
> > > ```
> > > type: basic
> > > 
> > > ```
> > 
> > > ```
> > > challenge: true
> > > 
> > > ```
> > 
> > > ```
> > > authentication_backend:
> > > 
> > > ```
> > 
> > > ```
> > > type: intern
> > > 
> > > ```
> > 
> > > …
> > 
> > > jwt\_auth\_domain:
> > 
> > > enabled: true
> > 
> > > order: 0
> > 
> > > http\_authenticator:
> > 
> > > ```
> > > type: jwt
> > > 
> > > ```
> > 
> > > ```
> > > challenge: true
> > > 
> > > ```
> > 
> > > ```
> > > config:
> > > 
> > > ```
> > 
> > > ```
> > > signing_key: "base64 encoded key"
> > > 
> > > ```
> > 
> > > ```
> > > jwt_header: "Authorization"
> > > 
> > > ```
> > 
> > > ```
> > > jwt_url_parameter: null
> > > 
> > > ```
> > 
> > > ```
> > > subject_key: null
> > > 
> > > ```
> > 
> > > ```
> > > roles_key: null
> > > 
> > > ```
> > 
> > > In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens.
> > 
> > > Is there anything I missed ?
> > 
> > > thank you in advance
> > 
> > > –  
> > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > 
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > 
> > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > 
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com).
> > 
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [November 30, 2017, 3:51pm UTC](https://forum.search-guard.com/t/jwt-authentification-doesnt-work/675/5 "2017-11-30T15:51:37Z")

</div>

Maybe you just have a typo in your post, but to make sure:

_"_

_…_

_config:_

_signing\_key: “base64 encoded key”_

_jwt\_header: “Authorization”_

_jwt\_url\_parameter: null_

_subject\_key: null_

_roles\_key: null_

_In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens._

_…_

_"_

You write you added an **Authentication** header in your HTTP request, but in sg\_config you configured the header to be **Authorization.**

_jwt\_header: “Authorization”_

> **···**
>
> On Wednesday, November 15, 2017 at 2:22:46 PM UTC+1, Fbo wrote:
> 
> > Thank you for your response,  
> > yes i use HMAC.
> > 
> > Le lundi 13 novembre 2017 15:59:43 UTC+1, Search Guard a écrit :
> > 
> > > look into the logfiles for errors.
> > > 
> > > most likely your signing\_key is not valid (do you use hmac or rsa?)
> > > 
> > > pls refer also to [https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md](https://github.com/floragunncom/search-guard-docs/blob/master/jwt.md)
> > > 
> > > > Am 12.11.2017 um 19:52 schrieb [boulmal...@gmail.com](mailto:boulmal...@gmail.com):
> > > 
> > > > Hi,  
> > > > I’m using
> > > > 
> > > > - Elasticsearch 5.6.3 with SearchGuard plugin 5-5.6.3-16
> > > 
> > > > - jwt module jar-with-dependencies.jar 5.0.6
> > > 
> > > > I’m trying to use JWT Authentification but i’m receiving 401 unauthorized errors
> > > > 
> > > > My configuration in sg\_config.yml is
> > > 
> > > > basic\_internal\_auth\_domain:  
> > > > enabled: true
> > > 
> > > > ```
> > > > order: 4
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > http_authenticator:
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > type: basic
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > challenge: true
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > authentication_backend:
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > type: intern
> > > > 
> > > > ```
> > > 
> > > > …
> > > 
> > > > jwt\_auth\_domain:
> > > 
> > > > enabled: true
> > > 
> > > > order: 0
> > > 
> > > > http\_authenticator:
> > > 
> > > > ```
> > > > type: jwt
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > challenge: true
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > config:
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > signing_key: "base64 encoded key"
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > jwt_header: "Authorization"
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > jwt_url_parameter: null
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > subject_key: null
> > > > 
> > > > ```
> > > 
> > > > ```
> > > > roles_key: null
> > > > 
> > > > ```
> > > 
> > > > In my request i added Authentication header with the Bearer as mentioned in the official documentation of JSON web tokens.
> > > 
> > > > Is there anything I missed ?
> > > 
> > > > thank you in advance
> > > 
> > > > –  
> > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group.
> > > 
> > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > > 
> > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > > 
> > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/ee0a895b-e85d-40d1-8dfd-a1a3714eb94c%40googlegroups.com).
> > > 
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).