# Kibana asks for authentication twice ! **URL:** \ **Category:** Search Guard\ **Created:** [March 7, 2017, 3:55pm UTC](https://forum.search-guard.com/t/kibana-asks-for-authentication-twice/408 "2017-03-07T15:55:24Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Oucema\_Bellagha](https://avatars.discourse-cdn.com/v4/letter/o/eb8c5e/32.png) [@Oucema\_Bellagha](https://forum.search-guard.com/u/Oucema_Bellagha)\ **Post date:** [March 7, 2017, 3:55pm UTC](https://forum.search-guard.com/t/kibana-asks-for-authentication-twice/408/1 "2017-03-07T15:55:24Z")
Hi folks, So I get all the Searchguard running with ELK stack - but now when I authenticate into kibana I need to authenticate twice - what could be the problem? ELK: 5.2.2 Searchguard: 5.2.2-12 Kibana conf: kibana.index: “.kibana-operations” elasticsearch.preserveHost: false elasticsearch.ssl.ca: “/etc/kibana/root-ca.pem” elasticsearch.ssl.verify: false elasticsearch.username: “kibanaserver” elasticsearch.password: “password” elasticsearch.url: “[https://kibanaserver:9200](https://kibanaserver:9200)” console.proxyConfig: - match: protocol: “https” ssl: ca: “/etc/kibana/root-ca.pem” [kibana.log](https://forum.search-guard.com/uploads/short-url/qkzyw6dVsKtZVfreYX5m8Zit8rz.log) (16.6 KB) > **···** > > * * * > > Elasticsearch conf: > > bootstrap: {memory\_lock: true} > > cluster: {name: elasticsearch} > > discovery: > > zen: > > minimum\_master\_nodes: 2 > > ping: > > unicast: {hosts: ‘kibanaserver,kibanaserver2’} > > http: {host: 10.3.0.221, max\_content\_length: 100mb, port: 9200} > > network: {host: 10.3.0.221} > > node: {data: true, master: true, name: kibanaserver} > > path: {conf: /etc/elasticsearch, data: /var/lib/elasticsearch, logs: /var/log/elasticsearch, > > scripts: /usr/share/elasticsearch/config/scripts} > > searchguard: > > authcz.admin\_dn: [‘CN=admin, OU=yolo, O=yolo, L=SA, C=US’] > > ssl: > > http: {enabled: true, keystore\_filepath: 'kibanaserver-keystore.jks, keystore\_password: password, > > truststore\_filepath: truststore.jks, truststore\_password: password} > > transport: {enforce\_hostname\_verification: false, keystore\_filepath: 'kibanaserver-keystore.jks, > > keystore\_password: password, truststore\_filepath: truststore.jks, > > truststore\_password: password} > > transport: {tcp.compress: true, tcp.port: 9300} > > * * * > > logs from kibana are attached. > > Now as you can see it seems like there’s two authentications: > > First to [http://kibanaserver:5562/app/kibana](http://kibanaserver:5562/app/kibana) > > Second: /es\_admin/.kibana-operations/index-pattern/\_search?stored\_fields ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 9, 2017, 8:32am UTC](https://forum.search-guard.com/t/kibana-asks-for-authentication-twice/408/2 "2017-03-09T08:32:12Z")
[https://github.com/floragunncom/search-guard/issues/298](https://github.com/floragunncom/search-guard/issues/298) > **···** > > > Am 07.03.2017 um 16:55 schrieb Oucema Bellagha \: > > > > Hi folks, > > > > So I get all the Searchguard running with ELK stack - but now when I authenticate into kibana I need to authenticate twice - what could be the problem? > > ELK: 5.2.2 > > Searchguard: 5.2.2-12 > > > > Kibana conf: > > kibana.index: ".kibana-operations" > > > > elasticsearch.preserveHost: false > > elasticsearch.ssl.ca: "/etc/kibana/root-ca.pem" > > elasticsearch.ssl.verify: false > > elasticsearch.username: "kibanaserver" > > elasticsearch.password: "password" > > elasticsearch.url: "[https://kibanaserver:9200](https://kibanaserver:9200)" > > > > console.proxyConfig: > >   - match: > >       protocol: "https" > >     ssl: > >       ca: "/etc/kibana/root-ca.pem" > > ------------------------------------------------------------------------------------------------------------------- > > Elasticsearch conf: > > bootstrap: {memory\_lock: true} > > cluster: {name: elasticsearch} > > discovery: > >   zen: > >     minimum\_master\_nodes: 2 > >     ping: > >       unicast: {hosts: 'kibanaserver,kibanaserver2'} > > http: {host: 10.3.0.221, max\_content\_length: 100mb, port: 9200} > > network: {host: 10.3.0.221} > > node: {data: true, master: true, name: kibanaserver} > > path: {conf: /etc/elasticsearch, data: /var/lib/elasticsearch, logs: /var/log/elasticsearch, > >   scripts: /usr/share/elasticsearch/config/scripts} > > searchguard: > >   authcz.admin\_dn: ['CN=admin, OU=yolo, O=yolo, L=SA, C=US'] > >   ssl: > >     http: {enabled: true, keystore\_filepath: 'kibanaserver-keystore.jks, keystore\_password: password, > >       truststore\_filepath: truststore.jks, truststore\_password: password} > >     transport: {enforce\_hostname\_verification: false, keystore\_filepath: 'kibanaserver-keystore.jks, > >       keystore\_password: password, truststore\_filepath: truststore.jks, > >       truststore\_password: password} > > transport: {tcp.compress: true, tcp.port: 9300} > > > > ---------------------------------------------------------------------------------------------------------------- > > logs from kibana are attached. > > > > Now as you can see it seems like there's two authentications: > > > > First to [http://kibanaserver:5562/app/kibana](http://kibanaserver:5562/app/kibana) > > > > Second: /es\_admin/.kibana-operations/index-pattern/\_search?stored\_fields > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/3e9ee64f-36f9-447c-8c4d-2b46f1c256d5%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/3e9ee64f-36f9-447c-8c4d-2b46f1c256d5%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \