# Problems with Kibana 5 and SG 5.0.1-8

**URL:** <https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334>\
**Category:** Search Guard\
**Created:** [December 7, 2016, 3:24pm UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334 "2016-12-07T15:24:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Assaf\_Lavie](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Assaf\_Lavie](https://forum.search-guard.com/u/Assaf_Lavie)\
**Post date:** [December 7, 2016, 3:24pm UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334/1 "2016-12-07T15:24:41Z")

</div>

Hey all,

Trying to get Kibana 5 (latest) to work with my SG-enabled ES cluster.

I gave the kibana user maximum permissions in the roles/mappings configuration, and in fact Kibana is able to create its own index (.kibana) in ES, so it’s _almost_ working. 🙂

Kibana’s logs do show “Status changed from uninitialized to green - Ready”, so I’m hopeful…

However, when I try to access kibana’s “/app/kibana” path I get a HTTP 500 error. Kibana’s logs don’t show any further error info beyond

> {  
> “type”: “error”,  
> “@timestamp”: “2016-12-07T15:20:11Z”,  
> “tags”: ,  
> “pid”: 7,  
> “level”: “error”,  
> “message”: “Authentication Exception”,  
> “error”: {  
> “message”: “Authentication Exception”,  
> “name”: “Error”,  
> “stack”: “Error: Authentication Exception\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:289:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:248:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:164:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4994:19)\n at emitNone (events.js:91:20)\n at IncomingMessage.emit (events.js:185:7)\n at endReadableNT (\_stream\_readable.js:974:12)\n at \_combinedTickCallback (internal/process/next\_tick.js:74:11)\n at process.\_tickDomainCallback (internal/process/next\_tick.js:122:9)”  
> },  
> “url”: {  
> “protocol”: null,  
> “slashes”: null,  
> “auth”: null,  
> “host”: null,  
> “port”: null,  
> “hostname”: null,  
> “hash”: null,  
> “search”: “”,  
> “query”: {},  
> “pathname”: “/app/kibana”,  
> “path”: “/app/kibana”,  
> “href”: “/app/kibana”  
> }  
> }

The es username and password are set correctly (it’s succeeding in creating its own index, after all).

Certificates seem to be configured correctly (otherwise the above would not have worked).

What else could it be?

Any ideas how to debug this?

Much appreciated,

Assaf Lavie

---

<div class="post-metadata">

**Author:** ![Nicolas\_Castet](https://avatars.discourse-cdn.com/v4/letter/n/e19adc/32.png) [@Nicolas\_Castet](https://forum.search-guard.com/u/Nicolas_Castet)\
**Post date:** [December 7, 2016, 3:57pm UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334/2 "2016-12-07T15:57:28Z")

</div>

I get the same error as you, see post: “Using search-guard-5:5.0.2-8 with Kibana 5.0.2”

> **···**
>
> On Wednesday, December 7, 2016 at 9:24:42 AM UTC-6, [assaf...@forter.com](mailto:assaf...@forter.com) wrote:
> 
> > Hey all,
> 
> > Trying to get Kibana 5 (latest) to work with my SG-enabled ES cluster.
> 
> > I gave the kibana user maximum permissions in the roles/mappings configuration, and in fact Kibana is able to create its own index (.kibana) in ES, so it’s _almost_ working. 🙂
> 
> > Kibana’s logs do show “Status changed from uninitialized to green - Ready”, so I’m hopeful…
> 
> > 
> 
> > However, when I try to access kibana’s “/app/kibana” path I get a HTTP 500 error. Kibana’s logs don’t show any further error info beyond
> 
> > > {  
> > > “type”: “error”,  
> > > “@timestamp”: “2016-12-07T15:20:11Z”,  
> > > “tags”: ,  
> > > “pid”: 7,  
> > > “level”: “error”,  
> > > “message”: “Authentication Exception”,  
> > > “error”: {  
> > > “message”: “Authentication Exception”,  
> > > “name”: “Error”,  
> > > “stack”: “Error: Authentication Exception\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:289:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:248:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:164:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4994:19)\n at emitNone (events.js:91:20)\n at IncomingMessage.emit (events.js:185:7)\n at endReadableNT (\_stream\_readable.js:974:12)\n at \_combinedTickCallback (internal/process/next\_tick.js:74:11)\n at process.\_tickDomainCallback (internal/process/next\_tick.js:122:9)”  
> > > },  
> > > “url”: {  
> > > “protocol”: null,  
> > > “slashes”: null,  
> > > “auth”: null,  
> > > “host”: null,  
> > > “port”: null,  
> > > “hostname”: null,  
> > > “hash”: null,  
> > > “search”: “”,  
> > > “query”: {},  
> > > “pathname”: “/app/kibana”,  
> > > “path”: “/app/kibana”,  
> > > “href”: “/app/kibana”  
> > > }  
> > > }
> 
> > 
> 
> > The es username and password are set correctly (it’s succeeding in creating its own index, after all).
> 
> > Certificates seem to be configured correctly (otherwise the above would not have worked).
> 
> > What else could it be?
> 
> > Any ideas how to debug this?
> 
> > 
> 
> > Much appreciated,
> 
> > Assaf Lavie
> 
> > 
> 
> >

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [December 17, 2016, 8:00pm UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334/3 "2016-12-17T20:00:30Z")

</div>

There have been changes in Kibana from 5.0.2 onwards which break HTTP Basic Authentication. It also seems that this PR

> <https://github.com/elastic/kibana/pull/9446>
>
> Closes #9442
> 
> callWithRequest expects err.statusCode to be defined \[here\](http…s://github.com/elastic/kibana/blob/5864f2b0935bd7f5b86c647005858a8b406573e8/src/core\_plugins/elasticsearch/lib/call\_with\_request.js#L25). In certain cases this metadata is not returned by the client resulting in defaulted 500 errors. This is fixed by https://github.com/elastic/elasticsearch-js/commit/f9d25696404e57f8d15be6e2d7eaaef42fea2151.

will not be backported to 5.0.2 unfortunately.

We’re working on a solution which should be available in the next week.

> **···**
>
> Am Mittwoch, 7. Dezember 2016 16:57:28 UTC+1 schrieb Nicolas Castet:
> 
> > I get the same error as you, see post: “Using search-guard-5:5.0.2-8 with Kibana 5.0.2”
> > 
> > On Wednesday, December 7, 2016 at 9:24:42 AM UTC-6, [assaf...@forter.com](mailto:assaf...@forter.com) wrote:
> > 
> > > Hey all,
> 
> > > Trying to get Kibana 5 (latest) to work with my SG-enabled ES cluster.
> 
> > > I gave the kibana user maximum permissions in the roles/mappings configuration, and in fact Kibana is able to create its own index (.kibana) in ES, so it’s _almost_ working. 🙂
> 
> > > Kibana’s logs do show “Status changed from uninitialized to green - Ready”, so I’m hopeful…
> 
> > >
> 
> > > However, when I try to access kibana’s “/app/kibana” path I get a HTTP 500 error. Kibana’s logs don’t show any further error info beyond
> 
> > > > {  
> > > > “type”: “error”,  
> > > > “@timestamp”: “2016-12-07T15:20:11Z”,  
> > > > “tags”: ,  
> > > > “pid”: 7,  
> > > > “level”: “error”,  
> > > > “message”: “Authentication Exception”,  
> > > > “error”: {  
> > > > “message”: “Authentication Exception”,  
> > > > “name”: “Error”,  
> > > > “stack”: “Error: Authentication Exception\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:289:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:248:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:164:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4994:19)\n at emitNone (events.js:91:20)\n at IncomingMessage.emit (events.js:185:7)\n at endReadableNT (\_stream\_readable.js:974:12)\n at \_combinedTickCallback (internal/process/next\_tick.js:74:11)\n at process.\_tickDomainCallback (internal/process/next\_tick.js:122:9)”  
> > > > },  
> > > > “url”: {  
> > > > “protocol”: null,  
> > > > “slashes”: null,  
> > > > “auth”: null,  
> > > > “host”: null,  
> > > > “port”: null,  
> > > > “hostname”: null,  
> > > > “hash”: null,  
> > > > “search”: “”,  
> > > > “query”: {},  
> > > > “pathname”: “/app/kibana”,  
> > > > “path”: “/app/kibana”,  
> > > > “href”: “/app/kibana”  
> > > > }  
> > > > }
> 
> > >
> 
> > > The es username and password are set correctly (it’s succeeding in creating its own index, after all).
> 
> > > Certificates seem to be configured correctly (otherwise the above would not have worked).
> 
> > > What else could it be?
> 
> > > Any ideas how to debug this?
> 
> > >
> 
> > > Much appreciated,
> 
> > > Assaf Lavie
> 
> > >
> 
> > >

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [December 22, 2016, 3:56pm UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334/4 "2016-12-22T15:56:00Z")

</div>

We’ve just release alpha versions of our Kibana plugin which should solve the authentication problem. If you want to give it a try, we appreciate any feedback:

> **[GitHub - floragunncom/search-guard-kibana-plugin: This plugin for Kibana adds...](https://github.com/floragunncom/search-guard-kibana-plugin)**
>
> This plugin for Kibana adds session management and multi tenancy to a Search Guard secured cluster. - GitHub - floragunncom/search-guard-kibana-plugin: This plugin for Kibana adds session managemen...

> **···**
>
> Am Samstag, 17. Dezember 2016 21:00:31 UTC+1 schrieb Jochen Kressin:
> 
> > There have been changes in Kibana from 5.0.2 onwards which break HTTP Basic Authentication. It also seems that this PR
> 
> > [https://github.com/elastic/kibana/pull/9446](https://github.com/elastic/kibana/pull/9446)
> 
> > 
> 
> > will not be backported to 5.0.2 unfortunately.
> 
> > 
> 
> > We’re working on a solution which should be available in the next week.
> > 
> > Am Mittwoch, 7. Dezember 2016 16:57:28 UTC+1 schrieb Nicolas Castet:
> > 
> > > I get the same error as you, see post: “Using search-guard-5:5.0.2-8 with Kibana 5.0.2”
> > > 
> > > On Wednesday, December 7, 2016 at 9:24:42 AM UTC-6, [assaf...@forter.com](mailto:assaf...@forter.com) wrote:
> > > 
> > > > Hey all,
> 
> > > > Trying to get Kibana 5 (latest) to work with my SG-enabled ES cluster.
> 
> > > > I gave the kibana user maximum permissions in the roles/mappings configuration, and in fact Kibana is able to create its own index (.kibana) in ES, so it’s _almost_ working. 🙂
> 
> > > > Kibana’s logs do show “Status changed from uninitialized to green - Ready”, so I’m hopeful…
> 
> > > >
> 
> > > > However, when I try to access kibana’s “/app/kibana” path I get a HTTP 500 error. Kibana’s logs don’t show any further error info beyond
> 
> > > > > {  
> > > > > “type”: “error”,  
> > > > > “@timestamp”: “2016-12-07T15:20:11Z”,  
> > > > > “tags”: ,  
> > > > > “pid”: 7,  
> > > > > “level”: “error”,  
> > > > > “message”: “Authentication Exception”,  
> > > > > “error”: {  
> > > > > “message”: “Authentication Exception”,  
> > > > > “name”: “Error”,  
> > > > > “stack”: “Error: Authentication Exception\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:289:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:248:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:164:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4994:19)\n at emitNone (events.js:91:20)\n at IncomingMessage.emit (events.js:185:7)\n at endReadableNT (\_stream\_readable.js:974:12)\n at \_combinedTickCallback (internal/process/next\_tick.js:74:11)\n at process.\_tickDomainCallback (internal/process/next\_tick.js:122:9)”  
> > > > > },  
> > > > > “url”: {  
> > > > > “protocol”: null,  
> > > > > “slashes”: null,  
> > > > > “auth”: null,  
> > > > > “host”: null,  
> > > > > “port”: null,  
> > > > > “hostname”: null,  
> > > > > “hash”: null,  
> > > > > “search”: “”,  
> > > > > “query”: {},  
> > > > > “pathname”: “/app/kibana”,  
> > > > > “path”: “/app/kibana”,  
> > > > > “href”: “/app/kibana”  
> > > > > }  
> > > > > }
> 
> > > >
> 
> > > > The es username and password are set correctly (it’s succeeding in creating its own index, after all).
> 
> > > > Certificates seem to be configured correctly (otherwise the above would not have worked).
> 
> > > > What else could it be?
> 
> > > > Any ideas how to debug this?
> 
> > > >
> 
> > > > Much appreciated,
> 
> > > > Assaf Lavie
> 
> > > >
> 
> > > >

---

<div class="post-metadata">

**Author:** ![Assaf\_Lavie](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Assaf\_Lavie](https://forum.search-guard.com/u/Assaf_Lavie)\
**Post date:** [December 25, 2016, 7:26am UTC](https://forum.search-guard.com/t/problems-with-kibana-5-and-sg-5-0-1-8/334/5 "2016-12-25T07:26:03Z")

</div>

Many thanks, Jochen.

Will give this a try. ATM we’re back on 5.0.1 (which is how we worked around this issue) but we’ll soon upgrade and try it with the new plugin.

Assaf

> **···**
>
> On Thu, Dec 22, 2016 at 5:56 PM, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) wrote:
> 
> > We’ve just release alpha versions of our Kibana plugin which should solve the authentication problem. If you want to give it a try, we appreciate any feedback:
> 
> > [https://github.com/floragunncom/search-guard-kibana-plugin](https://github.com/floragunncom/search-guard-kibana-plugin)
> > 
> > Am Samstag, 17. Dezember 2016 21:00:31 UTC+1 schrieb Jochen Kressin:
> > 
> > > There have been changes in Kibana from 5.0.2 onwards which break HTTP Basic Authentication. It also seems that this PR
> 
> > > [https://github.com/elastic/kibana/pull/9446](https://github.com/elastic/kibana/pull/9446)
> 
> > >
> 
> > > will not be backported to 5.0.2 unfortunately.
> 
> > >
> 
> > > We’re working on a solution which should be available in the next week.
> > > 
> > > Am Mittwoch, 7. Dezember 2016 16:57:28 UTC+1 schrieb Nicolas Castet:
> > > 
> > > > I get the same error as you, see post: “Using search-guard-5:5.0.2-8 with Kibana 5.0.2”
> > > > 
> > > > On Wednesday, December 7, 2016 at 9:24:42 AM UTC-6, [assaf...@forter.com](mailto:assaf...@forter.com) wrote:
> > > > 
> > > > > Hey all,
> 
> > > > > Trying to get Kibana 5 (latest) to work with my SG-enabled ES cluster.
> 
> > > > > I gave the kibana user maximum permissions in the roles/mappings configuration, and in fact Kibana is able to create its own index (.kibana) in ES, so it’s _almost_ working. 🙂
> 
> > > > > Kibana’s logs do show “Status changed from uninitialized to green - Ready”, so I’m hopeful…
> 
> > > > >
> 
> > > > > However, when I try to access kibana’s “/app/kibana” path I get a HTTP 500 error. Kibana’s logs don’t show any further error info beyond
> 
> > > > > > {  
> > > > > > “type”: “error”,  
> > > > > > “@timestamp”: “2016-12-07T15:20:11Z”,  
> > > > > > “tags”: ,  
> > > > > > “pid”: 7,  
> > > > > > “level”: “error”,  
> > > > > > “message”: “Authentication Exception”,  
> > > > > > “error”: {  
> > > > > > “message”: “Authentication Exception”,  
> > > > > > “name”: “Error”,  
> > > > > > “stack”: “Error: Authentication Exception\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:289:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:248:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:164:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4994:19)\n at emitNone (events.js:91:20)\n at IncomingMessage.emit (events.js:185:7)\n at endReadableNT (\_stream\_readable.js:974:12)\n at \_combinedTickCallback (internal/process/next\_tick.js:74:11)\n at process.\_tickDomainCallback (internal/process/next\_tick.js:122:9)”  
> > > > > > },  
> > > > > > “url”: {  
> > > > > > “protocol”: null,  
> > > > > > “slashes”: null,  
> > > > > > “auth”: null,  
> > > > > > “host”: null,  
> > > > > > “port”: null,  
> > > > > > “hostname”: null,  
> > > > > > “hash”: null,  
> > > > > > “search”: “”,  
> > > > > > “query”: {},  
> > > > > > “pathname”: “/app/kibana”,  
> > > > > > “path”: “/app/kibana”,  
> > > > > > “href”: “/app/kibana”  
> > > > > > }  
> > > > > > }
> 
> > > > >
> 
> > > > > The es username and password are set correctly (it’s succeeding in creating its own index, after all).
> 
> > > > > Certificates seem to be configured correctly (otherwise the above would not have worked).
> 
> > > > > What else could it be?
> 
> > > > > Any ideas how to debug this?
> 
> > > > >
> 
> > > > > Much appreciated,
> 
> > > > > Assaf Lavie
> 
> > > > >
> 
> > > > >
> 
> > –
> > 
> > You received this message because you are subscribed to a topic in the Google Groups “Search Guard” group.
> > 
> > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/search-guard/Pta\_cZLzW\_k/unsubscribe](https://groups.google.com/d/topic/search-guard/Pta_cZLzW_k/unsubscribe).
> > 
> > To unsubscribe from this group and all its topics, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com).
> > 
> > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com).
> 
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/a2a4f4f8-56dc-4a9b-854c-6d73667e8547%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/a2a4f4f8-56dc-4a9b-854c-6d73667e8547%40googlegroups.com?utm_medium=email&utm_source=footer).
> > 
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).