Search guard flx and kibana proxy authentication

Search Guard
1

I’m migrating from SG 53.0.0 on 7.17.10. I’m trying to run sgctl migrate-config, but I’m getting:

Errors in /tmp/kibana.yml
searchguard.auth.type:
	The Kibana authentication type PROXY is not supported

The current kibana.yml configuration is:

searchguard:
    cookie:
        secure: true
    auth:
        type: "proxy"
        debug: false
    proxycache:
      user_header: "CAS_sAMAccountName"
      roles_header: "CAS_memberOf"
      proxy_header_ip: "127.0.0.1"
    accountinfo:
        enabled: true

What am I doing wrong ? It’s the actual running setup, and SG FLX is said to keep support of proxy authentication.

2

What are your new versions of ElasticSearch and SearchGuard? Also, what version of sgctl.sh do you use?

3

Elastic 7.17.12 and SG 1.2.0, same for sgctl.

4

Could you share kibana.yml file? Have you tried to manually add searchguard.auth.type: "proxy" to the kibana.yml ?

5

Yes the current configuration is:

searchguard:
    cookie:
        secure: true
    auth:
        type: "proxy"
        debug: false
    accountinfo:
        enabled: true

with SG 1.3, so it’s not an illegal settings. I think the problem is in the proxycache entries which are indeed deprecated. But the error message is missleading.

6

Any one at search guard that have any hint about that ?

7

The issue was created for the development team. You can find it at the link below:

You can use basicauth authentication in kibana.yml instead for the migration process and then switch manually to proxy once migrated. The proxy authentication type is supported as per the SG FLX documentation below: