# Search guard flx and kibana proxy authentication **URL:** \ **Category:** Search Guard\ **Created:** [August 29, 2023, 1:10pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456 "2023-08-29T13:10:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [August 29, 2023, 1:10pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/1 "2023-08-29T13:10:53Z")
I’m migrating from SG 53.0.0 on 7.17.10. I’m trying to run sgctl migrate-config, but I’m getting: ```auto Errors in /tmp/kibana.yml searchguard.auth.type: The Kibana authentication type PROXY is not supported ``` The current kibana.yml configuration is: ```auto searchguard: cookie: secure: true auth: type: "proxy" debug: false proxycache: user_header: "CAS_sAMAccountName" roles_header: "CAS_memberOf" proxy_header_ip: "127.0.0.1" accountinfo: enabled: true ``` What am I doing wrong ? It’s the actual running setup, and SG FLX is said to keep support of proxy authentication. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.search-guard.com/u/Eugene7)\ **Post date:** [August 30, 2023, 12:09pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/2 "2023-08-30T12:09:59Z")
What are your new versions of ElasticSearch and SearchGuard? Also, what version of `sgctl.sh` do you use? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [August 30, 2023, 12:36pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/3 "2023-08-30T12:36:45Z")
Elastic 7.17.12 and SG 1.2.0, same for sgctl. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.search-guard.com/u/Eugene7)\ **Post date:** [September 1, 2023, 2:29pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/4 "2023-09-01T14:29:46Z")
Could you share `kibana.yml` file? Have you tried to manually add `searchguard.auth.type: "proxy"` to the `kibana.yml` ? ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 4, 2023, 8:14am UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/5 "2023-09-04T08:14:35Z")
Yes the current configuration is: ```auto searchguard: cookie: secure: true auth: type: "proxy" debug: false accountinfo: enabled: true ``` with SG 1.3, so it’s not an illegal settings. I think the problem is in the `proxycache` entries which are indeed deprecated. But the error message is missleading. ---
**Author:** ![fbacchella](https://avatars.discourse-cdn.com/v4/letter/f/f14d63/32.png) [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Post date:** [September 20, 2023, 10:32am UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/6 "2023-09-20T10:32:23Z")
Any one at search guard that have any hint about that ? ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.search-guard.com/u/Eugene7)\ **Post date:** [September 22, 2023, 10:23am UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/7 "2023-09-22T10:23:43Z")
The issue was created for the development team. You can find it at the link below: > **[sgctl.sh reports PROXY auth type as unsupported during config migration (#51)...](https://git.floragunn.com/search-guard/sgctl/-/issues/51)** > > When running sgtclt.sh version 1.3.0 and older with migrate-config option and PROXY set in searchguard.auth.type in kibana.yml, it will produce the below error. You can use `basicauth` authentication in kibana.yml instead for the migration process and then switch manually to proxy once migrated. The proxy authentication type is supported as per the SG FLX documentation below: > **[Quick Start](https://docs.search-guard.com/latest/proxy-authentication)** > > Use Search Guard's Proxy authentication feature to connect Elasticsearch to any third-party identity provider. ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [October 13, 2023, 10:23am UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/8 "2023-10-13T10:23:51Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed. ---
**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\ **Post date:** [November 9, 2023, 6:04pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/9 "2023-11-09T18:04:29Z")
What might be a bit confusing here is that the authentication type `proxy` is only not supported by the `sgctl migrate` command - as it is a rare thing. Search Guard FLX itself supports `proxy` authentication. See the documentation here: - [HTTP Proxy Quick Start | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/proxy-authentication) - [Kibana Proxy Authentication | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/kibana-authentication-proxy) How the configuration should look like would also depend on the previous proxy configuration in `sg_config.yml`. However, it will likely look similar to this: `sg_authc.yml`: ```auto auth_domains: - type: trusted_origin user_mapping.user_name.from: request.headers.CAS_sAMAccountName user_mapping.roles.from_comma_separated_string: request.headers.CAS_memberOf network: trusted_proxies: 'x.x.x.x/x' # Edit to set the IP of the trusted proxy and of Kibana (which also acts like a trusted proxy) ``` kibana.yml: ```auto searchguard.auth.type: "proxy" elasticsearch.requestHeadersWhitelist: ["Authorization", "sgtenant", "CAS_sAMAccountName", "CAS_memberOf"] ``` ---
**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\ **Post date:** [November 9, 2023, 6:04pm UTC](https://forum.search-guard.com/t/search-guard-flx-and-kibana-proxy-authentication/2456/10 "2023-11-09T18:04:39Z")