# Searchguard.basicauth.allowed\_usernames not in documentation
**URL:** https://forum.search-guard.com/t/searchguard-basicauth-allowed-usernames-not-in-documentation/1730
**Category:** Search Guard
**Created:** [January 7, 2020, 2:16pm UTC](https://forum.search-guard.com/t/searchguard-basicauth-allowed-usernames-not-in-documentation/1730 "2020-01-07T14:16:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mikew](https://forum.search-guard.com/u/mikew)
#### Post date: [January 7, 2020, 2:16pm UTC](https://forum.search-guard.com/t/searchguard-basicauth-allowed-usernames-not-in-documentation/1730/1 "2020-01-07T14:16:01Z")
A while back I asked about [Limiting who can log in to Kibana to defined list of users](https://forum.search-guard.com/t/limiting-who-can-log-in-to-kibana-to-defined-list-of-users/1685)
In the release notes for the current version of the Kibana plugin [Kibana 6.x-19 | Elasticsearch Security | Search Guard](https://docs.search-guard.com/6.x-25/changelog-kibana-6.x-19) it says:
> Add option for allowed\_usernames - whitelist users [#PR 362](https://git.floragunn.com/search-guard/search-guard-kibana-plugin/merge_requests/362)
Which is great. Thank you for implementing it! I’ve tried using it and it worked as expected. However, it is not mentioned in the documentation at [HTTP Basic Authentication | Elasticsearch Security | Search Guard](https://docs.search-guard.com/6.x-25/kibana-authentication-http-basic) and that discourages me from actually using it. Maybe there’s some gotcha in using it that I’m not aware of. 🤷♂️ How does it work in combination with `searchguard.basicauth.forbidden_usernames` ? The obvious thing would seem to be that using one of those settings makes using the other one redundant. But what if both were used by accident and a user was in both lists?
---
### Author:  [@Mike](https://forum.search-guard.com/u/Mike)
#### Post date: [January 7, 2020, 4:46pm UTC](https://forum.search-guard.com/t/searchguard-basicauth-allowed-usernames-not-in-documentation/1730/2 "2020-01-07T16:46:34Z")
Hi @mikew,
Yes, I took a stab at this based on your feature request. Again, I need to do my homework on the documentation part, but this is now an official feature.
You are right, using `allowed_usernames` in conjunction with `forbidden_usernames` does not make much sense - as soon as you use the `allowed_usernames` option, **ALL** users need to be explicitly allowed.
The check for a forbidden username still runs and throws an error if the given username is forbidden though, but **not listing** that user in the allowed usernames list should have the same effect.
Hope this works for you - otherwise please let me know!
Best Regards
Mike
---
### Author:  [@system](https://forum.search-guard.com/u/system)
#### Post date: [January 28, 2020, 4:46pm UTC](https://forum.search-guard.com/t/searchguard-basicauth-allowed-usernames-not-in-documentation/1730/3 "2020-01-28T16:46:41Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.