# SG2 With Marvel and proxy\_auth\_domain **URL:** \ **Category:** Search Guard\ **Created:** [June 28, 2016, 12:02am UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209 "2016-06-28T00:02:50Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [June 28, 2016, 12:02am UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209/1 "2016-06-28T00:02:50Z")
Is anyone able to get marvel to work without an http basic prompt? I see the username being passed and elevated to sg\_admin, but then it tries to continue and use basic\_internal\_auth\_domain. I’ve attached my configs and log. [2016-06-27 16:39:25,164][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? true (cache size: 5) [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=daniel.kasen@redfin.com, roles=]’ is authenticated [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget from 127.0.0.1:44671 [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetRequest$Item [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed =false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget against _/_: [\*] [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget[shard] from 127.0.0.1:44671 [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetShardRequest [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all] [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget[shard] against _/_: [\*] [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles [2016-06-27 16:39:25,226][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /127.0.0.1:44673 [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolved /127.0.0.1:44673 to /127.0.0.1:44673 [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http proxy [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [authorization=Basic REVOKED, Host=localhost:9200, Content-Length=154, Connection=keep-alive] [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value null [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? false (cache size: 5) [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) (1342371120) not cached, return from internal backend directly [2016-06-27 16:39:25,228][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] **sg\_roles\_mapping.yml** sg\_admin: users: - admin - [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) sg\_logstash: users: - logstash sg\_kibana4\_server: users: - kibana sg\_public: users: - '/((?!daniel.kasen).)\*.redfin.com/ ’ **sg\_config.yml** searchguard: dynamic: http: anonymous\_auth\_enabled: false xff: enabled: true internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern remoteIpHeader: ‘x-forwarded-for’ proxiesHeader: ‘x-forwarded-by’ authc: proxy\_auth\_domain: enabled: true order: 1 http\_authenticator: type: proxy challenge: false config: user\_header: “x-proxy-user” roles\_header: “x-proxy-roles” authentication\_backend: type: noop basic\_internal\_auth\_domain: enabled: true order: 2 http\_authenticator: type: basic challenge: false authentication\_backend: type: intern **sg\_roles.yml** sg\_admin: cluster: - ‘\*’ indices: ‘\*’: ‘\*’: - ‘\*’ ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [June 29, 2016, 3:53pm UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209/2 "2016-06-29T15:53:17Z")
see inline comments > Is anyone able to get marvel to work without an http basic prompt? I see the username being passed and elevated to sg\_admin, but then it tries to continue and use basic\_internal\_auth\_domain. I've attached my configs and log. > > [2016-06-27 16:39:25,164][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value daniel.kasen@redfin.com > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'daniel.kasen@redfin.com' is in cache? true (cache size: 5) > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'User [name=daniel.kasen@redfin.com, roles=]' is authenticated > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget from 127.0.0.1:44671 > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetRequest$Item > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed > =false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for \*, will check now types [\*] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for \*/\*: [\*] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget against \*/\*: [\*] > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for 'sg\_admin.\*', evaluate other roles > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget[shard] from 127.0.0.1:44671 > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetShardRequest > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all] > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for \*, will check now types [\*] > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for \*/\*: [\*] > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget[shard] against \*/\*: [\*] > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for 'sg\_admin.\*', evaluate other roles Above you see the successful proxy authentication Below it looks like this is another request with no x-proxy-user defined, so the next auth domain (which is basic authentication) tries to login the user: > **···** > > > Am 28.06.2016 um 02:02 schrieb djtecha \: > > > [2016-06-27 16:39:25,226][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /127.0.0.1:44673 > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolved /127.0.0.1:44673 to /127.0.0.1:44673 > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http proxy > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [authorization=Basic REVOKED, Host=localhost:9200, Content-Length=154, Connection=keep-alive] > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value null > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'daniel.kasen@redfin.com' is in cache? false (cache size: 5) > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] daniel.kasen@redfin.com (1342371120) not cached, return from internal backend directly > > [2016-06-27 16:39:25,228][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > sg\_roles\_mapping.yml > > sg\_admin: > >   users: > >     - admin > >     - daniel.kasen@redfin.com > > > > sg\_logstash: > >   users: > >     - logstash > > > > sg\_kibana4\_server: > >   users: > >     - kibana > > > > sg\_public: > >   users: > >     - '/((?!daniel.kasen).)\*.redfin.com/ ' > > > > sg\_config.yml > > > > searchguard: > >   dynamic: > >     http: > >       anonymous\_auth\_enabled: false > >       xff: > >         enabled: true > >         internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern > >         remoteIpHeader: 'x-forwarded-for' > >         proxiesHeader: 'x-forwarded-by' > >     authc: > >       proxy\_auth\_domain: > >         enabled: true > >         order: 1 > >         http\_authenticator: > >           type: proxy > >           challenge: false > >           config: > >             user\_header: "x-proxy-user" > >             roles\_header: "x-proxy-roles" > >         authentication\_backend: > >           type: noop > >       basic\_internal\_auth\_domain: > >         enabled: true > >         order: 2 > >         http\_authenticator: > >           type: basic > >           challenge: false > >         authentication\_backend: > >           type: intern > > > > sg\_roles.yml > > > > sg\_admin: > >   cluster: > >     - '\*' > >   indices: > >     '\*': > >       '\*': > >         - '\*' > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/015ee558-7428-4ab1-b9a8-a4b28b4f0bba%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/015ee558-7428-4ab1-b9a8-a4b28b4f0bba%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [June 30, 2016, 11:46pm UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209/3 "2016-06-30T23:46:23Z")
Right, which is why i’m confused. It appears to do the http basic prompt for me with any plugin (marvel, timelion). Wondering if anyone is able to make these work? I am able to get kibana to work perfectly at this point, just plugins not working. I have nginx to use a simple ‘/’ location block so it’s not as though i’m hitting anything else. > **···** > > On Monday, June 27, 2016 at 5:02:51 PM UTC-7, djtecha wrote: > > > Is anyone able to get marvel to work without an http basic prompt? I see the username being passed and elevated to sg\_admin, but then it tries to continue and use basic\_internal\_auth\_domain. I’ve attached my configs and log. > > > > > > [2016-06-27 16:39:25,164][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? true (cache size: 5) > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=daniel.kasen@redfin.com, roles=]’ is authenticated > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget from [127.0.0.1:44671](http://127.0.0.1:44671) > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetRequest$Item > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed > > > =false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget against _/_: [\*] > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget[shard] from [127.0.0.1:44671](http://127.0.0.1:44671) > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetShardRequest > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all] > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget[shard] against _/_: [\*] > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > [2016-06-27 16:39:25,226][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /[127.0.0.1:44673](http://127.0.0.1:44673) > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolved /[127.0.0.1:44673](http://127.0.0.1:44673) to /[127.0.0.1:44673](http://127.0.0.1:44673) > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http proxy > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [authorization=Basic REVOKED, Host=localhost:9200, Content-Length=154, Connection=keep-alive] > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value null > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? false (cache size: 5) > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) (1342371120) not cached, return from internal backend directly > > > [2016-06-27 16:39:25,228][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > > > **sg\_roles\_mapping.yml** > > > sg\_admin: > > > users: > > > - admin > > > - [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > > > > sg\_logstash: > > > users: > > > - logstash > > > > > > sg\_kibana4\_server: > > > users: > > > - kibana > > > > > > sg\_public: > > > users: > > > - '/((?!daniel.kasen).)\*.[redfin.com/](http://redfin.com/) ’ > > > > > > **sg\_config.yml** > > > > > > searchguard: > > > dynamic: > > > http: > > > anonymous\_auth\_enabled: false > > > xff: > > > enabled: true > > > internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern > > > remoteIpHeader: ‘x-forwarded-for’ > > > proxiesHeader: ‘x-forwarded-by’ > > > authc: > > > proxy\_auth\_domain: > > > enabled: true > > > order: 1 > > > http\_authenticator: > > > type: proxy > > > challenge: false > > > config: > > > user\_header: “x-proxy-user” > > > roles\_header: “x-proxy-roles” > > > authentication\_backend: > > > type: noop > > > basic\_internal\_auth\_domain: > > > enabled: true > > > order: 2 > > > http\_authenticator: > > > type: basic > > > challenge: false > > > authentication\_backend: > > > type: intern > > > **sg\_roles.yml** > > > > > > sg\_admin: > > > cluster: > > > - ‘\*’ > > > indices: > > > ‘\*’: > > > ‘\*’: > > > - ‘\*’ > > > > > > ---
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [July 26, 2016, 10:23pm UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209/4 "2016-07-26T22:23:12Z")
Has anyone been able to get plugins to work in kibana? I’m still stuck and if I look at the header to port 5601 I can see it gets the full request with my name and authorization it just doesn’t want to use it for kibana plugins. Does Kibana hava another routing system to it’s plugins that I’m unaware of, and consequently not passing a header correctly to SG2? > **···** > > On Thursday, June 30, 2016 at 4:46:23 PM UTC-7, djtecha wrote: > > > Right, which is why i’m confused. It appears to do the http basic prompt for me with any plugin (marvel, timelion). Wondering if anyone is able to make these work? I am able to get kibana to work perfectly at this point, just plugins not working. I have nginx to use a simple ‘/’ location block so it’s not as though i’m hitting anything else. > > > > On Monday, June 27, 2016 at 5:02:51 PM UTC-7, djtecha wrote: > > > > > Is anyone able to get marvel to work without an http basic prompt? I see the username being passed and elevated to sg\_admin, but then it tries to continue and use basic\_internal\_auth\_domain. I’ve attached my configs and log. > > > > > > > > [2016-06-27 16:39:25,164][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? true (cache size: 5) > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=daniel.kasen@redfin.com, roles=]’ is authenticated > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget from [127.0.0.1:44671](http://127.0.0.1:44671) > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetRequest$Item > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed > > > > =false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget against _/_: [\*] > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget[shard] from [127.0.0.1:44671](http://127.0.0.1:44671) > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetShardRequest > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all] > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget[shard] against _/_: [\*] > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > > [2016-06-27 16:39:25,226][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /[127.0.0.1:44673](http://127.0.0.1:44673) > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolved /[127.0.0.1:44673](http://127.0.0.1:44673) to /[127.0.0.1:44673](http://127.0.0.1:44673) > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http proxy > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [authorization=Basic REVOKED, Host=localhost:9200, Content-Length=154, Connection=keep-alive] > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value null > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? false (cache size: 5) > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) (1342371120) not cached, return from internal backend directly > > > > [2016-06-27 16:39:25,228][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > > > > > **sg\_roles\_mapping.yml** > > > > sg\_admin: > > > > users: > > > > - admin > > > > - [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > > > > > > sg\_logstash: > > > > users: > > > > - logstash > > > > > > > > sg\_kibana4\_server: > > > > users: > > > > - kibana > > > > > > > > sg\_public: > > > > users: > > > > - '/((?!daniel.kasen).)\*.[redfin.com/](http://redfin.com/) ’ > > > > > > > > **sg\_config.yml** > > > > > > > > searchguard: > > > > dynamic: > > > > http: > > > > anonymous\_auth\_enabled: false > > > > xff: > > > > enabled: true > > > > internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern > > > > remoteIpHeader: ‘x-forwarded-for’ > > > > proxiesHeader: ‘x-forwarded-by’ > > > > authc: > > > > proxy\_auth\_domain: > > > > enabled: true > > > > order: 1 > > > > http\_authenticator: > > > > type: proxy > > > > challenge: false > > > > config: > > > > user\_header: “x-proxy-user” > > > > roles\_header: “x-proxy-roles” > > > > authentication\_backend: > > > > type: noop > > > > basic\_internal\_auth\_domain: > > > > enabled: true > > > > order: 2 > > > > http\_authenticator: > > > > type: basic > > > > challenge: false > > > > authentication\_backend: > > > > type: intern > > > > **sg\_roles.yml** > > > > > > > > sg\_admin: > > > > cluster: > > > > - ‘\*’ > > > > indices: > > > > ‘\*’: > > > > ‘\*’: > > > > - ‘\*’ > > > > > > > > ---
**Author:** ![Daniel\_Kasen](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@Daniel\_Kasen](https://forum.search-guard.com/u/Daniel_Kasen)\ **Post date:** [July 26, 2016, 11:27pm UTC](https://forum.search-guard.com/t/sg2-with-marvel-and-proxy-auth-domain/209/5 "2016-07-26T23:27:11Z")
Not sure if this is related but i’m seeing a lot of these in the logs: [2016-07-26 16:24:02,124][INFO][com.floragunn.searchguard.auth.BackendRegistry] ElasticsearchSecurityException[xff not done] extracting credentials from proxy ElasticsearchSecurityException[xff not done] Current config: searchguard: dynamic: http: xff: enabled: true trustedProxies: ‘.\*’ internalProxies: ‘.\*’ remoteIpHeader: ‘x-forwarded-for’ proxiesHeader: ‘x-forwarded-by’ authc: proxy\_domain\_proxy: enabled: true order: 1 http\_authenticator: type: proxy challenge: false config: user\_header: “x-proxy-user” roles\_header: “x-proxy-roles” authentication\_backend: type: noop authentication\_domain\_basic\_internal: enabled: true order: 2 http\_authenticator: type: basic challenge: false authentication\_backend: type: intern > **···** > > On Tue, Jul 26, 2016 at 3:23 PM, djtecha [djtecha@gmail.com](mailto:djtecha@gmail.com) wrote: > > > Has anyone been able to get plugins to work in kibana? I’m still stuck and if I look at the header to port 5601 I can see it gets the full request with my name and authorization it just doesn’t want to use it for kibana plugins. Does Kibana hava another routing system to it’s plugins that I’m unaware of, and consequently not passing a header correctly to SG2? > > > > On Thursday, June 30, 2016 at 4:46:23 PM UTC-7, djtecha wrote: > > > > > Right, which is why i’m confused. It appears to do the http basic prompt for me with any plugin (marvel, timelion). Wondering if anyone is able to make these work? I am able to get kibana to work perfectly at this point, just plugins not working. I have nginx to use a simple ‘/’ location block so it’s not as though i’m hitting anything else. > > > > > > On Monday, June 27, 2016 at 5:02:51 PM UTC-7, djtecha wrote: > > > > > > > Is anyone able to get marvel to work without an http basic prompt? I see the username being passed and elevated to sg\_admin, but then it tries to continue and use basic\_internal\_auth\_domain. I’ve attached my configs and log. > > > > > > > > > > [2016-06-27 16:39:25,164][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? true (cache size: 5) > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=daniel.kasen@redfin.com, roles=]’ is authenticated > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget from [127.0.0.1:44671](http://127.0.0.1:44671) > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetRequest$Item > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed > > > > > =false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > > > [2016-06-27 16:39:25,165][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget against _/_: [\*] > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > > > [2016-06-27 16:39:25,166][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=daniel.kasen@redfin.com, roles=] > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/mget[shard] from [127.0.0.1:44671](http://127.0.0.1:44671) > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.MultiGetShardRequest > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true] > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana] > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {} > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana] > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all] > > > > > [2016-06-27 16:39:25,167][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg\_admin] > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_admin > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for \* > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for \*: [.kibana] > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for _, will check now types [_] > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for _/_: [\*] > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/mget[shard] against _/_: [\*] > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested aliases and indices: > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index \* remaining requested resolved types: > > > > > [2016-06-27 16:39:25,168][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_admin.\*’, evaluate other roles > > > > > [2016-06-27 16:39:25,226][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /[127.0.0.1:44673](http://127.0.0.1:44673) > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolved /[127.0.0.1:44673](http://127.0.0.1:44673) to /[127.0.0.1:44673](http://127.0.0.1:44673) > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http proxy > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] headers [authorization=Basic REVOKED, Host=localhost:9200, Content-Length=154, Connection=keep-alive] > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] userHeader x-proxy-user, value null > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.http.HTTPProxyAuthenticator] rolesHeader x-proxy-roles, value null > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘daniel.kasen@redfin.com’ is in cache? false (cache size: 5) > > > > > [2016-06-27 16:39:25,227][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) (1342371120) not cached, return from internal backend directly > > > > > [2016-06-27 16:39:25,228][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found] > > > > > > > > > > **sg\_roles\_mapping.yml** > > > > > sg\_admin: > > > > > users: > > > > > - admin > > > > > - [daniel.kasen@redfin.com](mailto:daniel.kasen@redfin.com) > > > > > > > > > > sg\_logstash: > > > > > users: > > > > > - logstash > > > > > > > > > > sg\_kibana4\_server: > > > > > users: > > > > > - kibana > > > > > > > > > > sg\_public: > > > > > users: > > > > > - '/((?!daniel.kasen).)\*.[redfin.com/](http://redfin.com/) ’ > > > > > > > > > > **sg\_config.yml** > > > > > > > > > > searchguard: > > > > > dynamic: > > > > > http: > > > > > anonymous\_auth\_enabled: false > > > > > xff: > > > > > enabled: true > > > > > internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern > > > > > remoteIpHeader: ‘x-forwarded-for’ > > > > > proxiesHeader: ‘x-forwarded-by’ > > > > > authc: > > > > > proxy\_auth\_domain: > > > > > enabled: true > > > > > order: 1 > > > > > http\_authenticator: > > > > > type: proxy > > > > > challenge: false > > > > > config: > > > > > user\_header: “x-proxy-user” > > > > > roles\_header: “x-proxy-roles” > > > > > authentication\_backend: > > > > > type: noop > > > > > basic\_internal\_auth\_domain: > > > > > enabled: true > > > > > order: 2 > > > > > http\_authenticator: > > > > > type: basic > > > > > challenge: false > > > > > authentication\_backend: > > > > > type: intern > > > > > **sg\_roles.yml** > > > > > > > > > > sg\_admin: > > > > > cluster: > > > > > - ‘\*’ > > > > > indices: > > > > > ‘\*’: > > > > > ‘\*’: > > > > > - ‘\*’ > > > > > > > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/44b1e38a-23a8-4362-ae83-497b688a3bfc%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/44b1e38a-23a8-4362-ae83-497b688a3bfc%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).