# Skip\_users feature not taking any effect when configured in basic\_auth\_domain to avoid "No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'" warning in the logs while using multiple auth domains

**URL:** <https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000>\
**Category:** Search Guard\
**Created:** [October 29, 2020, 7:54am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000 "2020-10-29T07:54:24Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [October 29, 2020, 7:54am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/1 "2020-10-29T07:54:25Z")

</div>

**Elasticsearch version:** 7.8.0

**Describe the issue:**  
I have configured skip\_users parameter in basic\_auth\_domain config section to avoid the warning log “No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’” , however it is not taking any effect and I can still observe the warning in the log.  
Searchguard version 7 is been used.

PFB sg\_config.yml section - ![sg-config](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/4e476e0a33b52f460fac99a2be02034673a41df8.png)

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [October 29, 2020, 11:05am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/2 "2020-10-29T11:05:11Z")

</div>

Do you have a user that has `kibanauser` name? It is a reserved backend role in Search Guard.

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [October 29, 2020, 11:30am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/3 "2020-10-29T11:30:04Z")

</div>

I have provided “kibanauser” just as a sample name here. In configuration file, I have given the correct username.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [October 29, 2020, 4:08pm UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/4 "2020-10-29T16:08:45Z")

</div>

I created an issue. I’ll reach you back when there is any update.

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [October 29, 2020, 5:08pm UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/5 "2020-10-29T17:08:20Z")

</div>

You have to move up the `skip_users` by two levels, directly under `basic_internal_auth_domain`. This would be the correct location.

However, I am not sure if this change would be actually effective, as - if I see it correctly - the log message is generated before the user is known. And for `skip_users` to work, you have to know the user.

For more information, we would need to see your whole configuration, the whole log message and the exact version of Search Guard you are using.

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [October 30, 2020, 7:10am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/6 "2020-10-30T07:10:22Z")

</div>

Hi  
I tried the scenario by keeping “skip\_users” directly under basic\_internal\_auth\_domain section and still it is not taking any effect.  
Search Guard version: 7.8.0-43.0  
PFB the config:

 ![sg-config](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/c795dc6c61fc2fc181b2d0be3269685e5c824417.png)

PFB logs:  
{“type”:“log”,“host”:“elasticsearch-client”,“level”:“DEBUG”,“systemid”:“2106a117733f42d697284fbc54927928”,“system”:“ELK-SYSTEM”,“time”: “2020-10-30T06:51:29.066Z”,“logger”:“c.f.s.a.BackendRegistry”,“timezone”:“UTC”,“marker”:"[elasticsearch-client] “,“log”:{“message”:“Check authdomain for rest internal/0 or 2 in total”}}  
{“type”:“log”,“host”:“elasticsearch-client”,“level”:“WARN”,“systemid”:“2106a117733f42d697284fbc54927928”,“system”:“ELK-SYSTEM”,“time”: “2020-10-30T06:51:29.066Z”,“logger”:“c.f.s.h.HTTPBasicAuthenticator”,“timezone”:“UTC”,“marker”:”[elasticsearch-client] “,“log”:{“message”:“No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’”}}  
{“type”:“log”,“host”:“elasticsearch-client”,“level”:“DEBUG”,“systemid”:“2106a117733f42d697284fbc54927928”,“system”:“ELK-SYSTEM”,“time”: “2020-10-30T06:51:29.066Z”,“logger”:“c.f.s.a.BackendRegistry”,“timezone”:“UTC”,“marker”:”[elasticsearch-client] “,“log”:{“message”:“Check authdomain for rest noop/1 or 2 in total”}}  
{“type”:“log”,“host”:“elasticsearch-client”,“level”:“DEBUG”,“systemid”:“2106a117733f42d697284fbc54927928”,“system”:“ELK-SYSTEM”,“time”: “2020-10-30T06:51:29.088Z”,“logger”:“c.n.c.b.HTTPKeycloakAuthenticator”,“timezone”:“UTC”,“marker”:”[elasticsearch-client] ",“log”:{“message”:“Received jwt token is valid”}}

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [October 30, 2020, 7:52am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/7 "2020-10-30T07:52:47Z")

</div>

This seems to be not the default Search Guard log configuration, as it also includes DEBUG messages.

Furthermore `c.n.c.b.HTTPKeycloakAuthenticator` does not seem to be a Search Guard component.

To disable the log messages from Search Guard, you can modify the file `config/log4j2.properties` on each node of the ES installation and add:

```auto
logger.sgbackendregistry.name = com.floragunn.searchguard.auth.BackendRegistry
logger.sgbackendregistry.level = info

logger.sghttpauth.name = com.floragunn.searchguard.http.HTTPBasicAuthenticator
logger.sghttpauth.level = error

```

For the log messages from `c.n.c.b.HTTPKeycloakAuthenticator`, you could do the same, but would need to know the whole package name (which is only abbreviated by `c.n.c.b` in the logs).

By the way, if this is a production system, I’d recommend to disable any log messages with level DEBUG or lower. There can be a very high amount of such messages which might negatively affect the performance of the whole system.

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [October 30, 2020, 8:18am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/8 "2020-10-30T08:18:39Z")

</div>

Yes, by default log level is set as “INFO” only. To capture the complete logs, I enabled debug level logs and shared here.  
However, {“type”:“log”,“host”:“elasticsearch-client”,“level”:“WARN”,“systemid”:“2106a117733f42d697284fbc54927928”,“system”:“ELK-SYSTEM”,“time”: “2020-10-30T06:51:29.066Z”,“logger”:“c.f.s.h.HTTPBasicAuthenticator”,“timezone”:“UTC”,“marker”:”[elasticsearch-client] “,“log”:{“message”:“No ‘Basic Authorization’ header, send 401 and ‘WWW-Authenticate Basic’”}} : This is a warn level log which comes even with “INFO” level log and to remove this we are trying to use skip\_users feature which is not taking any effect.

---

<div class="post-metadata">

**Author:** ![Kosmonafft](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kosmonafft/32/1010_2.png) [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\
**Post date:** [November 2, 2020, 12:12pm UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/9 "2020-11-02T12:12:01Z")

</div>

I experience the same issue. skip\_users has also no effect in my configuration. I am using openid and basicauth (for internal users of course). I was addressing the issue in this post: [No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic' while using openid and basic auth domain - #6 by jkressin](https://forum.search-guard.com/t/no-basic-authorization-header-send-401-and-www-authenticate-basic-while-using-openid-and-basic-auth-domain/1930/6)

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [November 2, 2020, 2:46pm UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/10 "2020-11-02T14:46:16Z")

</div>

As noted above, the warning log message is issued before the user is known. `skip_user` obviously only works after the user is known.

Right now, the only way to address the warning message is adapting the logging configuration as shown above.

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [November 4, 2020, 8:44am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/11 "2020-11-04T08:44:15Z")

</div>

Is skip\_users functionality in authentication domain been made available for elk 7.8.0?  
As it is making no difference even after configuring at config or auth\_domain level.

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [November 4, 2020, 10:23am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/12 "2020-11-04T10:23:50Z")

</div>

Please read the answers carefully. Again:

`skip_users` has and can have **no effect** on the warning message, as the warning message is produced before the user is known and thus before `skip_users` is evaluated.

The proper way to address the problem is to adjust the logging configuration:

```auto
logger.sghttpauth.name = com.floragunn.searchguard.http.HTTPBasicAuthenticator
logger.sghttpauth.level = error

```

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [November 4, 2020, 11:20am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/13 "2020-11-04T11:20:16Z")

</div>

Okay thanks for the information.  
Can you please tell when does the skip\_users functionality gets evaluated and also please confirm if this feature is available for elk 7.8.0?

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [November 5, 2020, 7:02am UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/14 "2020-11-05T07:02:03Z")

</div>

The `skip_users` feature is available since Search Guard 41.

It is getting evaluated after the user information has been extracted from a request to decide whether to use that information or to skip to the next auth domain.

---

<div class="post-metadata">

**Author:** ![pratikshavyas](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pratikshavyas](https://forum.search-guard.com/u/pratikshavyas)\
**Post date:** [November 6, 2020, 12:48pm UTC](https://forum.search-guard.com/t/skip-users-feature-not-taking-any-effect-when-configured-in-basic-auth-domain-to-avoid-no-basic-authorization-header-send-401-and-www-authenticate-basic-warning-in-the-logs-while-using-multiple-auth-domains/2000/15 "2020-11-06T12:48:27Z")

</div>

Thankyou for the information.