# Username showed in Kibana is always 'user'

**URL:** <https://forum.search-guard.com/t/username-showed-in-kibana-is-always-user/2142>\
**Category:** Search Guard\
**Created:** [March 29, 2021, 10:54am UTC](https://forum.search-guard.com/t/username-showed-in-kibana-is-always-user/2142 "2021-03-29T10:54:42Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![trautw](https://avatars.discourse-cdn.com/v4/letter/t/e99b99/32.png) [@trautw](https://forum.search-guard.com/u/trautw)\
**Post date:** [March 31, 2021, 11:46am UTC](https://forum.search-guard.com/t/username-showed-in-kibana-is-always-user/2142/6 "2021-03-31T11:46:33Z")

</div>

Hello.  
Thanks for notification about deprecated proxycache.  
I replaced it with `proxy`. Could you please clarify “for all config options”? I tried to replace `searchguard.proxycache.*` with `searchguard.proxy.*`, but Kibana failed because of validation of `[searchguard].proxy` failed.  
Now I removed `searchguard.proxycache.*` params.  
Kibana still shows “user” insead of “admin”  
The `_searchguard/authinfo` request returns:

```
{
  "user" : "User [name=admin, backend_roles=[offline_access, admin, uma_authorization, user], requestedTenant=null]",
  "user_name" : "admin",
      ...

```

Regarding source code noticed by @srgbnd in created issue. Seems username should be provided with `restapiinfo.user_name`. I see browser log and `/kibana/api/v1` requests failed:

```
{"statusCode":500,"error":"Internal Server Error","message":"security_exception","attributes":{"body":{"error":{"root_cause":[{"type":"security_exception","reason":"Unexpected exception indices:data/read/get"}],"type":"security_exception","reason":"Unexpected exception indices:data/read/get"},"status":500}}}`

```

In case of I request only /api/v1/restapiinfo, there are logs in elasticsearch:

```
│ elasticsearch {"type": "server", "timestamp": "2021-03-31T11:40:40,057Z", "level": "ERROR", "component": "c.f.s.f.SearchGuardFilter", "cluster.name": "elasticsearch", "node.name": "kublr-logging-elasticsearch-client-84b4 │
│ 9f5c8b-759nr", "message": "Unexpected exception [_searchguard] InvalidIndexNameException[Invalid index name [_searchguard], must not start with '_'.]", "cluster.uuid": "4_5qVLmuSzirXadBLEOP1g", "node.id": "jn1rwlxfSt2WLg │
│ AbZ3bIzg" , │
...
│ elasticsearch {"type": "server", "timestamp": "2021-03-31T11:40:40,062Z", "level": "WARN", "component": "r.suppressed", "cluster.name": "elasticsearch", "node.name": "kublr-logging-elasticsearch-client-84b49f5c8b-759nr", │
│ "message": "path: /_searchguard/api/permissionsinfo, params: {index=_searchguard, id=permissionsinfo, type=api}", "cluster.uuid": "4_5qVLmuSzirXadBLEOP1g", "node.id": "jn1rwlxfSt2WLgAbZ3bIzg" , │
│ elasticsearch "stacktrace": ["org.elasticsearch.ElasticsearchSecurityException: Unexpected exception indices:data/read/get", │
│ elasticsearch "at com.floragunn.searchguard.filter.SearchGuardFilter.apply0(SearchGuardFilter.java:323) [search-guard-suite-security-7.10.2-49.0.0.jar:7.10.2-49.0.0]", │

```

I already reported it here: [Invalid index name [\_searchguard], must not start with '\_'.]](https://forum.search-guard.com/t/invalid-index-name-searchguard-must-not-start-with/2135)  
Perhaps these problems are related to each other

---

_[View the full topic](https://forum.search-guard.com/t/username-showed-in-kibana-is-always-user/2142)._