ValidationError with basic authentication in sg_config.yml

When asking questions, please provide the following information:

  • Search Guard and Elasticsearch version

  • Installed and used enterprise modules, if any

  • JVM version and operating system version

  • Search Guard configuration files

  • Elasticsearch log messages on debug level

  • Other installed Elasticsearch or Kibana plugins, if any

Dear SearchGuard Community,

I am currently getting ValidationErrors while trying to setup basic authentication in Searchguard. I am using Elasticsearch, Kibana and Logstash in version 6.3.1 and SearchGuard 6 without any enterprise modules. The JVM is openjdk-8 (151-b12).

Here is the content of my sg_config.yml:

searchguard:

dynamic:

http:

anonymous_auth_enabled: false

xff:

enabled: false

internalProxies: “”

remoteIpHeader: “”

trustedProxies: “”

authc:

basic_internal_auth_domain:

http_enabled: true

transport_enabled: true

order: 0

http_authenticator:

type: basic

challenge: true

authentication_backend:

type: intern

``

and the related kibana log entry:

{“type”:“error”,"@timestamp":“2018-08-08T08:09:05Z”,“tags”:[“fatal”],“pid”:12604,“level”:“fatal”,“error”:{“message”:“child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”,“name”:“ValidationError”,“stack”:"ValidationError: child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]\n at Object.exports.process (/usr/share/kibana/node_modules/joi/lib/errors.js:181:19)\n at internals.Object._validateWithOptions (/usr/share/kibana/node_modules/joi/lib/any.js:651:31)\n at module.exports.internals.Any.root.validate (/usr/share/kibana/node_modules/joi/lib/index.js:121:23)\n at Config._commit (/usr/share/kibana/src/server/config/config.js:119:35)\n at Config.set (/usr/share/kibana/src/server/config/config.js:89:10)\n at Config.extendSchema (/usr/share/kibana/src/server/config/config.js:62:10)\n at extendConfigService (/usr/share/kibana/src/plugin_discovery/plugin_config/extend_config_service.js:26:10)\n at "},“message”:“child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”}

``

I already tried to set the type to basicauth and “basicauth” without any differences in the ValidationError.

Any help or useful input is gladly appreciated!

Greetings,

Yannick

Additionally the content of my kibana.yml:

Kibana is served by a back end server. This setting specifies the port to use.

server.port: 5601

Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

The default is ‘localhost’, which usually means remote machines will not be able to connect.

To allow connections from remote users, set this parameter to a non-loopback address.

server.host: “localhost”

elasticsearch.url: “https://localhost:9200

elasticsearch.ssl.verificationMode: none

Enables you specify a file where Kibana stores log output.

logging.dest: /var/log/kibana/kibana.log

xpack.security.enabled: false

``

It was due to the setting of ‘searchguard.auth.type: “basic”’, which I changed to ‘searchguard.basicauth.enabled: true’.
Now everything is working as expected.

Greetings Yannick

···

Am Mittwoch, 8. August 2018 10:12:01 UTC+2 schrieb Yannick K:

When asking questions, please provide the following information:

  • Search Guard and Elasticsearch version
  • Installed and used enterprise modules, if any
  • JVM version and operating system version
  • Search Guard configuration files
  • Elasticsearch log messages on debug level
  • Other installed Elasticsearch or Kibana plugins, if any

Dear SearchGuard Community,

I am currently getting ValidationErrors while trying to setup basic authentication in Searchguard. I am using Elasticsearch, Kibana and Logstash in version 6.3.1 and SearchGuard 6 without any enterprise modules. The JVM is openjdk-8 (151-b12).

Here is the content of my sg_config.yml:

searchguard:

dynamic:

http:

anonymous_auth_enabled: false

xff:

enabled: false

internalProxies: “”

remoteIpHeader: “”

trustedProxies: “”

authc:

basic_internal_auth_domain:

http_enabled: true

transport_enabled: true

order: 0

http_authenticator:

type: basic

challenge: true

authentication_backend:

type: intern

``

and the related kibana log entry:

{“type”:“error”,"@timestamp":“2018-08-08T08:09:05Z”,“tags”:[“fatal”],“pid”:12604,“level”:“fatal”,“error”:{“message”:“child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”,“name”:“ValidationError”,“stack”:"ValidationError: child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]\n at Object.exports.process (/usr/share/kibana/node_modules/joi/lib/errors.js:181:19)\n at internals.Object._validateWithOptions (/usr/share/kibana/node_modules/joi/lib/any.js:651:31)\n at module.exports.internals.Any.root.validate (/usr/share/kibana/node_modules/joi/lib/index.js:121:23)\n at Config._commit (/usr/share/kibana/src/server/config/config.js:119:35)\n at Config.set (/usr/share/kibana/src/server/config/config.js:89:10)\n at Config.extendSchema (/usr/share/kibana/src/server/config/config.js:62:10)\n at extendConfigService (/usr/share/kibana/src/plugin_discovery/plugin_config/extend_config_service.js:26:10)\n at "},“message”:“child “searchguard” fails because [child “auth” fails because [child “type” fails because [“type” must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”}

``

I already tried to set the type to basicauth and “basicauth” without any differences in the ValidationError.

Any help or useful input is gladly appreciated!

Greetings,

Yannick