ValidationError with basic authentication in sg_config.yml

Yannick_K · August 8, 2018, 8:12am

When asking questions, please provide the following information:

Search Guard and Elasticsearch version
Installed and used enterprise modules, if any
JVM version and operating system version
Search Guard configuration files
Elasticsearch log messages on debug level
Other installed Elasticsearch or Kibana plugins, if any

Dear SearchGuard Community,

I am currently getting ValidationErrors while trying to setup basic authentication in Searchguard. I am using Elasticsearch, Kibana and Logstash in version 6.3.1 and SearchGuard 6 without any enterprise modules. The JVM is openjdk-8 (151-b12).

Here is the content of my sg_config.yml:

searchguard:

dynamic:

http:

anonymous_auth_enabled: false

xff:

enabled: false

internalProxies: “”

remoteIpHeader: “”

trustedProxies: “”

authc:

basic_internal_auth_domain:

http_enabled: true

transport_enabled: true

order: 0

http_authenticator:

type: basic

challenge: true

authentication_backend:

type: intern

``

and the related kibana log entry:

{“type”:“error”,“@timestamp”:“2018-08-08T08:09:05Z”,“tags”:[“fatal”],“pid”:12604,“level”:“fatal”,“error”:{“message”:“child "searchguard" fails because [child "auth" fails because [child "type" fails because ["type" must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”,“name”:“ValidationError”,“stack”:“ValidationError: child "searchguard" fails because [child "auth" fails because [child "type" fails because ["type" must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]\n at Object.exports.process (/usr/share/kibana/node_modules/joi/lib/errors.js:181:19)\n at internals.Object._validateWithOptions (/usr/share/kibana/node_modules/joi/lib/any.js:651:31)\n at module.exports.internals.Any.root.validate (/usr/share/kibana/node_modules/joi/lib/index.js:121:23)\n at Config._commit (/usr/share/kibana/src/server/config/config.js:119:35)\n at Config.set (/usr/share/kibana/src/server/config/config.js:89:10)\n at Config.extendSchema (/usr/share/kibana/src/server/config/config.js:62:10)\n at extendConfigService (/usr/share/kibana/src/plugin_discovery/plugin_config/extend_config_service.js:26:10)\n at ”},“message”:“child "searchguard" fails because [child "auth" fails because [child "type" fails because ["type" must be one of [basicauth, jwt, openid, saml, proxy, kerberos]]]]”}

``

I already tried to set the type to basicauth and “basicauth” without any differences in the ValidationError.

Any help or useful input is gladly appreciated!

Greetings,

Yannick

Yannick_K · August 8, 2018, 9:12am

Additionally the content of my kibana.yml:

Kibana is served by a back end server. This setting specifies the port to use.

server.port: 5601

Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

The default is ‘localhost’, which usually means remote machines will not be able to connect.

To allow connections from remote users, set this parameter to a non-loopback address.

server.host: “localhost”

elasticsearch.url: “https://localhost:9200”

elasticsearch.ssl.verificationMode: none

Enables you specify a file where Kibana stores log output.

logging.dest: /var/log/kibana/kibana.log

xpack.security.enabled: false

``

Yannick_K · August 8, 2018, 11:11am

It was due to the setting of ‘searchguard.auth.type: “basic”’, which I changed to ‘searchguard.basicauth.enabled: true’.
Now everything is working as expected.

Greetings Yannick

···

Am Mittwoch, 8. August 2018 10:12:01 UTC+2 schrieb Yannick K: