# Action \[cluster:monitor/main\] is unauthorized for user

**URL:** https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074
**Category:** Elasticsearch
**Created:** [February 8, 2018, 2:52pm UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074 "2018-02-08T14:52:38Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)
#### Post date: [February 8, 2018, 2:52pm UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074/1 "2018-02-08T14:52:38Z")

</div>

I'm trying to setup X-Pack (on ES v5.1.1 - can't upgrade yet) using the Puppet module ([https://github.com/elastic/puppet-elasticsearch/tree/5.x#advanced-features](https://github.com/elastic/puppet-elasticsearch/tree/5.x#advanced-features)), but I'm having problem with authentication...

I've created a realm (type=file, order=0), a user with a password and added the user to the "monitoring\_user" built-in group. But I'm still getting

```
action [cluster:monitor/main] is unauthorized for user [my_user]

```

Preferably, I'd like to give anyone access (without login in) to that root URL because it's used by my [AE]LBs in AWS..

EDIT:  
Actually, it seems to be worse than that... I can't get ANY authentication working. I've setup an LDAP server as well, and no matter if I try to authenticate with my "file" user or my "ldap" user, I always get

```
failed to authenticate user [<user>]

```

However, just found the default password for the 'elastic' user, and THAT works..

My config files:

- elasticsearch.yml

```auto
cloud.aws.region: eu-west-1
cluster.name: dbase-esc
cluster.routing.allocation.awareness.attributes: eu-west-1a
cluster.routing.allocation.awareness.force.my_rack_id.values: "eu-west-1a,eu-west-1b,eu-west-1c"
cluster.routing.allocation.node_concurrent_recoveries: 2
cluster.routing.allocation.node_initial_primaries_recoveries: 4
discovery.ec2.availability_zones: "eu-west-1a,eu-west-1b,eu-west-1c"
discovery.ec2.host_type: private_ip
discovery.zen.hosts_provider: ec2
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping_timeout: "2s"
gateway.expected_nodes: 2
gateway.recover_after_nodes: 1
gateway.recover_after_time: "5m"
http.enabled: "true"
http.max_content_length: "500mb"
http.port: 9200
indices.recovery.max_bytes_per_sec: "200mb"
network.bind_host: "_ec2:privateIpv4_"
network.publish_host: "_ec2:privateIpv4_"
node.attr.my_node_type: "false"
node.attr.my_rack_id: eu-west-1a
node.data: false
node.ingest: false
node.master: false
node.max_local_storage_nodes: 1
node.name: dbase-esc-coordinating-slave-00008
path.data: /var/lib/elasticsearch/data
path.logs: /var/lib/elasticsearch/logs
path.repo: /var/lib/elasticsearch/backups
plugin.mandatory: repository-s3
transport.tcp.compress: "true"
transport.tcp.port: 9300
xpack.monitoring.exporters.my_local.type: local
xpack.monitoring.exporters.my_local.use_ingest: true
xpack.security.audit.enabled: true
xpack.security.audit.outputs:
  - logfile
xpack.security.authc.anonymous.authz_exception: true
xpack.security.authc.anonymous.roles: lbs
xpack.security.authc.anonymous.username: lbs
xpack.security.authc.realms.ldap1.group_search.attribute: cn
xpack.security.authc.realms.ldap1.group_search.base_dn: "<MY_BASE_DN>"
xpack.security.authc.realms.ldap1.order: 1
xpack.security.authc.realms.ldap1.ssl.certificate_authorities:
  - x-pack/cacert.pem
xpack.security.authc.realms.ldap1.type: ldap
xpack.security.authc.realms.ldap1.unmapped_groups_as_roles: false
xpack.security.authc.realms.ldap1.url: "ldaps://ldap.domain.tld"
xpack.security.authc.realms.ldap1.user_search.attribute: uid
xpack.security.authc.realms.ldap1.user_search.base_dn: "<MY_BASE_DN>"
xpack.security.authc.realms.local.order: 0
xpack.security.authc.realms.local.type: file

```

- x-pack/role\_mapping.yml

```auto
admins:
  - "cn=admins,ou=Groups,ou=<MY_BASE_OU>"
devs:
  - "cn=devs,ou=Groups,ou=<MY_BASE_OU>"

```

- x-pack/roles.yml

```auto
admins:
  cluster: all
  indices:
    "*":
      privileges: all
anon:
  cluster: monitor
  indicies:
    - monitor
devs:
  cluster: manage
  indices:
    - names: "20*"
      privileges:
        - write
        - delete
        - create_index
lbs:
  cluster:
    - monitor
  indices:
    - monitor
    - transport_client
  internal:
    - discovery/zen/fd/ping

```

- x-pack/users

```auto
lbs:$2a$10$<RANDOM_STRING>

```

- x-pack/users\_roles

```auto
lbs:lbs

```

I'm also getting

```
[2018-02-08T18:26:42,103] [transport] [access_denied] origin_type=[rest], origin_address=[10.111.0.188], principal=[lbs], action=[cluster:monitor/main], request=[MainRequest]

```

which is the other coordinating node. I also get the same from my AWS (application) load balancers.

---

<div class="post-metadata">

### Author: ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)
#### Post date: [February 8, 2018, 10:44pm UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074/2 "2018-02-08T22:44:45Z")

</div>

Well, several hours later, it seems that my `roles.yml` was WAY wrong!

This seems to work better:

```auto
admins:
  cluster:
    - all
  indices:
    - names:
        - "*"
      privileges:
        - all
devs:
  cluster:
    - manage
  indices:
    - names:
        - "20*"
      privileges:
        - write
        - delete
        - create_index
lbchk:
  cluster:
    - monitor
    - transport_client
  indices:
    - names:
        - ".marvel-es-*"
        - ".monitoring-*"
      privileges:
        - all

```

I took the opportunity to rename my 'LB check user' (kept getting `Username [something] is reserved and may not be used.`. But seems that no matter what username I use, I still get that..

---

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 9, 2018, 12:00am UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074/3 "2018-02-09T00:00:53Z")

</div>

> [@Turbo\_Fredriksson](#):
>
> I took the opportunity to rename my 'LB check user' (kept getting Username [something] is reserved and may not be used.. But seems that no matter what username I use, I still get that..

My guess is that you're talking about a user that you're trying use for the "anonymous" user function.

If so, you're probably trying to do something wrong there.  
To enabled anonymous access you need to:

1. Create a role that the anonymous user should have _(Note: technically **every** user gets that role whether they're authenticated or not)._
2. Add that role name into your `elasticsearch.yml` under the `xpack.security.authc.anonymous.roles` setting.
3. _Optional_ change the name of the anonymous user by setting `xpack.security.authc.anonymous.username`.

And that's it. Don't try and _create_ the anonymous user, or modify them in any way. It's a builtin, reserved user, and the only 2 options you have are _what the username is_ and _what roles is has_, both of which are configured in `elasticsearch.yml` and not via the API.

---

<div class="post-metadata">

### Author: ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)
#### Post date: [February 9, 2018, 9:02pm UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074/4 "2018-02-09T21:02:21Z")

</div>

> Don't try and create the anonymous user

That was not obvious from any documentation or HOWTO I've ever seen... Thanx, I'll try that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2018, 9:02pm UTC](https://discuss.elastic.co/t/action-cluster-monitor-main-is-unauthorized-for-user/119074/5 "2018-03-09T21:02:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.