# Add username/password ACL to kibana access

**URL:** <https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596>\
**Category:** Kibana\
**Created:** [January 7, 2016, 10:52am UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596 "2016-01-07T10:52:26Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 7, 2016, 10:52am UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/1 "2016-01-07T10:52:26Z")

</div>

Considering howto simplest add more that just IP ACL to protect access to a kibana instance without having to revert to graylog and having to swap current data in our custom indices for graylog server to understand, also latest graylog only support 1.7 \<= ES \< 2.x.

Anyone done something similar without applying Shields at ES level?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 7, 2016, 10:58am UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/2 "2016-01-07T10:58:04Z")

</div>

I don't understand how this relates to Graylog, but can't you just run Kibana behind a reverse proxy and apply access control in your web server?

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 7, 2016, 11:08am UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/3 "2016-01-07T11:08:10Z")

</div>

Well just because graylog among other features support user managment and ACLs but lack other features.  
Got few colleagues preferring graylog for their application, but I'll rather not.

Reverse proxy... maybe, something like [this](https://www.digitalocean.com/community/tutorials/how-to-set-up-a-node-js-application-for-production-on-ubuntu-14-04)

I was thinking maybe it was possible to do 'npm install http-auth' and utilize that in kibana 4, as it should be a node.js app

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 7, 2016, 11:34am UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/4 "2016-01-07T11:34:20Z")

</div>

Think I'll use a reverse proxy and thus not tamper with std kibana JS code... for easy future patching kibana.

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [January 7, 2016, 7:12pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/5 "2016-01-07T19:12:58Z")

</div>

You probably shouldn't tinker with the Kibana source, for exactly that reason. The easiest solution is just to proxy Kibana behind an nginx or Apache or HAProxy or some other instance and just do your auth through that.

If you have a commercial subscription, Shield is an option too.

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 9, 2016, 2:01pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/6 "2016-01-09T14:01:48Z")

</div>

Yeap agree.

Fooling around with a nginx proxy, I'm trying to mount kibana under en base path only kibana reponses like this:

> {"type":"response","@timestamp":"2016-01-09T13:53:52+00:00","tags":,"pid":5983,"method":"get","statusCode":404,"req":{"url":"/perf","method":"get","headers":{"connection":"upgrade","host":"","accept-encoding":"gzip, deflate","cookie":"BLKIPSID=3c5cffe3f6d17e1d1c742b34b5e6f35b","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_11\_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9","accept-language":"en-us","cache-control":"max-age=0"},"remoteAddress":"10.45.69.13","userAgent":"10.45.69.13"},"res":{"statusCode":404,"responseTime":25,"contentLength":9},"message":"GET /perf 404 25ms - 9.0B"}

Even when I got this in kibana.yml:

> server.basePath: "/perf"

should this be make kibana consider /perf as base?

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 9, 2016, 2:15pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/7 "2016-01-09T14:15:27Z")

</div>

Hm requesting / seems to prefix internally with basepath:

> GET / HTTP/1.0

> HTTP/1.1 200 OK  
> x-app-name: kibana  
> x-app-version: 4.3.0  
> cache-control: no-cache  
> content-type: text/html  
> content-length: 227  
> accept-ranges: bytes  
> Date: Sat, 09 Jan 2016 14:10:41 GMT  
> Connection: close

> ```
> <script>var hashRoute = '/perf/app/kibana';
> var defaultRoute = '/perf/app/kibana';
> 
> ```

> ```
> var hash = window.location.hash;
> if (hash.length) {
> window.location = hashRoute + hash;
> } else {
> window.location = defaultRoute;
> }</script>
> 
> ```

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [January 9, 2016, 3:26pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/8 "2016-01-09T15:26:24Z")

</div>

Doing [rewrite in nginx](https://github.com/elastic/kibana/issues/1653) along with kibana server.basePath does the trick!

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [January 11, 2016, 6:43pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/9 "2016-01-11T18:43:52Z")

</div>

Yeah, the basePath stuff is for when you're hosting Kibana under a given path, but it doesn't sound like that's what you're actually doing. The proxy is mounted at `/perf`, btu from Kibana's perspective, it's still running at `/`.

Glad you got it working, and thanks for sharing the solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:05pm UTC](https://discuss.elastic.co/t/add-username-password-acl-to-kibana-access/38596/10 "2017-07-06T14:05:18Z")

</div>