# Anonymous access on iframe but sign in otherwise

**URL:** <https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [March 18, 2021, 10:19pm UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724 "2021-03-18T22:19:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [March 18, 2021, 10:19pm UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724/1 "2021-03-18T22:19:56Z")

</div>

I am creating a web app that has kibana iframes embedded that I would like to not require sign in for them. I have read all of the elastic forums and githubs but I still can't figure out how to allow this.

When I use the settings I posted below, the iframe doesn't need auth and neither when I access kibana directly. However, I'm unable to sign in with another user so that I can do admin work.  
On the top right, I can click on the user, and it says "Sign In" I press that, it signs me out, and then there's another "Sign In" screen, and upon pressing that, I'm back to the same anonymous user. If I add:

```auto
xpack.security.authc.providers:
  basic.basic1:
    order: 1

```

to elasticsearch.yml, then I have to click on the anonymous sign in to make that work. What am I missing?

elasticsearch.yml

```auto
xpack.security.enabled: true
xpack.security.authc:
  anonymous:
    username: anonymous_user
    roles: public
    authz_exception: false

```

kibana.yml

```auto
xpack.security.enabled: true
xpack.security.authc.providers:
  anonymous.anonymous1:
    order: 1
    credentials:
      username: "user"
      password: "pw"

```

---

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [March 20, 2021, 11:40am UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724/2 "2021-03-20T11:40:36Z")

</div>

Hi @seanziee ,

You Kibana authentication configuration should look like this:

```auto
xpack.security.authc.providers:
  basic.basic1:
    order: 1
  anonymous.anonymous1:
    order: 2
    credentials:
      username: "user"
      password: "pw"

```

With this configuration you don't need to enable anonymous access in `elasticsearch.yml` (it's even discouraged if you don't need it). The only thing you're missing is the `auth_provider_hint=anonymous1` query string parameter in your `iframe` URL, read more about [here](https://www.elastic.co/guide/en/kibana/current/embedding.html#_authentication). In 7.11 you need to add this parameter manually, but since Kibana 7.12 [there will be a UI toggle for that](https://www.elastic.co/guide/en/kibana/7.12/kibana-authentication.html#anonymous-access-and-embedding) instead.

Best,  
Oleg

---

<div class="post-metadata">

**Author:** ![seanziee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seanziee/32/45151_2.png) [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Post date:** [March 20, 2021, 2:15pm UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724/3 "2021-03-20T14:15:43Z")

</div>

Oh ok thanks! I thought that the key for the hint was going to be the username, not `anonumous1`. It works now, thanks!

I'll remove the elasticsearch anon!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2021, 2:16pm UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724/4 "2021-04-17T14:16:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.