# Authenticate to Kibana without Elasticsearch? **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [August 19, 2020, 6:35am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529 "2020-08-19T06:35:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [August 19, 2020, 6:35am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/1 "2020-08-19T06:35:35Z")
Hi, Is it possible, somehow, to login/authenticate to Kibana with an external authentication method? So there will be no changes to the elastic node/yml and other configuration files. For example, authenticate to an active directory system or any third-party platform. If it is possible, how? Thanks~! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 19, 2020, 6:36am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/2 "2020-08-19T06:36:44Z")
The only thing I have seen would be a proxy like nginx. Why would you want this though? ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [August 19, 2020, 6:41am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/3 "2020-08-19T06:41:38Z")
Reason: security reasons. using Kibana on a few different domains, but with 1 centralised elasticsearch 'data lake'. So each user/user-group will need to authenticate against a different AD. And the native realm is less preferred in this case. Any reference? I am trying to convince it is impossible, or very complicated and not worth the effort. 🙂 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 19, 2020, 6:47am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/4 "2020-08-19T06:47:15Z")
You can use different [realms](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/realms.html) with the Security functionality, why not use that? ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [August 26, 2020, 2:06am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/5 "2020-08-26T02:06:03Z")
It will require 2 different domains to talk with each other. There is no trust between these domains. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 26, 2020, 2:08am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/6 "2020-08-26T02:08:04Z")
Then define them as separate realms, per that link? ---
**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Post date:** [August 26, 2020, 2:12am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/7 "2020-08-26T02:12:21Z")
yes, your solution is understood. yet, I will have to configure elastic to integrate with an external authentication system (AD/LDAP), i.e. on a different domain. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 23, 2020, 2:12am UTC](https://discuss.elastic.co/t/authenticate-to-kibana-without-elasticsearch/245529/8 "2020-09-23T02:12:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.