# Authentication problem after setting up native realm **URL:** \ **Category:** Elasticsearch\ **Created:** [December 20, 2017, 2:02pm UTC](https://discuss.elastic.co/t/authentication-problem-after-setting-up-native-realm/112647 "2017-12-20T14:02:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![TimTim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timtim/32/5295_2.png) [@TimTim](https://discuss.elastic.co/u/TimTim)\ **Post date:** [December 20, 2017, 2:02pm UTC](https://discuss.elastic.co/t/authentication-problem-after-setting-up-native-realm/112647/1 "2017-12-20T14:02:49Z")
So I have the following setup where i run Elasticsearch, Logstash and Kibana all on their own server in a Docker container. It all works fine and I used the latest version 6.1.1 (X-Pack pre-installed). Then I fixed the passwords for the built in users (elastic, kibana and logstash\_system). Fix all my YML files and start everything up again. Still going strong. Now, I change the security to the native realm, restarted ES and added myself as a user. Worked like a charm. But no more connections to the other servers ??? ES is showing this in the logs: ``` ... [2017-12-20T13:57:35,410][INFO][o.e.x.s.a.AuthenticationService] [es01] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic] [2017-12-20T13:57:35,418][INFO][o.e.x.s.a.AuthenticationService] [es01] Authentication of [logstash_system] was terminated by realm [reserved] - failed to authenticate user [logstash_system] ... ``` And..... Kibana shows a loging screen with the text: ``` Login is currently disabled. Administrators should consult the Kibana logs for more details. ``` But the logs give a similar problem: ``` {"type":"log","@timestamp":"2017-12-20T13:59:42Z","tags":["license","warning","xpack"],"pid":1,"message":"License information from the X-Pack plugin could not be obtained from Elasticsearch for the [monitoring] cluster. [security_exception] failed to authenticate user [elastic], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } :: {\"path\":\"/_xpack\",\"statusCode\":401,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"failed to authenticate user [elastic]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"failed to authenticate user [elastic]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}},\\\"status\\\":401}\",\"wwwAuthenticateDirective\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"}"} ``` Are those built-in users gone now ???? If so, I guess I have to add them to the native realm, but what roles do they have ?? /Tim ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 20, 2017, 11:50pm UTC](https://discuss.elastic.co/t/authentication-problem-after-setting-up-native-realm/112647/2 "2017-12-20T23:50:40Z")
> [@TimTim](#): > > Are those built-in users gone now ???? > > If so, I guess I have to add them to the native realm, but what roles do they have ?? No, switching to the native realm does not have any impact on the builtin users. My _guess_ is that in the process of changing your configuration to use the native realm (\*), you somehow managed to drop your `.security-6` index, possibly by removing all the `data/` directory, or something like that. It's just a guess, but given the ephermeral nature of docker containers, it's easy enough to do such things by accident. (\*) Out of interest, what were you using before the native realm? The default out-of-the-box configuration for X-Pack security provides the native realm and the file realm, so unless you had explicitly configured your own set of realms, you the native realm would have been enabled already. ---
**Author:** ![TimTim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timtim/32/5295_2.png) [@TimTim](https://discuss.elastic.co/u/TimTim)\ **Post date:** [December 21, 2017, 8:04am UTC](https://discuss.elastic.co/t/authentication-problem-after-setting-up-native-realm/112647/3 "2017-12-21T08:04:39Z")
Yes, the `.security-6` index was not there. What I did as well was after I configured a native realm and restarted ES, I went back to run the `bin/x-pack/setup-passwords` in the ES docker container and used the same passwords again that I had in my config files. Now everything is working again. Another thing I noticed is that even if you have all the correct roles and settings for a user, if the index has a read only setting like below, it will be impossible to make changes: ``` ... "settings": { "index": { "blocks": { "read_only_allow_delete": "true" } ... ``` /T ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 18, 2018, 8:04am UTC](https://discuss.elastic.co/t/authentication-problem-after-setting-up-native-realm/112647/4 "2018-01-18T08:04:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.