# Authorization Exception - Kibana connecting to Ngnix **URL:** \ **Category:** Kibana\ **Created:** [August 14, 2018, 8:35am UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298 "2018-08-14T08:35:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![srini155](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@srini155](https://discuss.elastic.co/u/srini155)\ **Post date:** [August 14, 2018, 8:35am UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298/1 "2018-08-14T08:35:31Z")
Authorization Exception - Kibana connecting to Ngnix [error][status][plugin:elasticsearch@6.2.4] Status changed from yellow to red - Authorization Exception Nginx is configured to proxy the requests to elasticsearch with basic auth and access control list using lua.. here is the nginx config looks like: auth\_basic "Restricted Content"; auth\_basic\_user\_file /etc/nginx/.htpasswd; access\_by\_lua\_file '/etc/nginx/authorize.lua'; location / { proxy\_pass [http://elasticsearch](http://elasticsearch); proxy\_http\_version 1.1; proxy\_set\_header Connection "Keep-Alive"; proxy\_set\_header Proxy-Connection "Keep-Alive"; Kibana configured to connect to nginx host, here is the config looks like elasticsearch.url: "https://\*\*\*\*\*:443" #elasticsearch.ssl.verificationMode: none elasticsearch.username: "user" elasticsearch.password: "\*\*\*\*" have identified the problem only when using lua, Kibna can authenticate fine if I remove "access\_by\_lua\_file" config in nginx config.. Can some one enlight what could be the problem, I would need to use the lua for access based on roles.. ---
**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\ **Post date:** [August 14, 2018, 5:45pm UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298/2 "2018-08-14T17:45:54Z")
Sounds like it could be a problem in the Lua file itself. What does `authorize.lua` look like? [Here's a blog post about nginx and Elasticsearch](https://www.elastic.co/blog/playing-http-tricks-nginx), which includes an [example Lua file](https://gist.github.com/karmi/b0a9b4c111ed3023a52d#file-authorize-lua). ---
**Author:** ![srini155](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@srini155](https://discuss.elastic.co/u/srini155)\ **Post date:** [August 15, 2018, 9:17am UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298/3 "2018-08-15T09:17:32Z")
this my my authorize.lua.. I am also using cerebro to connect using the same nginx host url and auth credentials which works fine.. -- authorization rules local restrictions = { all = { ["^/$"] = { "HEAD" } }, user = { ["^/$"] = { "GET" }, ["^/?[^/]_/?anywherehelp/contacts/_"] = { "GET", "POST", "PUT", "HEAD" }, ["/\_aliases"] = { "GET" }, ["/\_cluster._"] = { "GET" } }, admin = { ["^/?[^/]_/?[^/]_/\_bulk"] = { "GET", "POST" }, ["^/?[^/]_/?[^/]_/\_refresh"] = { "GET", "POST" }, ["^/?[^/]_/?[^/]_/?[^/]_/\_create"] = { "GET", "POST" }, ["^/?[^/]_/?[^/]_/?[^/]_/\_update"] = { "GET", "POST" }, ["^/?[^/]_/?[^/]_/?._"] = { "GET", "POST", "PUT", "DELETE" }, ["^/?[^/]_/?[^/]_$"] = { "GET", "POST", "PUT", "DELETE" }, ["/\_aliases"] = { "GET", "POST" } } } -- get authenticated user as role local role = ngx.var.remote\_user ngx.log(ngx.DEBUG, role) -- exit 403 when no matching role has been found if restrictions[role] == nil then ngx.header.content\_type = 'text/plain' ngx.log(ngx.WARN, "Unknown role ["..role.."]") ngx.status = 403 ngx.say("403 Forbidden: You don't have access to this resource.") return ngx.exit(403) end -- get URL local uri = ngx.var.uri ngx.log(ngx.DEBUG, uri) -- get method local method = ngx.req.get\_method() ngx.log(ngx.DEBUG, method) local allowed = false for path, methods in pairs(restrictions[role]) do -- path matched rules? local p = string.match(uri, path) local m = nil -- method matched rules? for \_, \_method in pairs(methods) do m = m and m or string.match(method, \_method) end if p and m then allowed = true ngx.log(ngx.NOTICE, method.." "..uri.." matched: "..tostring(m).." "..tostring(path).." for "..role) break end end if not allowed then ngx.header.content\_type = 'text/plain' ngx.log(ngx.WARN, "Role ["..role.."] not allowed to access the resource ["..method.." "..uri.."]") ngx.status = 403 ngx.say("403 Forbidden: You don't have access to this resource.") return ngx.exit(403) end ---
**Author:** ![srini155](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@srini155](https://discuss.elastic.co/u/srini155)\ **Post date:** [August 15, 2018, 1:31pm UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298/4 "2018-08-15T13:31:49Z")
got the kibana working after modifying the authorize.lua file.. had to allow some additional access for the user to be able to authenticate.. here are the lines user = { ["^/$"] = { "GET", "HEAD" }, --allowed the HEAD requests ["^/?[^/]_/?testindex/contacts/_"] = { "GET", "POST", "PUT", "HEAD" }, --below are additional added to allow kibana to be able to authenticate ["^/?[^/]_/?[^/]_/\_nodes\*"] = { "GET" }, ["^/?[^/]_/?[^/]_/.kibana/\_mappings"] = { "GET" }, ["^/?[^/]_/?[^/]_/.kibana/doc/config:6.2.4"] = { "GET" }, ["^/?[^/]_/?[^/]_/.kibana/\_search"] = { "GET", "POST" }, ["^/?[^/]_/?[^/]_/\_mapping\*"] = { "GET" }, ["^/?[^/]_/?[^/]_/\*/\_search"] = { "POST" }, -- till here ["/\_aliases"] = { "GET" }, ["/\_cluster."] = { "GET" } }, now this works for me, but I wanted to make sure I am not exposing any additional previlages to this users to read / modify the data other then the allowed index (which is testindex/contacts/).. can you enlight me, if there could be any possible security issues with this setup.. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 12, 2018, 1:31pm UTC](https://discuss.elastic.co/t/authorization-exception-kibana-connecting-to-ngnix/144298/5 "2018-09-12T13:31:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.