# Auto-authenticate Kibana 5.3 dashboard embedded in iframe
**URL:** https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059
**Category:** Kibana
**Created:** [May 9, 2017, 10:22am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059 "2017-05-09T10:22:36Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 9, 2017, 10:22am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/1 "2017-05-09T10:22:36Z")
Auto-authenticate Kibana 5.3 dashboard embedded in iframe... For security we installed X pack..
Anyone help should be appreciated.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 9, 2017, 6:14pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/2 "2017-05-09T18:14:19Z")
Hi @PrabakarKaruppasamy,
this is a commonly asked question, that has been discussed before in this forum. Please see these threads, among others:
- [Auto-authenticating to iframe-embedded Kibana dashboard](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4)
- [Authenticating to iframe-embedded Kibana dashboard](https://discuss.elastic.co/t/authenticating-to-iframe-embedded-kibana-dashboard/71129)
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 10, 2017, 10:05am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/3 "2017-05-10T10:05:57Z")
Hi @weltenwort
Thanks for your response.
My requirement is need to do in programmatic way.
1. Can I pass username and password as part of the embedded URL.
2. Is there a way to make the ajax request to Kibana server and get the response and access the Iframe without showing the login screen of Kibana.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 10, 2017, 10:19am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/4 "2017-05-10T10:19:54Z")
Making a preparatory ajax request to `/api/security/v1/login` to set the cookie as suggested in [Authenticating to iframe-embedded Kibana dashboard](https://discuss.elastic.co/t/authenticating-to-iframe-embedded-kibana-dashboard/71129/7) might work. If the cookie is set correctly, the login screen should not be shown.
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 10, 2017, 3:21pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/5 "2017-05-10T15:21:34Z")
@weltenwort ... Thanks a lot... It is helpful too much
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 16, 2017, 3:08pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/6 "2017-05-16T15:08:48Z")
@weltenwort can we set up cross orgin header in Kibana?
My kibana server is runing in another IP. My nginx server in another domain. Can't able to login due to cross orgin issue.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 16, 2017, 3:32pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/7 "2017-05-16T15:32:51Z")
You should be able to configure the CORS settings via the `server.cors` setting in `kibana.yml`, which will be forwarded to hapijs. For the valid values of that setting, please see the CORS-related settings in the [hapi route options documentation](https://hapijs.com/api/14.2.0#route-options). It would roughly look like this, but please check the linked documentation for specifics that might apply to your deployment environment:
```
server.cors:
origin: ['YOUR', 'ORIGINS', 'HERE']
credentials: true
```
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 17, 2017, 8:43am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/8 "2017-05-17T08:43:37Z")
> [@weltenwort](#):
>
> server.cors:
> origin: ['YOUR', 'ORIGINS', 'HERE']
> credentials: true
I have configured like below..
server.cors:
origin: ['\*']
credentials: true
But I can't able to start the kibana getting error like Kibana cros expection boolean parameter.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 17, 2017, 9:01am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/9 "2017-05-17T09:01:48Z")
My apologies, I just noticed that according to [the source](https://github.com/elastic/kibana/blob/5.3/src/server/config/schema.js#L63) it is supposed to be `server.cors: true` when not in development mode.
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [May 17, 2017, 9:27am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/10 "2017-05-17T09:27:46Z")
Is there any other way work around??
---
### Author:  [@M.S.S](https://discuss.elastic.co/u/M.S.S)
#### Post date: [June 1, 2017, 7:03am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/11 "2017-06-01T07:03:35Z")
Is it possible to set this flag in kibana.yml, for an instance running on elastic cloud?
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [June 1, 2017, 8:15am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/12 "2017-06-01T08:15:55Z")
The `kibana.yml` settings on Elastic Cloud are not editable by the user yet. This is being worked on though. In the meantime you could ask Cloud support to change settings for you.
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [June 14, 2017, 4:29pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/13 "2017-06-14T16:29:31Z")
@weltenwort
Hi It is not working in Prod environment. Is there any other way or other work around.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [June 15, 2017, 9:47am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/14 "2017-06-15T09:47:04Z")
Could you elaborate what "it" and "not working" means exactly in your case, please?
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [June 16, 2017, 11:03am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/15 "2017-06-16T11:03:45Z")
> [@weltenwort](#):
>
> server.cors: true
Sorry for late reply. I have configured in Kibana yml file like this _server.cors: true_ but it is not reflected. It is running in AWS cloud.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [June 19, 2017, 8:15am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/16 "2017-06-19T08:15:41Z")
With the `server.cors: true` setting, I am able to get the following CORS headers in the response:
```
$ http OPTIONS http://localhost:5601/login kbn-version:5.4.0 Origin:http://some-nginx-domain.com Access-Control-Request-Method:get
HTTP/1.1 200 OK
Connection: keep-alive
Date: Mon, 19 Jun 2017 08:12:25 GMT
access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match
access-control-allow-methods: get
access-control-allow-origin: http://some-nginx-domain.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
content-length: 0
kbn-name: kibana
kbn-version: 5.4.0
kbn-xpack-sig: dd98667ca0fad49b443090b0770f1b9f
vary: accept-encoding
```
Can you compare that to the response you are getting from your Kibana server?
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [June 19, 2017, 8:59am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/17 "2017-06-19T08:59:16Z")
Sure. Thanks for the great information. Let me check
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [June 27, 2017, 9:51am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/18 "2017-06-27T09:51:47Z")
> [@weltenwort](#):
>
> With the server.cors: true setting, I am able to get the following CORS headers in the response:
Hi
With server.cors: true am facing config error. Error Message - (FATAL { ValidationError: child "server" fails because [child "cors" fails because ["cors" must be an object]]). Kibana doesn't start. It is failed at the starting the kibana service
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [June 27, 2017, 1:10pm UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/19 "2017-06-27T13:10:04Z")
According to [the source](https://github.com/elastic/kibana/blob/44198f5cdf2f05b55ad3fef9404b70cc9961c077/src/server/config/schema.js#L58-L64) it expects a boolean in production mode and an object in development mode.
---
### Author:  [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)
#### Post date: [June 28, 2017, 10:40am UTC](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/20 "2017-06-28T10:40:01Z")
@weltenwort
Here [Source](https://github.com/elastic/kibana/blob/44198f5cdf2f05b55ad3fef9404b70cc9961c077/src/ui/index.js#L76) we can able to see the dev mode is false but 'server.cors: true' configuration not working.
[Next page](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059.md?page=2)