# Auto-authenticating to iframe-embedded Kibana dashboard

**URL:** <https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091>\
**Category:** Kibana\
**Created:** [April 1, 2016, 7:05pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091 "2016-04-01T19:05:20Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![jordansparked](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordansparked/32/8495_2.png) [@jordansparked](https://discuss.elastic.co/u/jordansparked)\
**Post date:** [April 1, 2016, 7:05pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/1 "2016-04-01T19:05:20Z")

</div>

I have a Shield-protected Kibana 4.5 dashboard that I'm embedding via iframe. Is there any way to programmatically provide the user/password so that the user automatically auths and the dashboard is displayed?

I've attempted the following with no luck:  
`<iframe src="https://username:password@myKibanaHost....>`  
`<iframe src="https://myKibanaHost?embed=true&username=myuser&password=mypass>`

I know this isn't best idea to embed credentials in the iframe, but this is an internal system and we don't want users to have to authenticate twice (once to our site, once to Kibana).

Or is there another way?

---

<div class="post-metadata">

**Author:** ![joyometer](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@joyometer](https://discuss.elastic.co/u/joyometer)\
**Post date:** [April 6, 2016, 4:32pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/2 "2016-04-06T16:32:38Z")

</div>

+1 Love to know the answer. Double auth very much limits our use-case for Kibana. Or is there some other way like using OAuth / SAML?

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [April 6, 2016, 6:27pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/3 "2016-04-06T18:27:56Z")

</div>

> [@jordansparked](#):
>
> Is there any way to programmatically provide the user/password so that the user automatically auths and the dashboard is displayed?

If you are using Shield 2.3, and you have the front-end plugin installed in Kibana, then yes, this is possible. It doesn't work as you've put in your example.

Instead, pass a valid Basic Authorization header with the request will cause Shield will validate the session, creating and using an authorization cookie in the background.

Note that prior to 2.3, I don't believe this was possible at all.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [September 14, 2016, 8:15pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4 "2016-09-14T20:15:00Z")

</div>

You can pass the Authorization header as Joe suggests using an nginx proxy.

Here is the relevant section of my nginx.conf:

```auto
 server {
     listen 4443 ssl; # the default was port 443
     server_name tim-virtual-machine.local;

     ssl_certificate /home/tim/domain.crt;
     ssl_certificate_key /home/tim/domain.key;

     ssl_session_cache shared:SSL:1m;
     ssl_session_timeout 5m;

     ssl_ciphers HIGH:!aNULL:!MD5;
     ssl_prefer_server_ciphers on;

     location / {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Authorization "Basic cGFudHM6b25maXJl"; # base64-encoded username:password to pass in header
         proxy_pass https://tim-virtual-machine.local:5601; # actual kibana URL
     }
 }

```

I got this mostly from following this tutorial: [http://shairosenfeld.blogspot.com/2011/03/authorization-header-in-nginx-for.html](http://shairosenfeld.blogspot.com/2011/03/authorization-header-in-nginx-for.html)

I generated the Base64 string out of the `username:password` combination with this unix one-liner:

```auto
echo -n username:password | base64

```

---

<div class="post-metadata">

**Author:** ![Gabriele](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriele/32/14515_2.png) [@Gabriele](https://discuss.elastic.co/u/Gabriele)\
**Post date:** [January 12, 2017, 12:17pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/5 "2017-01-12T12:17:30Z")

</div>

@tsullivan Can it also be done on the [Elastic.co](http://Elastic.co) cloud?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 12, 2017, 9:44pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/6 "2017-01-12T21:44:08Z")

</div>

> @tsullivan Can it also be done on the [Elastic.co](http://Elastic.co) cloud?

I really don't know. [You and a colleague have been posting in another thread](https://discuss.elastic.co/t/auto-authenticating-to-an-embedded-kibana-dashboard-on-elastic-co-cloud/71248/6) about trying to do this, and according to messages there, you are getting this error:

```auto
{"ok":false,"message":"Unknown cluster."}

```

When you use Kibana hosted in Cloud normally, you are talking to a proxy, and that proxy has headers that it sets, including one for the cluster\_id. I don't know enough about this to know if your proxy might be preventing the Cloud proxy's header from persisting.

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [January 12, 2017, 9:49pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/7 "2017-01-12T21:49:52Z")

</div>

@Gabriele

It should be possible to route to the Elastic Cloud using nginx, there's just an extra header you need to supply, eg:

```auto
         proxy_set_header X-Found-Cluster <cluster-id>;

```

(note that's the full cluster ID, not just the first 6 digits)

There may be other issues, it's not something I've tried; but based on the error you're currently getting, this extra header should at least get you one step closer!

Alex

---

<div class="post-metadata">

**Author:** ![Gabriele](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriele/32/14515_2.png) [@Gabriele](https://discuss.elastic.co/u/Gabriele)\
**Post date:** [January 13, 2017, 10:20am UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/8 "2017-01-13T10:20:57Z")

</div>

```
#Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
# to Kibana. This setting cannot end in a slash.
server.basePath: "/kibana"

```

Ok, but how do I set up server.basePath in the Kibana Cloud? I can't access the kibana .yml file ☹

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [January 13, 2017, 5:15pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/9 "2017-01-13T17:15:05Z")

</div>

Ah sorry - you cannot currently set `server.basePath` in the Elastic Cloud Kibana; so you'd need to configure the proxy to translate the Kibana URLs in the replies (I don't know if that's possible, I have done it for Splunk in the past though using `apache`)

The alternative that we see people do a fair bit in these sorts of scenarios is to run their Kibana outside of Elastic Cloud pointing at an Elasticsearch instance in the cloud Obviously that's a bit of a pain, but Kibana is generally easier to run and maintain than Elasticsearch anyway.

Alex

---

<div class="post-metadata">

**Author:** ![PrabakarKaruppasamy](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)\
**Post date:** [June 13, 2017, 12:42pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/10 "2017-06-13T12:42:03Z")

</div>

Can u please explain me what we need to give $proxy\_add\_x\_forwarded\_for (local machine IP address or remote machine address)

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 16, 2017, 6:07am UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/11 "2017-06-16T06:07:46Z")

</div>

Hi PrabakarKaruppasamy,

The place to go to understand how nginx configurations work, is the nginx documentation or forums. I found this page which might help: [https://www.nginx.com/resources/wiki/start/topics/examples/likeapache/](https://www.nginx.com/resources/wiki/start/topics/examples/likeapache/)

---

<div class="post-metadata">

**Author:** ![georgezoto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgezoto/32/18855_2.png) [@georgezoto](https://discuss.elastic.co/u/georgezoto)\
**Post date:** [May 4, 2018, 8:40pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/12 "2018-05-04T20:40:30Z")

</div>

Thank you @tsullivan for your recommendations and sample nginx configuration.I know it is a work around and it will not solve all issues. @thomasneirynck shared a ticket asking for a enhancement to basically provide public facing visualizations and dashboard like many other modern platforms offer. Please upvote or comment if you find it helpful: [https://github.com/elastic/kibana/issues/18331](https://github.com/elastic/kibana/issues/18331)

Thank you again,  
George

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [June 7, 2018, 2:17am UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/13 "2018-06-07T02:17:01Z")

</div>

Hi, @tsullivan my ELK is version 6.2.2.  
I want to let users can auto authenticate to x-pack security.  
Do I need to install shield into Kibana?  
How can I connect nginx with x-pack?

thank you in advance 🙂

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 21, 2018, 6:38pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/14 "2018-06-21T18:38:10Z")

</div>

Hi,  
If you install X-Pack in Elasticsearch, you should also install it into Kibana. X-Pack is the commercial suite of products that includes Security (formerly called Shield).

To auto authenticate, set up a reverse proxy that passes through to the Kibana server. The proxy can add an authentication header to make all the requests authenticated as whatever user you want them to be.

---

<div class="post-metadata">

**Author:** ![Francisca\_Lima](https://avatars.discourse-cdn.com/v4/letter/f/edb3f5/32.png) [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\
**Post date:** [February 7, 2019, 9:32am UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/15 "2019-02-07T09:32:45Z")

</div>

Hello,  
So I can use nginx to access Kibana dashboards with different users? I tried to use a variable for the user in the nginx, but my problem is when I do the GET request of Kibana Dashboard.  
My nginx is like this:

> ```
> location / {
> proxy_pass http://127.0.0.1:5601;
> proxy_http_version 1.1;
> proxy_set_header Upgrade $http_upgrade;
> proxy_set_header Connection 'upgrade';
> proxy_set_header Host $host;
> proxy_cache_bypass $http_upgrade;
> rewrite ^/kibana(.*)$ /$1 break;
> proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
> proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
> proxy_set_header X-Forwarded-Proto $scheme;
> auth_basic "Basic Auth";
> auth_basic_user_file /etc/nginx/.htpasswd;
> proxy_set_header x-forwarded-user $remote_user;
> proxy_set_header Authorization "";
> access_log /var/log/nginx/kibana.access.log;
> }
> 
> ```

How can I access my kibana dashboards? Through a POST login request?

Thanks.

---

<div class="post-metadata">

**Author:** ![flexoid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flexoid/32/41996_2.png) [@flexoid](https://discuss.elastic.co/u/flexoid)\
**Post date:** [March 14, 2019, 12:36pm UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/16 "2019-03-14T12:36:10Z")

</div>

@tsullivan @Alex_Piggott @Francisca_Lima and others interested.

Looks like you should use

`proxy_set_header Host $proxy_host;`

instead of

`proxy_set_header Host $host;`

`$proxy_host` takes host value from `proxy_pass` directive, while `$host` will contain your `server_name`. And apparently, Kibana from Elastic Cloud requires an original host to determine target cluster ID.

Works for me without proxifying any additional `X-Found-Cluster` headers.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 18, 2019, 12:54am UTC](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/17 "2019-03-18T00:54:37Z")

</div>