Cannot authenticate user through nginx authorization header

elk11 · November 21, 2019, 11:30am

Hi,

I want to configure auto login when users hit kibana url. So i created a anonymous user with basic read privileges through API. I checked if the user got created by logging in. it works. but when i add authorization header through nginx i get 401 in browser:

{"statusCode":401,"error":"Unauthorized","message":"[security_exception] unable to authenticate user [kibana_anonymous] for REST request [/_security/_authenticate], with { header={ WWW-Authenticate={ 0=\"Bearer realm=\\\"security\\\"\" & 1=\"ApiKey\" & 2=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } }"}

Part of my nginx conf where header is added:

 proxy_set_header  Host $host;
 proxy_set_header  X-Real-IP $remote_addr;
 proxy_set_header  X-Forwarded-For $remote_addr;

 location / {
        proxy_set_header  Authorization "Basic a2liYW5hX2Fub255bW91czphbm9ueW1vdXM=";
        proxy_pass https://<KIBANA_URL>:5601;
 }

This is what i get in elasticsearch log:

[id: 0x63c1aefd, L:/172.17.0.2:9200 - R:/172.17.0.1:55216] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Authentication to realm default_native failed - Password authentication failed for kibana_anonymous
path: /_security/_authenticate, params: {}
org.elasticsearch.ElasticsearchSecurityException: unable to authenticate user [kibana_anonymous] for REST request [/_security/_authenticate]
        at org.elasticsearch.xpack.core.security.support.Exceptions.authenticationError(Exceptions.java:18) ~[x-pack-core-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.core.security.authc.DefaultAuthenticationFailureHandler.createAuthenticationError(DefaultAuthenticationFailureHandler.java:154) ~[x-pack-core-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.core.security.authc.DefaultAuthenticationFailureHandler.failedAuthentication(DefaultAuthenticationFailureHandler.java:82) ~[x-pack-core-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$AuditableRestRequest.authenticationFailed(AuthenticationService.java:716) ~[x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.consumeUser(AuthenticationService.java:495) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$consumeToken$16(AuthenticationService.java:403) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:62) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.core.common.IteratingActionListener.onResponse(IteratingActionListener.java:115) [x-pack-core-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$consumeToken$13(AuthenticationService.java:387) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:62) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.lambda$authenticateWithCache$3(CachingUsernamePasswordRealm.java:175) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:62) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.esnative.NativeUsersStore.lambda$verifyPassword$16(NativeUsersStore.java:515) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:62) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.xpack.security.authc.esnative.NativeUsersStore$2.onResponse(NativeUsersStore.java:212) [x-pack-security-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:43) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.TransportAction$1.onResponse(TransportAction.java:68) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.TransportAction$1.onResponse(TransportAction.java:64) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:43) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:265) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$AsyncSingleAction$2.handleResponse(TransportSingleShardAction.java:251) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1101) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.transport.TransportService$DirectResponseChannel.processResponse(TransportService.java:1182) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:1162) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.transport.TaskTransportChannel.sendResponse(TaskTransportChannel.java:54) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:47) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.ChannelActionListener.onResponse(ChannelActionListener.java:30) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.action.support.single.shard.TransportSingleShardAction$1.doRun(TransportSingleShardAction.java:112) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:758) [elasticsearch-7.3.1.jar:7.3.1]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.3.1.jar:7.3.1]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:835) [?:?]

In logs it says 'Authentication to realm default_native failed - Password authentication failed for kibana_anonymous' I rechecked multiple times to make sure password is correct but still i'm getting this error. (Manual login through same credentials work)

I generated that base64 with following command:

echo -n username:password | base64

stefws · November 21, 2019, 12:15pm

Am using successfully these settings in our nginx proxy:

auth_basic "Only for authorized personal";
auth_basic_user_file <pwd file>;

# all proxy keys goes in our location section
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_no_cache "0";
proxy_cache_bypass $http_authorization;

Dunno if this help U

elk11 · November 21, 2019, 6:17pm

Thanks for sharing. But what's weird is when i create a user through UI, adding authorization header through nginx works amazingly. The problem is when i create a user though API.

I created user using the following curl command:

curl --insecure -X POST -u elastic "https://localhost:9200/_security/user/kibana_anonymous?pretty" -H 'Content-Type: application/json' -d'
{
  "password" : "anonymous",
  "roles" : [ "kibana_anonymous" ]
}
'

Does that mean users created using elasticsearch endpoint cannot login through headers? (I can login through UI though) If that's the case is there a Kibana API to create users? (I haven't found any)

stefws · November 22, 2019, 5:41am

Doesn’t seem so from the Kibana REST API doc, I’m not sure a Kibana User is the same as an Elastic User like the Kibana yaml is configured with to access the Elastic cluster it self.

Also note The Note under roles here

elk11 · November 22, 2019, 6:05am

I think the problem was i had assigned elasticsearch anonymous role to the user in addition to a kibana role. I modified kibana role itself and added 'run_as' to have a value of elasticsearch anonymous user. (It worked for me but not sure if it is the actual cause)

When i created user with above changes to same endpoint as described above, i could login through nginx without any problem.

stefws · November 22, 2019, 6:45am

Ok so elastic users are also what kibana authenticates against. Then there's the management of assigned Kibana Spaces, Index Patterns etc. but assume this could all be managed through the kibana API with kibana roles. Wouldn't it also be possible to authenticate users against a ldap/Microsoft DS...

system · December 20, 2019, 6:45am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.