# Canvas doesn't works with SearchGuard

**URL:** <https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625>\
**Category:** Kibana\
**Created:** [July 5, 2018, 4:08am UTC](https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625 "2018-07-05T04:08:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![w33ladalah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/w33ladalah/32/32975_2.png) [@w33ladalah](https://discuss.elastic.co/u/w33ladalah)\
**Post date:** [July 5, 2018, 4:08am UTC](https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625/1 "2018-07-05T04:08:25Z")

</div>

Hello,

I have installed ELK stack with version 6.3.0 and I also install Canvas plugin in Kibana. But it seems does not works because there is authentication issues when Canvas create request to Elasticsearch. I am uses SearchGuard for authentication instead of X-Pack security.

Below is my installation details:

```
1. Elasticsearch
    Version: 6.3.0
    Plugins: - search-guard-6

2. Kibana
    Version: 6.3.0
    Plugins: - canvas@0.1.2015
             - searchguard@6.3.0-13

```

And here is kibana log output:

> common/interpret esdocs: invokeChain rejected { Authentication Exception :: {"path":"/memberbebe/\_search","query":{},"body":"{"\_source":,"query":{"bool":{"must":[{"query\_string":{"query":"-\_index:.kibana"}}]}},"size":100}","statusCode":401,"response":"Unauthorized","wwwAuthenticateDirective":"Basic realm="Search Guard""}  
> at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:307:15)  
> at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:266:7)  
> at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:159:7)  
> at IncomingMessage.bound (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/dist/lodash.js:729:21)  
> at emitNone (events.js:111:20)  
> at IncomingMessage.emit (events.js:208:7)  
> at endReadableNT (\_stream\_readable.js:1064:12)  
> at \_combinedTickCallback (internal/process/next\_tick.js:138:11)  
> at process.\_tickDomainCallback (internal/process/next\_tick.js:218:9)  
> status: 401,  
> displayName: 'AuthenticationException',  
> message: 'Authentication Exception',  
> path: '/xxx/\_search',  
> query: {},  
> body: 'Unauthorized',  
> statusCode: 401,  
> response: 'Unauthorized',  
> wwwAuthenticateDirective: 'Basic realm="Search Guard"',  
> toString: [Function],  
> toJSON: [Function],  
> isBoom: true,  
> isServer: false,  
> data: null,  
> output:  
> { statusCode: 401,  
> payload:  
> { statusCode: 401,  
> error: 'Unauthorized',  
> message: 'Authentication Exception' },  
> headers: { 'WWW-Authenticate': 'Basic realm="Authorization Required"' } },  
> reformat: [Function] }  
> common/interpret esdocs: invokeChain rejected { Authentication Exception :: {"path":"/xxx/\_search","query":{},"body":"{"\_source":,"query":{"bool":{"must":[{"query\_string":{"query":"-\_index:.kibana"}}]}},"size":100}","statusCode":401,"response":"Unauthorized","wwwAuthenticateDirective":"Basic realm="Search Guard""}  
> at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:307:15)  
> at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:266:7)  
> at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:159:7)  
> at IncomingMessage.bound (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/dist/lodash.js:729:21)  
> at emitNone (events.js:111:20)  
> at IncomingMessage.emit (events.js:208:7)  
> at endReadableNT (\_stream\_readable.js:1064:12)  
> at \_combinedTickCallback (internal/process/next\_tick.js:138:11)  
> at process.\_tickDomainCallback (internal/process/next\_tick.js:218:9)  
> status: 401,  
> displayName: 'AuthenticationException',  
> message: 'Authentication Exception',  
> path: '/xxx/\_search',  
> query: {},  
> body: 'Unauthorized',  
> statusCode: 401,  
> response: 'Unauthorized',  
> wwwAuthenticateDirective: 'Basic realm="Search Guard"',  
> toString: [Function],  
> toJSON: [Function],  
> isBoom: true,  
> isServer: false,  
> data: null,  
> output:  
> { statusCode: 401,  
> payload:  
> { statusCode: 401,  
> error: 'Unauthorized',  
> message: 'Authentication Exception' },  
> headers: { 'WWW-Authenticate': 'Basic realm="Authorization Required"' } },  
> reformat: [Function] }  
> common/interpret esdocs: invokeChain rejected { Authentication Exception :: {"path":"/xxx/\_search","query":{},"body":"{"\_source":,"query":{"bool":{"must":[{"query\_string":{"query":"-\_index:.kibana"}}]}},"size":100}","statusCode":401,"response":"Unauthorized","wwwAuthenticateDirective":"Basic realm="Search Guard""}  
> at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:307:15)  
> at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:266:7)  
> at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:159:7)  
> at IncomingMessage.bound (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/dist/lodash.js:729:21)  
> at emitNone (events.js:111:20)  
> at IncomingMessage.emit (events.js:208:7)  
> at endReadableNT (\_stream\_readable.js:1064:12)  
> at \_combinedTickCallback (internal/process/next\_tick.js:138:11)  
> at process.\_tickDomainCallback (internal/process/next\_tick.js:218:9)  
> status: 401,  
> displayName: 'AuthenticationException',  
> message: 'Authentication Exception',  
> path: '/xxx/\_search',  
> query: {},  
> body: 'Unauthorized',  
> statusCode: 401,  
> response: 'Unauthorized',  
> wwwAuthenticateDirective: 'Basic realm="Search Guard"',  
> toString: [Function],  
> toJSON: [Function],  
> isBoom: true,  
> isServer: false,  
> data: null,  
> output:  
> { statusCode: 401,  
> payload:  
> { statusCode: 401,  
> error: 'Unauthorized',  
> message: 'Authentication Exception' },  
> headers: { 'WWW-Authenticate': 'Basic realm="Authorization Required"' } },  
> reformat: [Function] }

How I can solve this issue? Any suggestions?

Thank you

---

<div class="post-metadata">

**Author:** ![w33ladalah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/w33ladalah/32/32975_2.png) [@w33ladalah](https://discuss.elastic.co/u/w33ladalah)\
**Post date:** [July 5, 2018, 9:34am UTC](https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625/2 "2018-07-05T09:34:54Z")

</div>

Finally, I found temporary solution for this issue by myself.

I am editing file _/plugins/canvas/server/routes/socket.js_ in line 37:  
`if (server.plugins.security) request.headers.authorization = authHeader;`  
to:  
`request.headers.authorization = "Basic <HASHED_USER_PASS>";`

The **\<HASHED\_USER\_PASS\>** is **SearchGuard Username** : **SearchGuard Password** encoded with Base64.

I know that my solution maybe not the best solution and need to be improved but I hope it can help other users with the same issue.

Thanks.

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [July 5, 2018, 1:36pm UTC](https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625/3 "2018-07-05T13:36:54Z")

</div>

Glad you worked out your issue and thanks so much for posting your solution. As you say, it might help someone else with the same problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2018, 1:43pm UTC](https://discuss.elastic.co/t/canvas-doesnt-works-with-searchguard/138625/4 "2018-08-02T13:43:39Z")

</div>

Closed on August 2, 2018, 1:43pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.