# Custom authentication with Kibana + Shield **URL:** \ **Category:** Kibana\ **Created:** [February 8, 2016, 3:46pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197 "2016-02-08T15:46:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [February 8, 2016, 3:46pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/1 "2016-02-08T15:46:59Z")
I have a custom Shield plugin working with Elasticsearch that authenticates using a SAML token passed in the HTTP header. I want this authentication scheme work with Kibana as well. Kibana should deny access when the authentication fails and restrict access to Elasticsearch indices as appropriate. Is it possible to configure Kibana to pass the HTTP header contents through to Elasticsearch for authentication? One use case is Kibana users will use a login page that populates the SAML token in the HTTP header then redirects them to Kibana. Kibana should then pass the HTTP Authentication information through to the Elasticsearch + Shield + Custom Realm Plugin on each call. Another option might be upgrading to Kibana 4.4 to get the login screen then modify it using a plugin to authenticated using the SAML token? Any suggestions would be appreciated Thanks Curtis ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [February 8, 2016, 6:33pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/2 "2016-02-08T18:33:03Z")
There isn't any way to configure Kibana to do this today, but it's definitely possible if you want to write a plugin or tweak the source. ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [February 8, 2016, 6:52pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/3 "2016-02-08T18:52:10Z")
Thanks. Would prefer writing a plugin. Would that be a plugin to Shield installed with Kibana or something else? Any sample code or docs available? ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [February 8, 2016, 7:30pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/4 "2016-02-08T19:30:35Z")
Most of the core functionality in Kibana is implemented as plugins, so you can treat them as "sample code". They are available here: [https://github.com/elastic/kibana/tree/master/src/plugins](https://github.com/elastic/kibana/tree/master/src/plugins) Since the Kibana server sends elasticsearch the headers of each request, you probably just need to add an "onRequest" extension to the hapi server so that you can inject headers into each request. example from the [hapi docs](http://hapijs.com/api/8.8.1#serverextevent-method-options): ```auto server.ext('onRequest', function (request, reply) { // Change all requests to '/test' request.setUrl('/test'); return reply.continue(); }); ``` ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [February 9, 2016, 4:44am UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/5 "2016-02-09T04:44:32Z")
@spalger , does the Kibana backend forward all headers to ES from incoming requests? If it does, in theory, this should almost "just work" right? For example, if the client browser has a SSO plugin thingy that adds a custom SAML header to the HTTP requests the browser makes to the Kibana backend, does the Kibana backend attach that header in the request it makes to ES? If it works as described above (and there are several ways it might not), this would probably only be an 80% solution (no functioning logout button, etc), but it would allow the SSO AuthZ/N to work as expected without showing a login screen of any kind. ---
**Author:** ![Marcel\_Matus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcel_matus/32/140970_2.png) [@Marcel\_Matus](https://discuss.elastic.co/u/Marcel_Matus)\ **Post date:** [May 3, 2017, 5:59pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/6 "2017-05-03T17:59:25Z")
@nielsoncr - did you succeeded in your effort to have kibana 4.x working with your SAML realm? I am in the same situation now. There is one option, to upgrade to 5.2+, where custom headers are configurable. But that won't happen anytime soon, and I need to support SAML 2 ASAP on our ES v2.3 version (kibana 4.5.3). Tnx ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [May 3, 2017, 6:22pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/7 "2017-05-03T18:22:08Z")
Our solution ended up being writing a thin proxy installed in front of Kibana that performed automatic redirect to a login page for authentication. SAML information was included in the authorization header which was passed on to the Kibana instance running on the same server connecting to localhost. (i.e. accessing Kibana from an external connection without getting a SAML token from the proxy is prevented) We wrote a shield custom realm plugin and installed it in Elasticsearch which performed further authentication/authorization on the search requests made by Kibana. This solution works, but IMO clumsy and isn’t making for an easy upgrade to 5.3.x. [cid:image003.png@01D27AE2.AAB80570] Curtis Nielson | Software Architect 3M Health Information Systems Div 3M Silver Spring, 12215 Plum Orchard Drive | Silver Spring, MD 20904 Office: 301 281 8352 Mobile: 301 675 3573 [cnielson@mmm.com](mailto:cnielson@mmm.com)[mailto:cnielson@mmm.com](mailto:cnielson@mmm.com) | [www.3M.com](http://www.3M.com)[http://www.3m.com/](http://www.3m.com/) The information contained in this message and any attachments is intended only for the use of the individual or entity to which it is addressed, and may contain information that is PRIVILEGED, CONFIDENTIAL, and exempt from disclosure under applicable law. If you have received this message in error, you are prohibited from copying, distributing, or using the information. Please contact the sender immediately by return e-mail and delete the original message from your system. ![](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e691f96317d2f1028b0501f81f479acb0544fb9.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:32pm UTC](https://discuss.elastic.co/t/custom-authentication-with-kibana-shield/41197/8 "2017-07-06T13:32:03Z")