# Custom Realm - Building UsernamePasswordToken **URL:** \ **Category:** Elasticsearch\ **Created:** [April 18, 2017, 10:53am UTC](https://discuss.elastic.co/t/custom-realm-building-usernamepasswordtoken/82699 "2017-04-18T10:53:02Z")\ **Posts on this page:** 1\ **Showing post:** 5
**Author:** ![jhn134910](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jhn134910](https://discuss.elastic.co/u/jhn134910)\ **Post date:** [April 20, 2017, 1:29pm UTC](https://discuss.elastic.co/t/custom-realm-building-usernamepasswordtoken/82699/5 "2017-04-20T13:29:36Z")
I realize now that there is a further problem with this higher up the stack. Even though my plugin successfully authenticates against a third party user-store, no kibana cookie is created so the browser can detect that I'm authenticated. Is it my responsibility to create the kibana cookie? I read some where that the structure of the cookie is not advertised as you guys reserve the right to change the structure in the future and to I don't want my plugin to then break. This is a duplicate of a question already asked but not answered > [@Session Cookie with Custom Realm Plugin (kibana or es directly)](https://discuss.elastic.co/t/session-cookie-with-custom-realm-plugin-kibana-or-es-directly/72103): > > I have created a simple realm plugin and I am not seeing a session cookie being created when authenticating. Is there something special I need to do in the plugin to support the sessions? Which method in the interface is supposed to do this? The basic auth example on github is not clear. According to: [https://github.com/elastic/kibana/issues/3904](https://github.com/elastic/kibana/issues/3904) I should see the browser getting a cookie with username:password:timestamp There is also a property to support shield.sessionTimeout in ki… --- _[View the full topic](https://discuss.elastic.co/t/custom-realm-building-usernamepasswordtoken/82699)._