# ElasticSearch 7.3 basic authentication giving 403 Forbidden

**URL:** <https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 14, 2019, 2:15am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367 "2019-10-14T02:15:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinodres](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinodres/32/50379_2.png) [@vinodres](https://discuss.elastic.co/u/vinodres)\
**Post date:** [October 14, 2019, 2:15am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367/1 "2019-10-14T02:15:40Z")

</div>

I have recently installed ElasticSearch 7.3 basic on single instance of CentOS 7. Before enabling basic security I verified that I was able to access both ElasticSearch and Kibana UI.

Later I followed the exact steps specified at  
[https://www.elastic.co/guide/en/elasticsearch/reference/7.3/get-started-kibana-user.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/get-started-kibana-user.html)

After that I restarted both Elasticsearch and Kibana and verified that both services are active.

When I am trying to access kibana for the first time so that I can add additional users, using [http://mydomain:5601/](http://mydomain:5601/), I am being prompted for login. I entered built in username (kibana) and password that I configured, but I keep getting follow response

{"statusCode":403,"error":"Forbidden","message":"Forbidden"}

Not sure why I am getting this error, even if I am entering correct username and pwd.

Are there any additional steps that I need to perform?

I will really appreciate any help. I am new to Elastic search stack.

Thanks,  
Vinod.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 14, 2019, 11:50am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367/2 "2019-10-14T11:50:47Z")

</div>

if you do not connect to kibana, but try to connect directly to elasticsearch (using curl) with the kibana user and password. does that work?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 14, 2019, 1:22pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367/3 "2019-10-14T13:22:39Z")

</div>

This means that the user you are logging in with has no roles assigned to them.

> [@vinodres](#):
>
> , I am being prompted for login. I entered built in username (kibana) and password that I configured, but I keep getting follow response

`kibana` is an internal user meant to be used by kibana server in order to communicate with elasticsearch and **should not** be used by end users to log in to Kibana. Use the `elastic` user to log in at first , and then go to Management -\> Security -\> Users and create the users and roles that will give access to your users. You can read more about role based access control in our [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/authorization.html)

---

<div class="post-metadata">

**Author:** ![vinodres](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinodres/32/50379_2.png) [@vinodres](https://discuss.elastic.co/u/vinodres)\
**Post date:** [October 14, 2019, 9:20pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367/4 "2019-10-14T21:20:36Z")

</div>

@ikakavas / @spinscale

When I tried to access elasticsearch to list all indexes using kibana user with basic authentication via curl as well as postman, I got the results back.

As @ikakavas suggested, I then used elastic user to login to Kibana and was able to go in without any issues. Thank you both for the helpful tips. Really appreciate it.

-Vinod.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2019, 9:30pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-basic-authentication-giving-403-forbidden/203367/5 "2019-11-11T21:30:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.