# Embed Kibana 7.3.1 in iframe behind nginx?

**URL:** <https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481>\
**Category:** Kibana\
**Created:** [August 30, 2019, 9:15am UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481 "2019-08-30T09:15:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![NetwarSystem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/netwarsystem/32/50862_2.png) [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\
**Post date:** [August 30, 2019, 9:15am UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481/1 "2019-08-30T09:15:37Z")

</div>

I have a single VM with Elastic 7.3.1 and Kibana 7.3.1 - a fresh install, just so I can do this without stepping on production stuff. The system works fine, log in with username and password, that's great. The nginx reverse proxy works fine, can log in through it, but trying to add an automatic authorization header has been fruitless.

Here is the current config:

server {  
listen 80;  
server\_name [elk.netwarsystem.com](http://elk.netwarsystem.com);  
access\_log /var/log/nginx/elk.access.log;  
location / {  
proxy\_pass [http://192.168.88.124:5601](http://192.168.88.124:5601);  
proxy\_http\_version 1.1;  
proxy\_set\_header Upgrade $http\_upgrade;  
proxy\_set\_header Connection 'upgrade';  
proxy\_set\_header Host $host;  
proxy\_cache\_bypass $http\_upgrade;  
proxy\_set\_header Authorization "Basic c3R1cGlkd2ViOnN0dXBpZHdlYgo=";  
}  
}

I know what the first and last ones do - the proxy pass itself, and a base64 encoded string of "username:password" for Authorization. The rest I have copied from various posts I have read, doesn't seem to help/harm.

Here is the error I get:

{"statusCode":401,"error":"Unauthorized","message":"[security\_exception] unable to authenticate user [stupidweb] for REST request [/\_security/\_authenticate], with { header={ WWW-Authenticate="Basic realm=\"security\" charset=\"UTF-8\"" } }"}

I have this in both elasticsearch.yml and kibana.yml.

xpack.security.enabled: true

if I use the following curl and enter the password, no problems here.

curl -u stupidweb '[http://localhost:9200/\_xpack/security/\_authenticate?pretty](http://localhost:9200/_xpack/security/_authenticate?pretty)'

If I access Kibana directly I can log in with the username and password.

This really seems like something that should be written up and pinned in the Kibana support area - there are dozens of posts on it, none of them are particularly clear, none end with a solid answer containing all config files, etc, etc.

---

<div class="post-metadata">

**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\
**Post date:** [August 30, 2019, 5:17pm UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481/2 "2019-08-30T17:17:42Z")

</div>

Hi @NetwarSystem -

I'm assuming the credentials in your example aren't real, but just to double-check, is your base64 string in the `Authorization` header definitely correct?

e.g.

```auto
atob('c3R1cGlkd2ViOnN0dXBpZHdlYgo=')
"stupidweb:stupidweb
"

```

```auto
btoa('stupidweb:stupidweb')
"c3R1cGlkd2ViOnN0dXBpZHdlYg=="

```

Might be worth double-checking this just to be safe.

---

<div class="post-metadata">

**Author:** ![NetwarSystem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/netwarsystem/32/50862_2.png) [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\
**Post date:** [August 30, 2019, 5:24pm UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481/3 "2019-08-30T17:24:20Z")

</div>

Real credentials, fake host name, and nothing of consequence on it even if it were guessed.

And you nailed it - working now, tyvm.

---

<div class="post-metadata">

**Author:** ![NetwarSystem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/netwarsystem/32/50862_2.png) [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\
**Post date:** [August 30, 2019, 10:27pm UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481/4 "2019-08-30T22:27:00Z")

</div>

It worked **ONCE** , and now I get this:

[2019-08-30T15:23:35,681][WARN][o.e.x.s.a.AuthenticationService] [bleh] An exception occurred while attempting to find authentication credentials  
org.elasticsearch.ElasticsearchSecurityException: invalid basic authentication header encoding  
at org.elasticsearch.xpack.core.security.support.Exceptions.authenticationError(Exceptions.java:18) ~[x-pack-core-7.3.1.jar:7.3.1]  
at org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken.extractToken(UsernamePasswordToken.java:108) ~[x-pack-core-7.3.1.jar:7.3.1]  
at

**\> MUCH CLIPPING TO PLEASE THE FORUM .**

io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.MessageToMessageCodec.channelRead(MessageToMessageCodec.java:111) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:323) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:297) [netty-codec-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:287) [netty-handler-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1408) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:930) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:682) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:582) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:536) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496) [netty-transport-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:906) [netty-common-4.1.36.Final.jar:4.1.36.Final]  
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.36.Final.jar:4.1.36.Final]  
at java.lang.Thread.run(Thread.java:835) [?:?]  
Caused by: java.lang.IllegalArgumentException: Last unit does not have enough valid bits  
at java.util.Base64$Decoder.decode0(Base64.java:763) ~[?:?]  
at java.util.Base64$Decoder.decode(Base64.java:535) ~[?:?]  
at java.util.Base64$Decoder.decode(Base64.java:558) ~[?:?]  
at org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken.extractToken(UsernamePasswordToken.java:106) ~[x-pack-core-7.3.1.jar:7.3.1]  
... 69 more

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2019, 10:27pm UTC](https://discuss.elastic.co/t/embed-kibana-7-3-1-in-iframe-behind-nginx/197481/5 "2019-09-27T22:27:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.