# Embedded Kibana auto login **URL:** \ **Category:** Kibana\ **Created:** [October 15, 2019, 1:26pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656 "2019-10-15T13:26:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nickgregz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickgregz/32/54533_2.png) [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Post date:** [October 15, 2019, 1:26pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/1 "2019-10-15T13:26:30Z")
There have been multiple threads on this topic but most of them seem to circle around the same answers with contradicting official statements. I want to auto-login users to a Kibana dashboard from a web app. I have enabled x-pack security and tried to get the auth cookie with an ajax request before showing the dashboard but unfortunately, I get the preflight CORS error: OPTIONS with code 404. There is an official response in [this](https://discuss.elastic.co/t/elasticcloud-kibana-iframe-auto-authentication-cors/147001) thread saying that this is not supported, and an unofficial thread [here](https://discuss.elastic.co/t/ajax-call-to-open-the-kibana-page/78428/8) suggesting the same. Despite this, there are official responses like in this thread [here](https://discuss.elastic.co/t/auto-authenticate-kibana-5-3-dashboard-embedded-in-iframe/85059/2) suggesting that it can be done setting the kibana.yml values: server.cors: true server.cors.origin: "\*" Adding this removed the 404 problem but the CORS couldn't recognize the headers ('kbn-xsrf') so I used a solution from [here](https://github.com/elastic/kibana/issues/16714) and modified http\_tools.js with: > cors: { additionalHeaders: ['kbn-xsrf','cookie'], origin: ['\*'], credentials: true } which ended up returning 200 OK for OPTIONS and 204 No Content for POST but did not set the cookie in the browser. Another [thread](https://discuss.elastic.co/t/receiving-204-response-but-no-cookie-with-the-api-security-v1-login-endpoint/167534) with an official answer seems to suggest that it can't be done even if you manage to attach the cookie to the browser. Is such an approach even possible taking into account contradicting answers across the board? Another suggested approach is to use an NGINX reverse proxy to add authentication, but wouldn't that mean that every request to Kibana would be authorized and unprotected? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [October 15, 2019, 1:56pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/2 "2019-10-15T13:56:47Z")
Hi @nickgregz, I can confirm that there are only two ways that we recommend for such use case currently: - Use SSO ([SAML](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#saml), [OIDC](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#oidc), Kerberos) or [PKI](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#pki-authentication) - Use reverse proxy in front of Kibana that will be adding `Authorization` header > [@nickgregz](#): > > Another suggested approach is to use an NGINX reverse proxy to add authentication, but wouldn't that mean that every request to Kibana would be authorized and unprotected? Yes, all requests will be made on behalf of a dedicated user. You can of course create a dedicated read-only user with specific set of permissions, privileges etc, but it may not work for your use case. You can also try to [integrate Third Party Auth](https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana). Let me know if you still have questions, Oleg ---
**Author:** ![nickgregz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickgregz/32/54533_2.png) [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Post date:** [October 15, 2019, 2:36pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/3 "2019-10-15T14:36:00Z")
Thank you very much for your answer! I have a couple more questions. The first solution(s) is part of the paid license (Gold and Premium)? So the NGINX solution is just a bypass of security for anyone trying to access Kibana through a URL. There is no way to set up the reverse proxy so it can only let certain requests to Kibana and add the auth header based on received credentials from the client? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [October 15, 2019, 3:08pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/4 "2019-10-15T15:08:19Z")
> [@nickgregz](#): > > The first solution(s) is part of the paid license (Gold and Premium)? Yes, that's correct. > [@nickgregz](#): > > There is no way to set up the reverse proxy so it can only let certain requests to Kibana and add the auth header based on received credentials from the client? Proxies are pretty flexible these days and can attach authz header to a particular set of URLs I believe. But how do you envision passing credentials from the client when Kibana is embedded? ---
**Author:** ![nickgregz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickgregz/32/54533_2.png) [@nickgregz](https://discuss.elastic.co/u/nickgregz)\ **Post date:** [October 15, 2019, 4:43pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/5 "2019-10-15T16:43:02Z")
Thank you, you are right, there is no way of passing credentials or any data if it's embedded. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 12, 2019, 4:43pm UTC](https://discuss.elastic.co/t/embedded-kibana-auto-login/203656/6 "2019-11-12T16:43:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.