# Enable Kibana Security WITHOUT Elasticsearch security

**URL:** <https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [March 3, 2022, 4:38am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695 "2022-03-03T04:38:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![KrishnaCh](https://avatars.discourse-cdn.com/v4/letter/k/df788c/32.png) [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Post date:** [March 3, 2022, 4:38am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695/1 "2022-03-03T04:38:04Z")

</div>

Hi Team,

Is it possible to enable Kibana level security like creating username and passwords for Kibana login and dashboards (for role level access), **without** enabling the security in Elasticsearch level (username & password) ?

I checked the [documentation](https://www.elastic.co/guide/en/kibana/7.16/using-kibana-with-security.html) and the first point itself states that we need to configure security in Elasticsearch!

The need for this requirement is, if I enable the security in Elasticsearch level, then the application that is connecting to this cluster, will also need to be modified to accommodate the change. Hence just want to check if its possible to have username and passwords for Kibana alone or not?

Thank you.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 3, 2022, 5:56am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695/2 "2022-03-03T05:56:50Z")

</div>

Kibana uses Elasticsearch for its security, there is no concept of security in Kibana without security in Elasticsearch. Kibana would have no way to create users or verify passwords.

You can probably achieve what you're after by enabling security in Elasticsearch and turning on anonymous access so that the existing application continues to work.

---

<div class="post-metadata">

**Author:** ![KrishnaCh](https://avatars.discourse-cdn.com/v4/letter/k/df788c/32.png) [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Post date:** [March 3, 2022, 11:53am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695/3 "2022-03-03T11:53:07Z")

</div>

Oh Okay.  
So I need to enable the anonymous access feature in both Elasticsearch.yml and kibana.yml right?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 4, 2022, 12:19am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695/4 "2022-03-04T00:19:28Z")

</div>

No, just in Elasticsearch. Based on your requirements, I don't think you want anonymous access in Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2022, 12:20am UTC](https://discuss.elastic.co/t/enable-kibana-security-without-elasticsearch-security/298695/5 "2022-04-01T00:20:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.