# Enable xpack autentication on live clusters

**URL:** <https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 25, 2019, 8:14am UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650 "2019-08-25T08:14:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [August 25, 2019, 8:14am UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650/1 "2019-08-25T08:14:03Z")

</div>

Got two live 6.8 clusters both with basic license and no TLS in communication on which I've like to enable authentication. Currently using nginx proxy basic auth on kibana.  
Got multiple data shippers (beats and logstashes) and kibana instances running (one with tribe node to search across both clusters).

Wondering howto best (least downtime for data shippers) to convert this to run with enabled xpack security and authenticate initially with 'elastic local' users and later maybe with ldap/M$ DC authentication when every thing is working.

Only found [this](https://discuss.elastic.co/t/enabling-authentication-for-a-live-cluster/167486)

Anu hints appreciated, TIA!

---

<div class="post-metadata">

**Author:** ![mbelaloui](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbelaloui/32/49140_2.png) [@mbelaloui](https://discuss.elastic.co/u/mbelaloui)\
**Post date:** [August 25, 2019, 5:20pm UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650/2 "2019-08-25T17:20:51Z")

</div>

Hello @stefws,

If I understand correctly, you want to only enable basic user authentication. What I can advise you to do is to configure all your nodes, and add somme crontable rul to restart them all at the same time \<give 1 or 2 minutes of advance to elasticsearch\>.

do some test before to be sure that your configuration is ok 🙂

Mehdi.

---

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [August 25, 2019, 11:49pm UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650/3 "2019-08-25T23:49:38Z")

</div>

@mbelaloui Ok so think I now got both clusters running with xpack security + transport over TLS and have set the default users passwords interactively.

Though I could use logstash\_system user to shipper data from logstash, but maybe only to index patterns logstash-\*? I'm sending to other indicies as well, anyway the superuser elastic seems to work for now.

Where might I find info on the standard users privilliges/roles?

---

<div class="post-metadata">

**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\
**Post date:** [August 26, 2019, 4:09am UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650/4 "2019-08-26T04:09:19Z")

</div>

Hi @stefws,

This would be a good starting point to understand built-in roles and privileges: [https://www.elastic.co/guide/en/elastic-stack-overview/6.8/authorization.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.8/authorization.html)

Regards,  
Yogesh Gaikwad

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2019, 4:09am UTC](https://discuss.elastic.co/t/enable-xpack-autentication-on-live-clusters/196650/5 "2019-09-23T04:09:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.