# Getting 401 first time and able to login in same session in second attempt
**URL:** https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524
**Category:** Kibana
**Created:** [November 6, 2023, 1:17pm UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524 "2023-11-06T13:17:53Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@amitkumar.gupta](https://discuss.elastic.co/u/amitkumar.gupta)
#### Post date: [November 6, 2023, 1:17pm UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524/1 "2023-11-06T13:17:53Z")
I am implementing SSO with elastic/Kibana. and using Wso2 credential to login.
When i login first time, i see 401, below is the curl i can copy from browser.
curl '[http://server1.local:5601/api/security/oidc/callback?code=6b7b7efe-6e11-3557-af93-00be8ef62f84&state=4LY5rrjyuveeL0erJVH9hjIOiGsCTUEOMG6fdb2vB5A&session\_state=446911a32e14d4ff754cb95ab4390708a2257299982e30c7b0f7fc9092e9dfe1.5Do94CoZTboiROzD\_546WA](http://server1.local:5601/api/security/oidc/callback?code=6b7b7efe-6e11-3557-af93-00be8ef62f84&state=4LY5rrjyuveeL0erJVH9hjIOiGsCTUEOMG6fdb2vB5A&session_state=446911a32e14d4ff754cb95ab4390708a2257299982e30c7b0f7fc9092e9dfe1.5Do94CoZTboiROzD_546WA)'
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,_/_;q=0.8,application/signed-exchange;v=b3;q=0.7'
-H 'Accept-Language: en-US,en;q=0.9'
-H 'Cache-Control: no-cache'
-H 'Connection: keep-alive'
-H 'Pragma: no-cache'
-H 'Upgrade-Insecure-Requests: 1'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36'
--compressed
--insecure
Second time if i click on login, i am allowed to login and i can see home page without providing user name/password, same session allowed me to login.
curl '[http://server1.local:5601/api/security/oidc/callback?code=39a99484-c52f-39fc-98c5-0d9f3dd06906&state=shckd4H0K8upFL1jSR7jjrTOYZCezYaolHxGT\_2IQqA&session\_state=91ae5a5ce2b392af48ce918febf1c7d79364d8f84977e4538f57a5894fe34aa9.G6\_8ishplImP0ah86-U\_fw](http://server1.local:5601/api/security/oidc/callback?code=39a99484-c52f-39fc-98c5-0d9f3dd06906&state=shckd4H0K8upFL1jSR7jjrTOYZCezYaolHxGT_2IQqA&session_state=91ae5a5ce2b392af48ce918febf1c7d79364d8f84977e4538f57a5894fe34aa9.G6_8ishplImP0ah86-U_fw)'
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,_/_;q=0.8,application/signed-exchange;v=b3;q=0.7'
-H 'Accept-Language: en-US,en;q=0.9'
-H 'Cache-Control: no-cache'
-H 'Connection: keep-alive'
-H 'Cookie: sid=Fe26.2 **73f674f475e9c98fb95a2096d53cfe116e64ae44f835937d8fc9f223f9c4395e_2WJ7Of7edH-it5ghCN6KGA_ps924BFE311bNbuKOmCyq36ORD8G2oAvoDzGpwVYb\_WAuh95cv4BZsg-dLejEmPPU28OQJHvc60GeGB0XRP\_Kc8cS2UvSmtnrTGrmvXBY5xbYI519ikeYJT3Xn3X-29wpB9B-cHgAavmD4uYQ6L3q566C6wFhu\_sGuWbyPH3UtWZh023CI9Jdiih2e2XQyDFCaplaa7baC88hGdBhxqWTsP4d-zG4r7qp-UdYlPTyfwI9f\_vrBTsxg36CTPBj36V** dcc97fef4bf14e70cf6bdac67ea4e34f489bc80020517299991e3a094198ef3f\*uRL9k1cjIXl-F0JvFETtAnHzJC03e9UqnvVEZtokSoA'
-H 'Pragma: no-cache'
-H 'Referer: [http://vlmazccmockdev2.fisdev.local:5601/login?msg=UNAUTHENTICATED&next=%2F'](http://vlmazccmockdev2.fisdev.local:5601/login?msg=UNAUTHENTICATED&next=%2F%27)
-H 'Upgrade-Insecure-Requests: 1'
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36'
--compressed
--insecure
Can someone please confirm what configuration i should check.
I am trying to implement SSO.
---
### Author:  [@Chenhui\_Wang](https://discuss.elastic.co/u/Chenhui_Wang)
#### Post date: [November 7, 2023, 6:00am UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524/2 "2023-11-07T06:00:00Z")
Hi Amit,
I think this post is related to Kibana, so I moved it here so you can get a better response.
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [November 7, 2023, 10:03am UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524/3 "2023-11-07T10:03:28Z")
Hi @amitkumar.gupta,
Are you following through [this ELK SSO](https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-guide-stack.html) guide? I would take a look at the `elasticsearch.yml` configuration [as per this section of the guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-guide-stack.html#saml-create-realm).
Let us know if that helps.
---
### Author:  [@amitkumar.gupta](https://discuss.elastic.co/u/amitkumar.gupta)
#### Post date: [November 7, 2023, 11:42am UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524/4 "2023-11-07T11:42:53Z")
Hey, thanks for your input.
I am using guide provided by wso2 for integration..
[https://apim.docs.wso2.com/en/latest/api-analytics/on-prem/elk-installation-guide/](https://apim.docs.wso2.com/en/latest/api-analytics/on-prem/elk-installation-guide/)
below is the full file -
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# [Elasticsearch Guide | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/index.html)
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory\_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
#network.host: 192.168.0.1
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed\_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial\_master\_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# --------------------------------- Readiness ----------------------------------
#
# Enable an unauthenticated TCP readiness endpoint on localhost
#
#readiness.port: 9399
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive\_requires\_name: false
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically
# generated to configure Elasticsearch security features on 08-02-2023 07:34:15
#
# --------------------------------------------------------------------------------
# Enable security features
#xpack.security.autoconfiguration.enabled: true
xpack.security.enabled: true
#xpack.security.authc.api\_key.enabled: true
xpack.security.enrollment.enabled: false
xpack.security.authc.token.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: false
keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: false
verification\_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial\_master\_nodes: ["server2"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
ingest.geoip.downloader.enabled: false
xpack.security.authc.realms.oidc.oidc1:
order: 1
rp.client\_id: "a3xWuyoswA8rQsjbmghsz6LJyfoa"
rp.response\_type: code
rp.redirect\_uri: "[http://server2.local:5601/api/security/oidc/callback](http://server2.local:5601/api/security/oidc/callback)"
op.issuer: "[https://server1.local:9443/oauth2/token](https://server1.local:9443/oauth2/token)"
rp.requested\_scopes: profile
#op.issuer: "[https://server1.local:9443/oauth2/token](https://server1.local:9443/oauth2/token)"
op.authorization\_endpoint: "[https://vlmazccmockdev1.fisdev.local:9443/oauth2/authorize](https://vlmazccmockdev1.fisdev.local:9443/oauth2/authorize)"
op.token\_endpoint: "[https://server1.local:9443/oauth2/token](https://server1.local:9443/oauth2/token)"
op.jwkset\_path: "[https://server1.local:9443/oauth2/jwks](https://server1.local:9443/oauth2/jwks)"
op.endsession\_endpoint: "[https://server1.local:9443/oidc/logout](https://server1.local:9443/oidc/logout)"
op.userinfo\_endpoint: "[https://server1.local:9443/oauth2/userinfo](https://server1.local:9443/oauth2/userinfo)"
rp.post\_logout\_redirect\_uri: "[http://server2.local:5601/security/logged\_out](http://server2.local:5601/security/logged_out)"
claims.principal: sub
claims.groups: groups
ssl.verification\_mode: none
claims.name: name
claims.mail: email
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 5, 2023, 11:43am UTC](https://discuss.elastic.co/t/getting-401-first-time-and-able-to-login-in-same-session-in-second-attempt/346524/5 "2023-12-05T11:43:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.