# Getting access denied error while acessing monitoring tab in kibana

**URL:** https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731
**Category:** Kibana
**Created:** [March 18, 2019, 9:23am UTC](https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731 "2019-03-18T09:23:49Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![arvind297](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@arvind297](https://discuss.elastic.co/u/arvind297)
#### Post date: [March 18, 2019, 9:23am UTC](https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731/1 "2019-03-18T09:23:49Z")

</div>

Hi,

We have set up a dedicated monitoring cluster and saml/filebased authentication is setup for user authentication.

When I connect to kibana through file based authentication user(elk\_user-username) and try to acess the monitoring tab,I am able to access the tab(same user is present in monitoring cluster as well and superuser/monitoring\_user privs has been granted to the user).While for saml authentication I have granted monitoring\_user privileges to all the AD groups present in both monitoring and production cluster.But still I get the below error while logging in through my id.

You are not authorized to access Monitoring. To use Monitoring, you need the privileges granted by both the `kibana_user` and `monitoring_user` roles.

If you are attempting to access a dedicated monitoring cluster, this might be because you are logged in as a user that is not configured on the monitoring cluster.

Please suggest if we can access the monitoring tab with saml authentication with our current setup.If Yes,any changes that has to be done in elasticsearch.yml file or please confirm if the user has to be present in monitoring cluster (through native realm/file based authentication) and we cannot access monitoring tab through saml authentication.

Thanks,  
Aravind

---

<div class="post-metadata">

### Author: ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)
#### Post date: [March 18, 2019, 9:47am UTC](https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731/2 "2019-03-18T09:47:35Z")

</div>

Hi @arvind297,

Looks like you're hitting [this issue](https://github.com/elastic/kibana/issues/21611) and, unfortunately, currently SAML realm doesn't support external monitoring cluster since when you login with SAML you get an elasticsearch security token for the cluster you are logged in to and those tokens are cluster specific (see more details on that issue).

Having said that, it's something that we really would like to solve in the near term.

Best,  
Oleg

---

<div class="post-metadata">

### Author: ![arvind297](https://avatars.discourse-cdn.com/v4/letter/a/71c47a/32.png) [@arvind297](https://discuss.elastic.co/u/arvind297)
#### Post date: [March 18, 2019, 12:21pm UTC](https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731/3 "2019-03-18T12:21:23Z")

</div>

Hi Oleg,

Thanks for the update.

Thanks,  
Aravind

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2019, 12:21pm UTC](https://discuss.elastic.co/t/getting-access-denied-error-while-acessing-monitoring-tab-in-kibana/172731/4 "2019-04-15T12:21:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.