# \[Google Oauth2 Sign-In\] User impersonation alternative using OAuth2 Proxy
**URL:** https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946
**Category:** Kibana
**Created:** [May 24, 2017, 10:32am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946 "2017-05-24T10:32:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@MihaiS](https://discuss.elastic.co/u/MihaiS)
#### Post date: [May 24, 2017, 10:32am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946/1 "2017-05-24T10:32:14Z")
Hello,
I wanted to share to the community a different approach to this great guide [https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana](https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana).
After playing a little bit with Nginx and OAuth2 Proxy I have managed to avoid the user impersonation and give the admin the chance to create accounts for each user in the organization with their associated roles.
Notes:
- Parts of this guide are taken from the user impersonation guide (see link above)
- This guide requires you to manually create the accounts in advance with the same predefined password (work in progress for an automatic creation solution).
- The following guide is based on a installation of Elasticsearch + Kibana 5.4 (SSL configuration enabled on port 8443) + X-Pack plugin from DEB files on a Debian 8.x machine.
- This guide does not cover the security aspects. These should be taken care by you, using your own solutions to properly secure Elasticsearch, Kibana, Oauth2\_proxy and Nginx
* * *
1. After X-Pack plugin installation, uncomment and modify or add the following lines in /etc/kibana/kibana.yml and restart the Kibana service:
2. Install and configure OAuth2 Proxy
- Download prebuilt binary for OAuth2 Proxy: [https://github.com/bitly/oauth2\_proxy/releases](https://github.com/bitly/oauth2_proxy/releases)
- Put the binary from the archive in the /usr/local/bin folder
- Create configuration folders:
- Create the configuration file for the oauth2\_proxy service (/etc/oauth2\_proxy/oauth2\_proxy.cfg):
- Check the tutorial at [https://github.com/bitly/oauth2\_proxy#google-auth-provider](https://github.com/bitly/oauth2_proxy#google-auth-provider) in order to create the Google project for authentication in order to obtain the google client\_id and client\_secret
- Create the systemd script in order to start the OAuth2\_Proxy service (/usr/lib/systemd/system/oauth2\_proxy.service):
- Optional: create the template files sign\_in.html and error.html in the etc/oauth2\_proxy/templates folder based on the ones defined here [https://github.com/bitly/oauth2\_proxy/blob/master/templates.go](https://github.com/bitly/oauth2_proxy/blob/master/templates.go)
- Enable the Oauth2 Proxy service:
- Start the service:
1. Build, install, configure and start NGINX
- Install packages required to make builds from source:
- Create the folder where the nginx will be built:
- Download the source packages:
- Extract the packages:
- Build and install nginx:
- Create the systemd service script (/lib/systemd/system/nginx.service):
..................................................
---
### Author:  [@MihaiS](https://discuss.elastic.co/u/MihaiS)
#### Post date: [May 24, 2017, 10:33am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946/2 "2017-05-24T10:33:40Z")
- Create NGINX configuration folders:
- Update the NGINX configuration file (/opt/nginx/conf/nginx.conf)
- Create the NGINX proxy configuration file (/opt/nginx/conf/sites-available/oauth2\_proxy):
- Create a symlink of the file /opt/nginx/conf/sites-available/oauth2\_proxy in the folder /opt/nginx/conf/sites-enabled
- Enable the NGINX service
- Start the NGINX service
1. Create the Kibana usernames identicals to the ones from the email addresses:
- Connect to Kibana server using the address [https://kibana.example.com:8443](https://kibana.example.com:8443) with a superuser account and create the users as in the following example:
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 25, 2017, 9:53am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946/3 "2017-05-25T09:53:00Z")
Thanks for sharing!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2017, 9:53am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946/4 "2017-06-22T09:53:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.