I have elasticsearch 5.5.1 working with xpack. If I make a call to one of my indexs via postman setting the authorization to basic and providing the username and password I receive the correct data as expected.
I now move the same search into an ajax call in the following way in a classic asp page.
I have ensured through IIS, the user 'elastic' has permissions to the site. When it hit's the runat=server line, It crashes with the user doesn't have the correct security permissions. If I leave this the runat=server command off, then it doesn't run at all.