# How to pass token (any type) to the ES(xpack) instead of userNamePassword?

**URL:** <https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390>\
**Category:** Elasticsearch\
**Created:** [December 5, 2017, 4:01pm UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390 "2017-12-05T16:01:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hym](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hym/32/22399_2.png) [@hym](https://discuss.elastic.co/u/hym)\
**Post date:** [December 5, 2017, 4:01pm UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390/1 "2017-12-05T16:01:12Z")

</div>

Hi,

I've worked by xpack security and its custom realms with its basic definitions as well as run-as feature.  
But what I am looking for now, is passing on the token (like SAML) to the ES and then parse that token to authenticate the request.

How can I pass this token to the ES and have access to it in my custom realm? Can I have my own custom headers in the request which hands this token?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 6, 2017, 12:32am UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390/2 "2017-12-06T00:32:56Z")

</div>

There's a couple of different ways to interpret your question, and I'm not sure which one you're looking for.

Can you clarify which of these you mean (or something else entirely)

- How to pass custom headers from Kibana to Elasticsearch
- How to read customer headers within the Java code of an Elasticsearch custom realm

---

<div class="post-metadata">

**Author:** ![hym](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hym/32/22399_2.png) [@hym](https://discuss.elastic.co/u/hym)\
**Post date:** [December 6, 2017, 9:17am UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390/3 "2017-12-06T09:17:08Z")

</div>

In this case, Kibana doesn't play any role then I don't want to pass on something throw Kibana.

Just think I'm calling the ES directly with curl or my application. My question is this could I send the token (let's say SAML) by header and get access to that in the custom realm code and use that for Authentication and maybe use to discover the roles.

Thanks

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 6, 2017, 9:45am UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390/4 "2017-12-06T09:45:52Z")

</div>

In which case, that's fine.

You implement `getRestHeaders` in your extension class, and list the headers that you want to use in your realm [(example)](https://github.com/elastic/shield-custom-realm-example/blob/master/src/main/java/org/elasticsearch/example/CustomRealmExtension.java#L57-L60).

Then in your realm, in the `token` method, you can get access to that header through the `ThreadContext` [(example)](https://github.com/elastic/shield-custom-realm-example/blob/master/src/main/java/org/elasticsearch/example/realm/CustomRealm.java#L103).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2018, 9:46am UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390/5 "2018-01-03T09:46:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.