# Kibana 5.3.0 Active Directory authentication

**URL:** <https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289>\
**Category:** Kibana\
**Created:** [April 13, 2017, 12:49pm UTC](https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289 "2017-04-13T12:49:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mk40us](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@mk40us](https://discuss.elastic.co/u/mk40us)\
**Post date:** [April 13, 2017, 12:49pm UTC](https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289/1 "2017-04-13T12:49:04Z")

</div>

Hi,

We would like to setup AD authentication just for Kibana and not setup AD authentication for Elasticsearch or Logstash components. Is that possible?. Can anyone point me towards the direction of setting up AD based authentication just for Kibana?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [April 13, 2017, 3:32pm UTC](https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289/2 "2017-04-13T15:32:19Z")

</div>

hi @mk40us,

you could do this by defining two sets of users. One for the Kibana users (humans I assume), and another for the Elasticsearch/Logstash users (services&processes I'd guess).

The Kibana users you would authenticate using the AD-realm. Ensure each has at least the `kibana_user`-role mapped to the appropriate AD-group, as well as (read/write) access to the required data/indices ([https://www.elastic.co/guide/en/x-pack/current/mapping-roles.html](https://www.elastic.co/guide/en/x-pack/current/mapping-roles.html))

For the ES/Logstash users, use the native realm. So you can create these users with the ES user-api (cf. [https://www.elastic.co/guide/en/x-pack/current/native-realm.html](https://www.elastic.co/guide/en/x-pack/current/native-realm.html)).

Let me know if this is what you're looking for,  
thx,

---

<div class="post-metadata">

**Author:** ![mk40us](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@mk40us](https://discuss.elastic.co/u/mk40us)\
**Post date:** [April 13, 2017, 3:58pm UTC](https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289/3 "2017-04-13T15:58:47Z")

</div>

I am getting authc not allowed error. Can you provide an example config file ?

```
 log [15:56:18.759] [fatal] ValidationError: child "xpack" fails because [child "security" fails because ["authc" is not allowed]]
    at Object.exports.process (/usr/share/kibana/node_modules/joi/lib/errors.js:140:17)
    at internals.Any._validateWithOptions (/usr/share/kibana/node_modules/joi/lib/any.js:649:25)
    at root.validate (/usr/share/kibana/node_modules/joi/lib/index.js:102:23)
    at Config._commit (/usr/share/kibana/src/server/config/config.js:134:38)
    at Config.set (/usr/share/kibana/src/server/config/config.js:104:12)
    at Config.extendSchema (/usr/share/kibana/src/server/config/config.js:74:12)
    at /usr/share/kibana/src/server/plugins/plugin_collection.js:21:10
    at undefined.next (native)
    at step (/usr/share/kibana/src/server/plugins/plugin_collection.js:32:273)
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2017, 4:04pm UTC](https://discuss.elastic.co/t/kibana-5-3-0-active-directory-authentication/82289/4 "2017-05-11T16:04:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.