# Kibana 6.4 prompting basic authentication after upgrading Elasticsearch from 5.6 to 6.4

**URL:** <https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086>\
**Category:** Elasticsearch\
**Created:** [January 21, 2019, 4:25pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086 "2019-01-21T16:25:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![preddy75](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@preddy75](https://discuss.elastic.co/u/preddy75)\
**Post date:** [January 21, 2019, 4:25pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086/1 "2019-01-21T16:25:54Z")

</div>

Hi,

We have a large Kubernetes setup that uses ELK for logging. Filebeat-\>Logstash-\>Elasticsearch-\>Kibana (searchguard turned on).

After upgrading Elasticsearch to 6.4 from 5.6 (Kibana still at 5.6) Kibana started prompting us for basic authentication information in an execution path that used to utilize header information from successful login from corporate login page.

Then we turned on KIbana 6.4 and got same behavior. This makes us think that it is Elasticsearch is causing this. I posted our Searchguard plugin configuration below, the Elasticsearch searchguard configuration, and our Kibana configuration (unchanged from version upgrades).

If anyone can shed light it would be greatly appreciated, we have been looking at this for a few days and are stumped.

We do not see any difference in logs in the 5.6 and 6.4 flows.

* * *

Searchguard plugin config:

searchguard:  
dynamic:  
http:  
xff:  
enabled: false  
internalProxies: 192.168.0.10|192.168.0.11  
remoteIpHeader: "x-forwarded-for"  
proxiesHeader: "x-forwarded-by"  
trustedProxies: "proxy1|proxy2"  
authc:  
authenticaton\_internal:  
enabled: true  
order: 0  
authentication\_backend:  
type: internal  
http\_authenticator:  
type: basic  
authentication\_gl:  
enabled: true  
order: 1  
authentication\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.GlobalLoginAuthenticationBackend  
http\_authenticator:  
type: com.proprietary.searchguard.auth.oursauthstuff.HTTPGlobalLoginAuthenticator  
authentication\_ourauthstuff:  
enabled: true  
order: 2  
authentication\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.OurAuthenticationBackend  
http\_authenticator:  
type: basic  
authz:  
authorization\_ourauthstuff:  
enabled: true  
order: 0  
authorization\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.K8sOurStuffAuthorizationBackend

```
  ---------------------------------

Searchguard configuration on Elasticsearch nodes

elasticsearch.yml: |
cluster.name: mycluster
node:
  name: ${HOSTNAME}
  master: false
  data: true
  ingest: ${INGEST_NODE:true}
  max_local_storage_nodes: 1
network:
  host: 0.0.0.0

path:
  data: /usr/share/elasticsearch/data
  logs: /usr/share/elasticsearch/logs

bootstrap:
  memory_lock: true
  system_call_filter: false

http:
  enabled: true
  compression: true
  cors:
    enabled: false
  port: 9200

transport:
  tcp:
    port: 9300

discovery.zen:
  minimum_master_nodes: 3
  ping_timeout: 3s
  ping.unicast.hosts: "elasticsearch-discovery-internal-svc.ourstuff"

# Disable X-Pack components
xpack.security.enabled: false
xpack.watcher.enabled: false
xpack.ml.enabled: false
xpack.graph.enabled: false

thread_pool:
  bulk:
    queue_size: 600

#SGAAF Config
searchguard:
  enterprise_modules_enabled: false
  ssl:
    transport:
      enable_openssl_if_available: true
      enabled: true
      keystore_type: JKS
      keystore_filepath: <keystore path -- removed for posting>
      keystore_password: ${KEYSTORE_PASSWORD}
      truststore_type: JKS
      truststore_filepath: <truststore path -- removed for posting>
      truststore_password: ${TRUSTSTORE_PASSWORD}
      enforce_hostname_verification: false
    http:
      enable_openssl_if_available: true
      enabled: true
      keystore_type: JKS
      keystore_filepath: <keystore path -- removed for posting>
      keystore_password: ${KEYSTORE_PASSWORD}
      truststore_type: JKS
      truststore_filepath: <truststore path -- removed for posting>
      truststore_password: ${TRUSTSTORE_PASSWORD}

  # Admin users
  authcz.admin_dn:
  - <removed for posting> 

```

* * *

```
Below is our kibana.yml configuration (cleansed for this post):

server:
  host: "0.0.0.0"
  name: kibana
  basePath: "/kibana"

xpack.reporting.encryptionKey: <removed for posting>

xpack.apm.ui.enabled: false
xpack.grokdebugger.enabled: false
xpack.searchprofiler.enabled: false
  
xpack.security.enabled: false
xpack.graph.enabled: false
xpack.ml.enabled: false
xpack.watcher.enabled: false

searchguard.basicauth.login.title: "Kibana Login"
searchguard.basicauth.login.subtitle: "Please enter your Global Login credentials."

elasticsearch:
  url: "https://elasticsearch-http-internal-svc.com-ourstuff-elkpaas:9200"
  preserveHost: true
  ssl:
    verificationMode: none
  requestTimeout: 3000000
  pingTimeout: 3000000
  requestHeadersWhitelist: ['authorization', 'cookie']

kibana:
  index: ".kibana"
  defaultAppId: "discover"

ops.interval: 5000
console.enabled: false
```

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [January 21, 2019, 4:48pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086/2 "2019-01-21T16:48:52Z")

</div>

Try setting this in your elasticsearch.yml

```
xpack.security.enabled: false
```

---

<div class="post-metadata">

**Author:** ![preddy75](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@preddy75](https://discuss.elastic.co/u/preddy75)\
**Post date:** [January 21, 2019, 5:32pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086/3 "2019-01-21T17:32:53Z")

</div>

Thank you. We already had that set in our elasticsearch.yml (I posted above).

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 22, 2019, 1:54am UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086/4 "2019-01-22T01:54:09Z")

</div>

Please don't cross post, it makes it much harder for people to help you if they have to jump between different topics 🙂

> [@Kibana 6.4 prompting basic authentication after upgrading ELK stack from 5.6 to 6.4](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085/2):
>
> Hello, I am not sure how searchguard works. These are upgrade docs: [https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html](https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html) We also need to generate passwords: [https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-passwords.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-passwords.html) Please note searchguard is a commercial independent plugin and we don't support it. Thanks, Bhavya

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 22, 2019, 1:54am UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elasticsearch-from-5-6-to-6-4/165086/5 "2019-01-22T01:54:13Z")

</div>