# Kibana 6.4 prompting basic authentication after upgrading ELK stack from 5.6 to 6.4

**URL:** <https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085>\
**Category:** Kibana\
**Created:** [January 21, 2019, 4:21pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085 "2019-01-21T16:21:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![preddy75](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@preddy75](https://discuss.elastic.co/u/preddy75)\
**Post date:** [January 21, 2019, 4:21pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085/1 "2019-01-21T16:21:26Z")

</div>

Hi,

We have a large Kubernetes setup that uses ELK for logging. Filebeat-\>Logstash-\>Elasticsearch-\>Kibana (searchguard turned on).

After upgrading Elasticsearch to 6.4 from 5.6 (Kibana still at 5.6) Kibana started prompting us for basic authentication information in an execution path that used to utilize header information from successful login from corporate login page.

Then we turned on KIbana 6.4 and got same behavior. This makes us think that it is Elasticsearch is causing this. I posted our Searchguard plugin configuration below, the Elasticsearch searchguard configuration, and our Kibana configuration (unchanged from version upgrades).

If anyone can shed light it would be greatly appreciated, we have been looking at this for a few days and are stumped.

```
 ----------------------------------

 Searchguard plugin config:

```

searchguard:  
dynamic:  
http:  
xff:  
enabled: false  
internalProxies: 192.168.0.10|192.168.0.11  
remoteIpHeader: "x-forwarded-for"  
proxiesHeader: "x-forwarded-by"  
trustedProxies: "proxy1|proxy2"  
authc:  
authenticaton\_internal:  
enabled: true  
order: 0  
authentication\_backend:  
type: internal  
http\_authenticator:  
type: basic  
authentication\_gl:  
enabled: true  
order: 1  
authentication\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.GlobalLoginAuthenticationBackend  
http\_authenticator:  
type: com.proprietary.searchguard.auth.oursauthstuff.HTTPGlobalLoginAuthenticator  
authentication\_ourauthstuff:  
enabled: true  
order: 2  
authentication\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.OurAuthenticationBackend  
http\_authenticator:  
type: basic  
authz:  
authorization\_ourauthstuff:  
enabled: true  
order: 0  
authorization\_backend:  
type: com.proprietary.searchguard.auth.oursauthstuff.K8sOurStuffAuthorizationBackend

```
------------------------------

Searchguard configuration on Elasticsearch nodes

elasticsearch.yml: |
cluster.name: mycluster
node:
  name: ${HOSTNAME}
  master: false
  data: true
  ingest: ${INGEST_NODE:true}
  max_local_storage_nodes: 1
network:
  host: 0.0.0.0

path:
  data: /usr/share/elasticsearch/data
  logs: /usr/share/elasticsearch/logs

bootstrap:
  memory_lock: true
  system_call_filter: false

http:
  enabled: true
  compression: true
  cors:
    enabled: false
  port: 9200

transport:
  tcp:
    port: 9300

discovery.zen:
  minimum_master_nodes: 3
  ping_timeout: 3s
  ping.unicast.hosts: "elasticsearch-discovery-internal-svc.ourstuff"

# Disable X-Pack components
xpack.security.enabled: false
xpack.watcher.enabled: false
xpack.ml.enabled: false
xpack.graph.enabled: false

thread_pool:
  bulk:
    queue_size: 600

#SGAAF Config
searchguard:
  enterprise_modules_enabled: false
  ssl:
    transport:
      enable_openssl_if_available: true
      enabled: true
      keystore_type: JKS
      keystore_filepath: <keystore path -- removed for posting>
      keystore_password: ${KEYSTORE_PASSWORD}
      truststore_type: JKS
      truststore_filepath: <truststore path -- removed for posting>
      truststore_password: ${TRUSTSTORE_PASSWORD}
      enforce_hostname_verification: false
    http:
      enable_openssl_if_available: true
      enabled: true
      keystore_type: JKS
      keystore_filepath: <keystore path -- removed for posting>
      keystore_password: ${KEYSTORE_PASSWORD}
      truststore_type: JKS
      truststore_filepath: <truststore path -- removed for posting>
      truststore_password: ${TRUSTSTORE_PASSWORD}

  # Admin users
  authcz.admin_dn:
  - <removed for posting> 

```

* * *

```
Below is our kibana.yml configuration (cleansed for this post):

server:
  host: "0.0.0.0"
  name: kibana
  basePath: "/kibana"

xpack.reporting.encryptionKey: <removed for posting>

xpack.apm.ui.enabled: false
xpack.grokdebugger.enabled: false
xpack.searchprofiler.enabled: false
  
xpack.security.enabled: false
xpack.graph.enabled: false
xpack.ml.enabled: false
xpack.watcher.enabled: false

searchguard.basicauth.login.title: "Kibana Login"
searchguard.basicauth.login.subtitle: "Please enter your Global Login credentials."

elasticsearch:
  url: "https://elasticsearch-http-internal-svc.com-ourstuff-elkpaas:9200"
  preserveHost: true
  ssl:
    verificationMode: none
  requestTimeout: 3000000
  pingTimeout: 3000000
  requestHeadersWhitelist: ['authorization', 'cookie']

kibana:
  index: ".kibana"
  defaultAppId: "discover"

ops.interval: 5000
console.enabled: false
```

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [January 21, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085/2 "2019-01-21T16:29:04Z")

</div>

Hello,

I am not sure how searchguard works.

These are upgrade docs: [https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html](https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html)

We also need to generate passwords: [https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-passwords.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-passwords.html)

Please note searchguard is a commercial independent plugin and we don't support it.

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![preddy75](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@preddy75](https://discuss.elastic.co/u/preddy75)\
**Post date:** [January 21, 2019, 5:34pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085/3 "2019-01-21T17:34:10Z")

</div>

Thank you. Looking at this now, but we have passwords generated for all elk components. Having a look at the links you posted.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 5:34pm UTC](https://discuss.elastic.co/t/kibana-6-4-prompting-basic-authentication-after-upgrading-elk-stack-from-5-6-to-6-4/165085/4 "2019-02-18T17:34:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.