# Kibana 7.10 login issues
**URL:** https://discuss.elastic.co/t/kibana-7-10-login-issues/255201
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [November 12, 2020, 11:05am UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201 "2020-11-12T11:05:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@KevSex](https://discuss.elastic.co/u/KevSex)
#### Post date: [November 12, 2020, 11:05am UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/1 "2020-11-12T11:05:18Z")
Since upgrading to Elastic stack 7.10, I am now receiving the below error when attempting to POST to `/internal/security/login`
```auto
[root@dev-node-01 ~]# curl -k 'https://127.0.0.1:5601/internal/security/login' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' -H 'Connection: keep-alive' --data 'username= ***&password=***'
{
"statusCode":400,
"error":"Bad Request",
"message":"[request body.providerType]: expected value of type [string] but got [undefined]"
}
```
I had a look at the changelog but couldn't see anything that could explain this.
Any ideas if this change is expected in the new version.
Running this command on previous versions produce a `HTTP/1.1 204 No Content` which works.
Cheers,
Kev
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [November 12, 2020, 1:25pm UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/2 "2020-11-12T13:25:49Z")
Hey, as this is an internal API, changes in accepted payload are not considered breaking changes. Because of this it's possible they won't show up in the release notes.
I reached out to our security team to look into the issue.
---
### Author:  [@azasypkin](https://discuss.elastic.co/u/azasypkin)
#### Post date: [November 12, 2020, 1:45pm UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/3 "2020-11-12T13:45:34Z")
Hey @KevSex,
Yeah, as @flash1293 already noted, it's an internal API and we reserve the right to make any breaking changes to it even though we try hard to not do that without a strong need.
Back to your original question, [here is the definition](https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135) of request body schema:
```auto
schema.object({
providerType: schema.string(),
providerName: schema.string(),
currentURL: schema.string(),
params: schema.conditional(
schema.siblingRef('providerType'),
schema.oneOf([
schema.literal(BasicAuthenticationProvider.type),
schema.literal(TokenAuthenticationProvider.type),
]),
basicParamsSchema,
schema.never()
),
}),
```
So assuming you're using default `xpack.security.autch.providers` config, your request should look like this:
```auto
POST https://localhost:5601/internal/security/login
Accept: application/json
Content-Type: application/json
kbn-xsrf: true
{
"providerType": "basic",
"providerName": "basic",
"currentURL": "/",
"params": { "username": " ***", "password": "***" }
}
```
`providerName` is an arbitrary string and depends on how you configure Kibana, you can read more about this [here](https://www.elastic.co/guide/en/kibana/current/security-settings-kb.html#authentication-security-settings).
We changed the API signature so that it can work with all authentication mechanisms Kibana supports now or will in the future.
Let me know if you have any other questions.
Best,
Oleg
---
### Author:  [@KevSex](https://discuss.elastic.co/u/KevSex)
#### Post date: [November 12, 2020, 2:20pm UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/4 "2020-11-12T14:20:57Z")
Hi @azasypkin,
Thanks for the response.
Yes, I'm using the default authentication provider. I've updated the POST to include these however it now complains that `body.params.username` is undefined yet they are clearly defined. See below:
**Request**
```auto
curl -k --request POST 'https://127.0.0.1:5601/internal/security/login?username= ***&password=***' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--form 'providerType=basic' \
--form 'providerName=basic' \
--form 'currentURL=/'
```
**Response**
```auto
{
"statusCode": 400,
"error": "Bad Request",
"message": "[request body.params.username]: expected value of type [string] but got [undefined]"
}
```
Cheers,
Kev
---
### Author:  [@azasypkin](https://discuss.elastic.co/u/azasypkin)
#### Post date: [November 12, 2020, 2:26pm UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/5 "2020-11-12T14:26:01Z")
Well, `username` is a part of `params` and the body itself should be a JSON object, so `--form` and `application/x-www-form-urlencoded` won't work here. What you want is this:
```auto
curl 'https://localhost:5601/internal/security/login' \
-H 'Accept: */*' \
-H 'Content-Type: application/json' \
-H 'kbn-version: 8.0.0' \
--data-raw '{"providerType":"basic","providerName":"basic","currentURL":"","params":{"username":" ***","password":"***"}}'
```
By the way, the easiest way to get the right request is to just use browser dev tools:
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 10, 2020, 2:26pm UTC](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/6 "2020-12-10T14:26:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.