# Kibana (active directory realm) (version 6.2.1)
**URL:** https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866
**Category:** Kibana
**Created:** [February 21, 2018, 2:25pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866 "2018-02-21T14:25:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ezmani](https://discuss.elastic.co/u/ezmani)
#### Post date: [February 21, 2018, 2:25pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/1 "2018-02-21T14:25:44Z")
Team,
We are using elastic search version 6.2.1. I've setup elastic/kibana to use the active directory realm. We've ran into strange issue. It doesn't matter what user I use to log in. It keeps logging in as built user "kibana".
Any help is much appreciated.
Thanks!
# elastic yml
```
authc:
realms:
native1:
type: native
order: 0
active_directory:
type: active_directory
order: 1
domain_name: domain.com
url: ldap://domain.com:389
```
# kibana yml
```
xpack:
security:
enabled: true
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 21, 2018, 2:38pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/2 "2018-02-21T14:38:07Z")
I moved your question to #x-pack
Please format your code, logs or configuration files using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable.
Or use markdown style like:
````
```
CODE
```
````
There's a live preview panel for exactly this reasons.
Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.
---
### Author:  [@ezmani](https://discuss.elastic.co/u/ezmani)
#### Post date: [February 21, 2018, 2:40pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/3 "2018-02-21T14:40:28Z")
Will do thank you! Thanks for moving it into #x-pack
---
### Author:  [@ezmani](https://discuss.elastic.co/u/ezmani)
#### Post date: [February 21, 2018, 3:31pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/4 "2018-02-21T15:31:03Z")
I have an update on this.
I explicitly disabled the kibana user with the following command
```auto
https://server.com:9200/_xpack/security/user/kibana/_disable
```
After I performed this command, I logged in with my AD creds into kibana.
Kibana immediately prompted me a native user prompt (a user/pass challenge box from the browser).
I canceled out of that window and it immediately threw an error saying invalid credentials for the user "kibana".
After that, I hit Ctrl + f5 (in chrome) and I was in the AD prompt. This time when I logged in with my AD creds it worked as expected.
My only guess is that when I disabled the "kibana" native account it cleared out some kind of cache.
If anyone knows further explanation regarding this situation please chime in.
Thanks!
Mani
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 21, 2018, 11:52pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/5 "2018-02-21T23:52:09Z")
> [@ezmani](#):
>
> I explicitly disabled the kibana user with the following command
>
> ```
> https://server.com:9200/_xpack/security/user/kibana/_disable
>
> ```
That seems unwise.
What use are you using to connect Kibana to Elasticsearch (`elasticsearch.username`) ? You _should_ be using `kibana` for that, which won't work if you disable the user.
---
### Author:  [@ezmani](https://discuss.elastic.co/u/ezmani)
#### Post date: [February 23, 2018, 12:44pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/6 "2018-02-23T12:44:11Z")
Tim,
This was a temporary disable of the account. At that time the `elasticsearch.username` was elastic.
Before I tried this, I enabled the audit logs and all I saw was the context was switching from my AD account to the "kibana" account but never really eluded to why it was switching context. I am not certain but there was some kind of caching going on causing the login to always be kibana (as if xpack security wasn't turned on).
Do you have any ideas as to why it would just log in as kibana?
Thanks!
Mani
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2018, 12:44pm UTC](https://discuss.elastic.co/t/kibana-active-directory-realm-version-6-2-1/120866/7 "2018-03-23T12:44:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.