# Kibana Client side headers and not getting forwarded to Elasticsearch! **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 2, 2017, 10:10am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165 "2017-11-02T10:10:14Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)\ **Post date:** [November 2, 2017, 10:10am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/1 "2017-11-02T10:10:14Z")
We are implementing Custom Realm in Kibana 5.6 and we are using a Siteminder login page and bypassing the Kibana login page. We are seeing the Kibana client side headers in Kibana logs. However, the ThreadContext in Elasticsearch doesn't contain any headers. Can someone please help me in this! ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [November 7, 2017, 5:55pm UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/2 "2017-11-07T17:55:16Z")
Have you tried setting the following in your kibana.yml? > elasticsearch.requestHeadersWhitelist: [header\_you\_want\_to\_forward] ---
**Author:** ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)\ **Post date:** [November 8, 2017, 11:14am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/3 "2017-11-08T11:14:20Z")
Yes, I did. elasticsearch.requestHeadersWhitelist: [es-security-runas-user, Authorization, authorization, sm\_user, user\_id, host, source] As soon as I login to Siteminder, I keep getting the below message in ES logs [2017-11-07T22:11:11,470][WARN][o.e.x.s.a.AuthenticationService] [AMA\_MONITOR] An error occurred while attempting to authenticate [elastic] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [elastic]] [2017-11-07T22:11:11,670][WARN][o.e.x.s.a.AuthenticationService] [AMA\_MONITOR] An error occurred while attempting to authenticate [elastic] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [elastic]] ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [November 8, 2017, 3:20pm UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/4 "2017-11-08T15:20:16Z")
Are you trying to authenticate as the built-in `elastic` user or one that you've created? ---
**Author:** ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)\ **Post date:** [November 8, 2017, 4:33pm UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/5 "2017-11-08T16:33:39Z")
sm\_user is the header that Siteminder responds and we wanted to read its value ( as whomsoever logged in user ) into ES and Custom Realm ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 9, 2017, 1:34am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/6 "2017-11-09T01:34:28Z")
From what you've posted, it sounds like you have a custom realm that is handling the `sm_user` header, and are trying to use that to log in as the `elastic` user. Is that an accurate summary? If so, then that won't work. A custom realm is not able to authenticate _reserved_ users such as "elastic". Those users are authenticated exclusively by the reserved realm, they will not be delegated to any other realms down the authc chain. if you need to be able to login through Siteminder as a superuser, then it will need to be a new custom user that is handled by your realm. You can simply assign the `superuser` role to your user and it will have the same privileges as `elastic` does. ---
**Author:** ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)\ **Post date:** [November 9, 2017, 5:48am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/7 "2017-11-09T05:48:52Z")
Yes, I am able to create a new custom user and also able to handle the roles mapping in my Custom Realm. The thing is we do not want the Kibana login page, instead we want Kibana to be protected by Siteminder. We achieved it by setting up reverse proxy using IBM HTTP Server; and we are hardcoding it with a custom user. But by doing so we were able to bypass the kibana login page but the no headers are being sent from Kibana to ES and Custom Realm; and thereby ThreadContext is just returning an empty map. **Note:** If we remove the reverse proxy, the ThreadContext is populating the map with sm\_user, but in this case, we are getting Kibana login page as well (which we do not want it and want it to bypass). ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 9, 2017, 7:10am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/8 "2017-11-09T07:10:10Z")
I'm having trouble following exactly what parts are causing which issue. Please try to be as precise with your information as you can be, and provide direct answers to the questions people ask. @lukas suggested using `elasticsearch.requestHeadersWhitelist` You responded showing a log message: > [2017-11-07T22:11:11,470][WARN][o.e.x.s.a.AuthenticationService] [AMA\_MONITOR] An error occurred while attempting to authenticate [elastic] against realm [reserved] - ElasticsearchSecurityException[failed to authenticate user [elastic]] But that error shows that you're trying to log in as `elastic`. That won't work. If you are seeing that error, then you are trying to do something that will _never_ work. If you are have troubles when you try to login as your custom user, then please show the errors for that user. > We achieved it by setting up reverse proxy using IBM HTTP Server; Is this separate to SiteMinder? So you have - SiteMinder in front, generating a `sm_user` header - going to the IBM reverse proxy, which is adding a "custom user" - then it goes to Kibana - and Kibana goes to Elasticsearch ? That's a lot of moving parts. If you want to debug this you'll need to be thorough at checking that each component is doing what you think it's doing. > and we are hardcoding it with a custom user. What exactly does this mean? You are adding an `Authorization` header? Or something else? > If we remove the reverse proxy, the ThreadContext is populating the map with sm\_user That makes it sound like the reverse proxy is removing the `sm_user` header. Why do you think this is a Kibana problem? ---
**Author:** ![Vivek\_Unni](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@Vivek\_Unni](https://discuss.elastic.co/u/Vivek_Unni)\ **Post date:** [November 9, 2017, 7:22am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/9 "2017-11-09T07:22:28Z")
We sorted out the issue! It was the config entry in the kibana.yml, for elasticsearch.requestHeadersWhitelist. When we tried user impersonation we required authorization header. But in our case we just need sm\_user. Since we have both authorization and sm\_user in the list, the authorization bypassed rest of the headers. Now we removed the authorization from the list, and having only sm\_user, we see the sm\_user is getting passed to ThreadContext. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2017, 7:26am UTC](https://discuss.elastic.co/t/kibana-client-side-headers-and-not-getting-forwarded-to-elasticsearch/106165/10 "2017-12-07T07:26:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.