# Kibana doesn’t work authentication with Shield

**URL:** <https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863>\
**Category:** Kibana\
**Created:** [March 9, 2016, 6:53am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863 "2016-03-09T06:53:21Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 6:53am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/1 "2016-03-09T06:53:21Z")

</div>

I have installed and configured ELK **(Elasticsearch2.2.0, Logstash2.2.2, and kibana-4.4.1-windows)** and updated Elasticsearch with **shield** plugin to enable authentication. I have craeted new role and user in order to restrict access to specific user to access specific indices. But I got an error that says:

```
Error: [index_not_found_exception] no such index, with: {"index":"[logstash-*]"}
ErrorAbstract@http://localhost:5601/bundles/kibana.bundle.js?v=9693:74977:20
StatusCodeError@http://localhost:5601/bundles/kibana.bundle.js?v=9693:75139:6
respond@http://localhost:5601/bundles/kibana.bundle.js?v=9693:76344:16
checkRespForFailure@http://localhost:5601/bundles/kibana.bundle.js?v=9693:76307:8
[24]</AngularConnector.prototype.request/<@http://localhost:5601/bundles/kibana.bundle.js?v=9693:74925:8
processQueue@http://localhost:5601/bundles/commons.bundle.js?v=9693:42357:29
scheduleProcessQueue/<@http://localhost:5601/bundles/commons.bundle.js?v=9693:42373:28
$RootScopeProvider/this.$get</Scope.prototype.$eval@http://localhost:5601/bundles/commons.bundle.js?v=9693:43601:17
$RootScopeProvider/this.$get</Scope.prototype.$digest@http://localhost:5601/bundles/commons.bundle.js?v=9693:43412:16
$RootScopeProvider/this.$get</Scope.prototype.$apply@http://localhost:5601/bundles/commons.bundle.js?v=9693:43709:14
done@http://localhost:5601/bundles/commons.bundle.js?v=9693:38158:37
completeRequest@http://localhost:5601/bundles/commons.bundle.js?v=9693:38356:8
requestLoaded@http://localhost:5601/bundles/commons.bundle.js?v=9693:38297:1

```

There is no problem when accessing with admin account. This is the roles.yml file

```
stature:
  cluster: 
      - cluster:monitor/nodes/info
      - cluster:monitor/health 
  indices:
    'logstashstature':
      privileges: indices:admin/mappings/fields/get, indices:admin/validate/query, indices:data/read/search, indices:data/read/msearch, indices:data/read/field_stats, indices:admin/get
    '.kibana':
      privileges: indices:admin/exists, indices:admin/mapping/put, indices:admin/mappings/fields/get, indices:admin/refresh, indices:admin/validate/query, indices:data/read/get, indices:data/read/mget, indices:data/read/search, indices:data/write/delete, indices:data/write/index, indices:data/write/update
```

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 9, 2016, 9:56am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/2 "2016-03-09T09:56:15Z")

</div>

**Your stack trace says, INDEX NOT FOUND. Its not security error.**

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 10:06am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/3 "2016-03-09T10:06:24Z")

</div>

Actually i have index with index names using \* as a wildcard (e.g. logstash-2015.12.21) and also a index with name 'logstashstature' . I created role for accessing that index only (roles.yml).  
There is no problem when logging kibana with a user has admin role.

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 9, 2016, 11:17am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/4 "2016-03-09T11:17:30Z")

</div>

@munees But the index clearly says,

> [@munees](#):
>
> Error: [index\_not\_found\_exception] no such index, with: {"index":"[logstash-\*]"}

To figure it out, create a index starts with **logstash-** and then try login.

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 11:34am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/5 "2016-03-09T11:34:53Z")

</div>

The error you are having is because your configured role is not having access to the default index which is logstash-_. I have been playing around with kibana and I noticed that in addition to the .kibana index all users must have access to the index logstash-_.  
Try sometime like this:

logstashstature:  
cluster:  
- cluster:monitor/nodes/info  
- cluster:monitor/health  
indices:  
'logstashstature':  
privileges: all  
'.kibana':  
privileges: all  
'logstash-\*':  
privileges: all

Then create a user on shield with the role logstashstature  
That is esusers useradd munees -r logstashstature -p passwordofmunees  
Sorry I have updated my answer. The roles has to be logstashstature in the roles.yml file of kibana.

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 11:44am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/6 "2016-03-09T11:44:08Z")

</div>

I have made this change. now i got new error message on the top of kibana discover window  
that says:

`Discover: [security_exception] action [indices:data/read/msearch] is unauthorized for user [statureuser]`

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 11:46am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/7 "2016-03-09T11:46:44Z")

</div>

my role name is just stature, is there any need to change that to logstashstature

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 12:01pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/8 "2016-03-09T12:01:13Z")

</div>

I have updated my answer please take a look on the changes.

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 12:25pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/9 "2016-03-09T12:25:33Z")

</div>

The same error is still exist

`Discover: [security_exception] action [indices:data/read/msearch] is unauthorized for user [munees]`

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 12:27pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/10 "2016-03-09T12:27:57Z")

</div>

What are your configuration?

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 12:29pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/11 "2016-03-09T12:29:15Z")

</div>

means?

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 12:31pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/12 "2016-03-09T12:31:53Z")

</div>

I means please provide all the configurations that you did.

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 12:33pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/13 "2016-03-09T12:33:53Z")

</div>

I just added the role in roles.yml and added user with the role using esusers

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 12:39pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/14 "2016-03-09T12:39:22Z")

</div>

Does the user munees has priviledges for data/read/msearch on all the indices which are in his roles.  
that is for the index logstashstucture, .kibana and logstash-\*?

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 9, 2016, 12:40pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/15 "2016-03-09T12:40:57Z")

</div>

already updated **privileges: all** on all the indices. with the same settings

`logstashstature: cluster: - cluster:monitor/nodes/info - cluster:monitor/health indices: 'logstashstature': privileges: all '.kibana': privileges: all 'logstash-*': privileges: all`

---

<div class="post-metadata">

**Author:** ![jstar](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jstar](https://discuss.elastic.co/u/jstar)\
**Post date:** [March 9, 2016, 12:46pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/16 "2016-03-09T12:46:09Z")

</div>

Try changing the name of your index maybe the issue is because the name of the index is the same as that of the role. That is change logstashstature to logstashindex.  
Then make sure the index logstashindex exist in elasticsearch.  
Login and query that index.

---

<div class="post-metadata">

**Author:** ![munees](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munees/32/8368_2.png) [@munees](https://discuss.elastic.co/u/munees)\
**Post date:** [March 10, 2016, 4:43am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/17 "2016-03-10T04:43:03Z")

</div>

changed indexname and role name to different.The same error is still exist.

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 21, 2016, 7:01am UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/18 "2016-03-21T07:01:22Z")

</div>

Use following permissions,

```
user_testuser1: 
  indices: 
    'user_testuser1*': 
      privileges: all  
    '.kibana': 
      privileges: indices:admin/create, indices:admin/exists, indices:admin/mapping/put, indices:admin/mappings/fields/get, indices:admin/refresh, indices:admin/validate/query, indices:data/read/get, indices:data/read/mget, indices:data/read/search, indices:data/write/delete, indices:data/write/index, indices:data/write/update
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:58pm UTC](https://discuss.elastic.co/t/kibana-doesn-t-work-authentication-with-shield/43863/19 "2017-07-06T13:58:28Z")

</div>