# Kibana Shields **URL:** \ **Category:** Kibana\ **Created:** [July 7, 2015, 2:43pm UTC](https://discuss.elastic.co/t/kibana-shields/25052 "2015-07-07T14:43:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Hamza\_Chtioui](https://avatars.discourse-cdn.com/v4/letter/h/c37758/32.png) [@Hamza\_Chtioui](https://discuss.elastic.co/u/Hamza_Chtioui)\ **Post date:** [July 7, 2015, 2:43pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/1 "2015-07-07T14:43:29Z")
Hello, I'm trying to create authentication page before accessing Kibana index page, then access kibana's fonctionnalities (get, delete, update dashboards...) depending on wich role the user have. I looked on the "Kibana's shields" guide for creating users and roles on Kibana 4 but i don't understand how to do it or wich conf files to update?? ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [July 7, 2015, 6:58pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/2 "2015-07-07T18:58:43Z")
Shield is an Elasticsearch plugin, so to configure users and roles, you have to do that in the Elasticsearch config/shield directory (e.g. roles.yml). The Shield guide talks about how to configure users and roles in detail, for instance in the Authorization section: [https://www.elastic.co/guide/en/shield/current/authorization.html](https://www.elastic.co/guide/en/shield/current/authorization.html) All configuration changes in Kibana 4 that are required to work with shield are in kibana.yml, but are limited to configuring the right Kibana username and password to talk to Elasticsearch... the rest is handled by ES+Shield, and are described here: [https://www.elastic.co/guide/en/shield/current/\_shield\_with\_kibana\_4.html](https://www.elastic.co/guide/en/shield/current/_shield_with_kibana_4.html) Note that at present Kibana 4 just presents a basic authentication login screen to users and simply passes those credentials to ES+Shield to authorize (or reject) access to the data. In 4.2, we're working on a dedicated login screen and user session support: [https://github.com/elastic/kibana/issues/3904](https://github.com/elastic/kibana/issues/3904) ---
**Author:** ![Hamza\_Chtioui](https://avatars.discourse-cdn.com/v4/letter/h/c37758/32.png) [@Hamza\_Chtioui](https://discuss.elastic.co/u/Hamza_Chtioui)\ **Post date:** [July 8, 2015, 1:49pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/3 "2015-07-08T13:49:55Z")
Thanks for the reply, i created a roles.yml file in /config/shield. this is its content: ``` # All cluster rights # All operations on all indices admin: cluster: all indices: '*': all # Monitoring cluster privileges # All operations on all indices power_user: cluster: monitor indices: '*': all # Only read operations on indices user: indices: '*': read # Only read operations on indices named events_* events_user: indices: 'events_*': read # Only GET read action on index named events_index get_user: indices: 'events_index': 'indices:data/read/get' ``` what i have to do next to see the authentication screen? And to be able to access kibana through différents roles?? Sorry but the doc is not clear.. Thanks in advance. ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [July 9, 2015, 4:15am UTC](https://discuss.elastic.co/t/kibana-shields/25052/4 "2015-07-09T04:15:01Z")
In general, there are two places you have to modify: 1. Shield configuration files living in elasticsearch config/shield directory [https://www.elastic.co/guide/en/shield/current/\_shield\_with\_kibana\_4.html](https://www.elastic.co/guide/en/shield/current/_shield_with_kibana_4.html) 2. kibana.yml in your Kibana 4 installation. Instructions here: [https://www.elastic.co/guide/en/kibana/current/production.html#configuring-kibana-shield](https://www.elastic.co/guide/en/kibana/current/production.html#configuring-kibana-shield) Looking at your roles file, for one, you're still missing the kibana4\_server role. Once you have that, make sure to follow instructions in step (2) above. ---
**Author:** ![Hamza\_Chtioui](https://avatars.discourse-cdn.com/v4/letter/h/c37758/32.png) [@Hamza\_Chtioui](https://discuss.elastic.co/u/Hamza_Chtioui)\ **Post date:** [July 9, 2015, 8:55am UTC](https://discuss.elastic.co/t/kibana-shields/25052/5 "2015-07-09T08:55:50Z")
Hi, Still not working.. I'm asking for the result of this configuration.. After this config, i have to specify the user and password in the kibana.yml file before each start of Kibana? like this? ``` # If your Elasticsearch is protected with basic auth, this is the user credentials # used by the Kibana server to perform maintence on the kibana_index at statup. Your Kibana # users will still need to authenticate with Elasticsearch (which is proxied thorugh # the Kibana server) # kibana_elasticsearch_username: user # kibana_elasticsearch_password: pass ``` And i'm asking for the password declaration.. where to configure the user's password?? ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [July 9, 2015, 12:57pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/6 "2015-07-09T12:57:32Z")
Ensure the kibana4\_server role exists in the roles file. Then, according to [the Shield guide](https://www.elastic.co/guide/en/shield/current/quick-getting-started.html), add a user: ` bin/shield/esusers useradd kibana4_server -r kibana4_server ` This command will prompt you for the password. ---
**Author:** ![Hamza\_Chtioui](https://avatars.discourse-cdn.com/v4/letter/h/c37758/32.png) [@Hamza\_Chtioui](https://discuss.elastic.co/u/Hamza_Chtioui)\ **Post date:** [July 9, 2015, 3:08pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/7 "2015-07-09T15:08:20Z")
This makes sense 😄 I'll try this later. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:16pm UTC](https://discuss.elastic.co/t/kibana-shields/25052/8 "2017-07-06T14:16:44Z")