Kibana_system user ID is unable to connect to elasticsearch

Hi,

I have created a new Elasticsearch cluster 8.8.0(on Linux) and tried to start kibana. But found this error for the first time.
BTW, kibana_system/new id's password is set already with APIs.

kibana.yml

server.port: 5601
server.host: 0.0.0.0
elasticsearch.username: "kib_admin"
elasticsearch.password: "kib_admin"
elasticsearch.hosts: [https://srv.fqdn:9200]
elasticsearch.ssl.verificationMode: none
elasticsearch.requestTimeout: 30000
xpack.actions.enabledActionTypes: ["*"]
xpack.encryptedSavedObjects.encryptionKey: xxxxxxxxxxxxxxxxxxxxxxxx
xpack.reporting.encryptionKey: xxxxxxxxxxxxxxxxxxxxxx
xpack.security.encryptionKey: xxxxxxxxxxxxxxxxxxxxxx
xpack.reporting.kibanaServer.hostname: kibana.fqdn
server.ssl.enabled: true
server.ssl.certificate: /usr/share/kibana/config/node1.pem
server.ssl.key: /usr/share/kibana/config/node1.key
server.ssl.supportedProtocols: [TLSv1.2, TLSv1.3]
xpack.security.cookieName: "somesid"
server.securityResponseHeaders.strictTransportSecurity: "max-age=31536000"
server.securityResponseHeaders.disableEmbedding: true
csp.strict: true

Error:

[2023-06-09T10:50:52.848+00:00][FATAL][root] ResponseError: security_exception
Root causes:
security_exception: unable to authenticate user [kib_admin] for REST request [/_cluster/settings?include_defaults=true&flat_settings=true]
at KibanaTransport.request (/usr/share/kibana/node_modules/@elastic/transport/lib/Transport.js:479:27)
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at KibanaTransport.request (/usr/share/kibana/node_modules/@kbn/core-elasticsearch-client-server-internal/src/create_transport.js:51:16)
at Cluster.getSettings (/usr/share/kibana/node_modules/@elastic/elasticsearch/lib/api/api/cluster.js:157:16)
at isInlineScriptingEnabled (/usr/share/kibana/node_modules/@kbn/core-elasticsearch-server-internal/src/is_scripting_enabled.js:20:20)
at ElasticsearchService.start (/usr/share/kibana/node_modules/@kbn/core-elasticsearch-server-internal/src/elasticsearch_service.js:115:32)
at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:339:32)
at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:64:14)
at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:129:5)
at Command. (/usr/share/kibana/src/cli/serve/serve.js:272:5)
[2023-06-09T10:50:52.855+00:00][INFO ][plugins-system.preboot] Stopping all plugins.
[2023-06-09T10:50:52.856+00:00][INFO ][plugins-system.standard] Stopping all plugins.
[2023-06-09T10:50:52.857+00:00][INFO ][plugins.monitoring.monitoring.kibana-monitoring] Monitoring stats collection is stopped
[2023-06-09T10:50:52.860+00:00][ERROR][plugins.ruleRegistry] Error: Server is stopping; must stop all async operations
at /usr/share/kibana/node_modules/@kbn/alerting-plugin/server/alerts_service/lib/install_with_timeout.js:40:18
at processTicksAndRejections (node:internal/process/task_queues:96:5)
[2023-06-09T10:50:52.861+00:00][ERROR][plugins.ruleRegistry] Error: Failure during installation of common resources shared between all indices. Server is stopping; must stop all async operations

Is this method user ID/password authentication deprecated? Can someone suggest what I am doing wrong

Regards,

Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you :slight_smile:

Can you successfully curl Elasticsearch with the details you are defining in your Kibana config?

Yup.
{
"name" : "SRV1",
"cluster_name" : "cluster1",
"cluster_uuid" : "4Efb8tJpSW6X8Gzipbm-yA",
"version" : {
"number" : "8.8.0",
"build_flavor" : "default",
"build_type" : "docker",
"build_hash" : "c01029875a091076ed42cdb3a41c10b1a9a5a20f",
"build_date" : "2023-05-23T17:16:07.179039820Z",
"build_snapshot" : false,
"lucene_version" : "9.6.0",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.