# Kibana With X-Pack Security behind apache rejects digest authentication

**URL:** <https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899>\
**Category:** Kibana\
**Created:** [May 22, 2018, 10:29pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899 "2018-05-22T22:29:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emily1](https://avatars.discourse-cdn.com/v4/letter/e/76d3ee/32.png) [@Emily1](https://discuss.elastic.co/u/Emily1)\
**Post date:** [May 22, 2018, 10:29pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/1 "2018-05-22T22:29:05Z")

</div>

Hello,

I recently installed X-Pack 6.2.4 and am running Kibana behind an Apache reverse proxy using digest authentication. For whatever reason, when X-Pack security and Apache Digest authentication are both enabled, Kibana returns this error:

{"statusCode":400,"error":"Bad Request","message":"Unsupported authentication schema: Digest"}

If I disable the digest auth OR I disable x-pack security, it works. Is there a way to keep this proxy + digest auth intact?

Thanks!

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [May 22, 2018, 11:09pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/2 "2018-05-22T23:09:55Z")

</div>

Looks like you could implement Digest authentication by [writing a custom realm](https://www.elastic.co/guide/en/x-pack/current/custom-realms.html). Not being a Java developer though, I don't know how involved that is. There's an example linked to from the docs though.

I want to point out the following from the [Apache docs](https://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html) though:

> This module implements HTTP Digest Authentication (RFC2617), and provides an alternative to mod\_auth\_basic where the password is not transmitted as cleartext. However, this does not lead to a significant security advantage over basic authentication. On the other hand, the password storage on the server is much less secure with digest authentication than with basic authentication. Therefore, using basic auth and encrypting the whole connection using mod\_ssl is a much better alternative.

Food for thought.

---

<div class="post-metadata">

**Author:** ![Emily1](https://avatars.discourse-cdn.com/v4/letter/e/76d3ee/32.png) [@Emily1](https://discuss.elastic.co/u/Emily1)\
**Post date:** [May 29, 2018, 4:13pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/3 "2018-05-29T16:13:48Z")

</div>

Thanks for your response Joe. I am not trying to get Kibana to use digest authentication, but just am using it on Apache. I will bring your point about Apache digest authentication back to my team, but it does seem to be a separate issue.

Just so that I understand what is happening here -

Apache has a digest-authenticated session between the client browser and itself. When it passes the traffic off to Kibana, somewhere in the header the fact that Apache performed Digest authentication is indicated. Because of this, even though Kibana is not using that authentication mechanism at all, Kibana rejects the traffic.

If this is the case, it seems like it may be a bug because it does not seem to actually improve the security provided by the Elastic stack.

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [May 29, 2018, 5:16pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/4 "2018-05-29T17:16:19Z")

</div>

Hey @Emily1, if I understand correctly, you're using Apache in front of Kibana to enforce your own Digest authentication, and it appears that the requests that are being forwarded to Kibana still have the digest authentication header specified on them. You should be able to use `RequestHeader unset Authorization` in Apache to no longer forward these headers to Kibana, as Kibana doesn't support digest authentication so we're throwing an error when we receive requests with this header.

---

<div class="post-metadata">

**Author:** ![Emily1](https://avatars.discourse-cdn.com/v4/letter/e/76d3ee/32.png) [@Emily1](https://discuss.elastic.co/u/Emily1)\
**Post date:** [May 29, 2018, 10:14pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/5 "2018-05-29T22:14:22Z")

</div>

Thanks Brandon! That did it 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2018, 10:14pm UTC](https://discuss.elastic.co/t/kibana-with-x-pack-security-behind-apache-rejects-digest-authentication/132899/6 "2018-06-26T22:14:24Z")

</div>

Closed on June 26, 2018, 10:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.