# Kopf plugin with Shield and Anonymous access

**URL:** <https://discuss.elastic.co/t/kopf-plugin-with-shield-and-anonymous-access/61723>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 28, 2016, 4:08pm UTC](https://discuss.elastic.co/t/kopf-plugin-with-shield-and-anonymous-access/61723 "2016-09-28T16:08:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![diranged](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diranged/32/4065_2.png) [@diranged](https://discuss.elastic.co/u/diranged)\
**Post date:** [September 28, 2016, 4:08pm UTC](https://discuss.elastic.co/t/kopf-plugin-with-shield-and-anonymous-access/61723/1 "2016-09-28T16:08:50Z")

</div>

We have ES configured to allow a light amount of anonymous access to the cluster for the simplest types of debugging, monitoring, etc.

# elasticsearch.yaml

```
shield.authc.anonymous.roles: monitoring
shield.authc.anonymous.username: anonymous_user
shield.authc.authz_exception.authz_exception: true

```

# roles.yaml

```
monitoring: 
  cluster: monitor
  indices: 
    "*": monitor

```

So simple curl calls work just fine..

```
[root@staging-us1-search-es-uswest2-9:/etc/elasticsearch/staging-us1-search/shield:60]# curl --insecure https://localhost:9200/_cluster/health?pretty
{
  "cluster_name" : "staging-us1-search",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 2,
  "number_of_data_nodes" : 2,
  "active_primary_shards" : 2,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

```

We can also access the kopf plugin.. but when we do, it fails to load any data with the following error (ignore the URL .. thats me doing some tunneling to get to the server)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e2f2371671112b9c35100f20913410feab4d8ffd.png)

If we switch the anonymous access to use the `admin` role, it works fine .. so im pretty sure this is just a role issue. Can someone help me create a role that will give the kopf plugin access to the data it needs?

---

<div class="post-metadata">

**Author:** ![Saitama](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Saitama](https://discuss.elastic.co/u/Saitama)\
**Post date:** [February 23, 2017, 10:33am UTC](https://discuss.elastic.co/t/kopf-plugin-with-shield-and-anonymous-access/61723/2 "2017-02-23T10:33:28Z")

</div>

I have the same problem. Did you find a solution yet???

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/kopf-plugin-with-shield-and-anonymous-access/61723/3 "2017-07-06T13:41:17Z")

</div>