# Logging in to Kibana 8 without security for LDAP auth ES cluster

**URL:** <https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [January 30, 2023, 4:50pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250 "2023-01-30T16:50:38Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel/32/49777_2.png) [@Chel](https://discuss.elastic.co/u/Chel)\
**Post date:** [January 30, 2023, 4:50pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/1 "2023-01-30T16:50:38Z")

</div>

Hi, We have 8.5.2 cluster running with LDAP authentication(xpack security) with basic license. Earlier Versions of Kibana in 7.x

we use the same username and password of elastic to login to kibana but in 8.x versions looks it needs a same elastic uname/pwd to be created agin using \_security/user API with the same password of elastic so it passes both kibana and ES authentication.

Can we disable security in Kibana alone to use the same userid/password of elastic to login like in 7.x version of Kibana?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 30, 2023, 5:15pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/2 "2023-01-30T17:15:17Z")

</div>

> [@Chel](#):
>
> We have 8.5.2 cluster running with LDAP authentication(xpack security) with basic license.

Something is wrong, the LDAP integration does not work with the basic license, you need a paid license to use it.

What is the result of `GET _license` ?

> [@Chel](#):
>
> we use the same username and password of elastic to login to kibana but in 8.x versions looks it needs a same elastic uname/pwd to be created agin using \_security/user API with the same password of elastic so it passes both kibana and ES authentication.

It is not clear what is the issue, to log in Kibana you need to use a username and password, these credentials are stored in Elasticsearch, every client need a username and password or API Key.

What changed in Kibana version 8 is that you now can use a [service account](https://www.elastic.co/guide/en/elasticsearch/reference/current/service-accounts.html#service-accounts-explanation) to configure the user that Kibana will use to connect to Elasticsearch.

Can you provide more context about what is your issue?

---

<div class="post-metadata">

**Author:** ![Chel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel/32/49777_2.png) [@Chel](https://discuss.elastic.co/u/Chel)\
**Post date:** [January 30, 2023, 5:31pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/3 "2023-01-30T17:31:50Z")

</div>

@leandrojmp We are using Elastic basic license (not paid) with httpd proxy LDAP system.  
With 7.17 version if we are connecting via kibana it will let us in with the Elastic username and password (any service account associated with the AD group)

But the new 8.x version of Kibana is not allowing us to login with the same uname/password of Elastic.

Earlier teams use their own id to login if they are part of AD group but with 8.x we need to get the uname and password of individuals and added to users for enabling login to them.

Is there any workaround for configuring a service account to kibana so that they can login with their own id and also will single kibana allows multiple logins ? or

is there a way to disable security in kibana alone ?

We don't want the existing system to be disturbed and upgrade to 8.x seamlessly

---

<div class="post-metadata">

**Author:** ![Chel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel/32/49777_2.png) [@Chel](https://discuss.elastic.co/u/Chel)\
**Post date:** [January 30, 2023, 5:33pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/4 "2023-01-30T17:33:53Z")

</div>

```auto
{
  "license" : {
    "status" : "active",
    "uid" : "f937d78e-7a86-46d4-80c7-8a63a1c515fb",
    "type" : "basic",
    "issue_date" : "2022-05-27T09:49:14.974Z",
    "issue_date_in_millis" : 1653644954974,
    "max_nodes" : 1000,
    "max_resource_units" : null,
    "issued_to" : "es-test",
    "issuer" : "elasticsearch",
    "start_date_in_millis" : -1
  }
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 30, 2023, 7:00pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/5 "2023-01-30T19:00:55Z")

</div>

> [@Chel](#):
>
> We are using Elastic basic license (not paid) with httpd proxy LDAP system.  
> With 7.17 version if we are connecting via kibana it will let us in with the Elastic username and password (any service account associated with the AD group)

So your issue is not in Kibana, but with your proxy, you need to check on the proxy software you are using as Kibana has no knowledge of it.

> [@Chel](#):
>
> But the new 8.x version of Kibana is not allowing us to login with the same uname/password of Elastic.

What is the error you are getting? Please share the Kibana log.

> [@Chel](#):
>
> is there a way to disable security in kibana alone ?

Not possible, there is no security in Kibana, the security is configured in Elasticsearch, not in Kibana, Kibana acts as a client to Elasticsearch and the authentication and authorization is done by Elasticsearch.

> [@Chel](#):
>
> Is there any workaround for configuring a service account to kibana so that they can login with their own id and also will single kibana allows multiple logins ?

The service account I mentioned is used by Kibana to authenticate to Elasticsearch, not the users, the users still need.

I'm trying to understand your infrastructure, it looks like in version 7 you didn't have security enabled and the access was controlled by your httpd proxy, but in version 8 security is enabled by default.

Can you share your current `kibana.yml` and `elasticsearch.yml` ?

---

<div class="post-metadata">

**Author:** ![tonyk](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@tonyk](https://discuss.elastic.co/u/tonyk)\
**Post date:** [January 30, 2023, 8:55pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/6 "2023-01-30T20:55:12Z")

</div>

Hello Leandrojmp. I am working on this issue with Chel and can provide some infra context.

Below is the Kibana.yml

```auto
server.port: 5601
server.host: 0.0.0.0
elasticsearch.hosts: ["https://full_qualified_name.com:443"]
elasticsearch.username: "ad_service_account1"
elasticsearch.password: "super_secure_password"
elasticsearch.ssl.verificationMode: "none"
xpack.reporting.roles.enabled: false

```

And here is the Elasticsearch.yaml file

```auto
network.host: 0.0.0.0
cluster.name: UNIQUE_CLUSTER_NAME
node.roles: [master, data, ingest, remote_cluster_client]
node.store.allow_mmap: false
discovery.seed_providers: file
bootstrap.memory_lock: true

action.destructive_requires_name: true

path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch

#Security and TLS configuration
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/instance/instance.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/instance/instance.crt
xpack.security.transport.ssl.certificate_authorities: ["/etc/elasticsearch/ca/ca.crt"]
xpack.security.http.ssl.enabled: false

#disable geoip download
ingest.geoip.downloader.enabled: false

```

You are correct in your assessment that our version 7x did not have the xpack.security plugin enabled and it seems with version 8x (8.5.2) it defaults to true.

We also do have an http service running on each of the Elasticsearch nodes and they are configured to authenticate users that exist in a specific AD group. The "ad\_service\_account1" above in the kibana.yml file is in the needed AD group. However, before we were able to log into the Kibana UI with the "ad\_service\_account1" id, we first had to create that user in Elastic with the security user api ([Create or update users API | Elasticsearch Guide [8.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.5/security-api-put-user.html)) and assign the user to the admin role.

Is there any way to use the standard "kibana\_system" user in the Kibana.yml file and still allow users that exist in an AD group access to the Kibana UI??

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 30, 2023, 9:34pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/7 "2023-01-30T21:34:28Z")

</div>

> [@tonyk](#):
>
> Is there any way to use the standard "kibana\_system" user in the Kibana.yml file and still allow users that exist in an AD group access to the Kibana UI??

These are two different things, Kibana is an Elasticsearch client, the settings `elasticsearch.username` and `elasticsearch.password` are the settings where you configure the username and password that Kibana as a client will use to write on its own indices in Elasticsearch.

This is used when you have security enabled and Kibana users still need to authenticate in Elasticsearch.

On the documentation you have this about those settings:

> `elasticsearch.username` and `elasticsearch.password`  
> If your Elasticsearch is protected with basic authentication, these settings provide the username and password that the Kibana server uses to perform maintenance on the Kibana index at startup. Kibana users still need to authenticate with Elasticsearch, which is proxied through the Kibana server.

You said you didn't had security enabled in version 7, so you were not authenticating in Elasticsearch, only in your httpd proxy.

Were you using the `elasticsearch.username` and `elastiscearch.password` in your settings to talk with the http service running on the Elasticsearch nodes?

> [@tonyk](#):
>
> Is there any way to use the standard "kibana\_system" user in the Kibana.yml file and still allow users that exist in an AD group access to the Kibana UI??

No, if you enable security in elasticsearch the users needs to authenticate in elasticsearch, with the basic license the only authentication realm available is the native one, you can't integrate with an active directory without a paid license, so all your users will need to be created in the native realm.

The `kibana_system` user is used by kibana to write and read in elasticsearch, not to authenticate users. To authenticate users Kibana acts as a proxy as described in the documentation.

---

<div class="post-metadata">

**Author:** ![tonyk](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@tonyk](https://discuss.elastic.co/u/tonyk)\
**Post date:** [January 30, 2023, 10:29pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/8 "2023-01-30T22:29:52Z")

</div>

Ok, I think I understand. We are currently using Elasticsearch basic authentication and have 2 user IDs setup in Elasticsearch (admin/normal). We have the https service running on all Elasticsearch nodes as well and that is excepting all API calls. The LDAP authentication (AD group membership), is configured in the https service and that will proxy the api call to use the appropriate Elasticsearch user credentials to Elasticsearch service.

---

<div class="post-metadata">

**Author:** ![Chel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel/32/49777_2.png) [@Chel](https://discuss.elastic.co/u/Chel)\
**Post date:** [February 1, 2023, 9:08am UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/9 "2023-02-01T09:08:04Z")

</div>

one clarification on the users as We are adding users by

bin/elasticsearch-users useradd jacknich -p theshining -r network,monitoring

but the same user is not getting reflected if we get user like below

[https://host/\_security/user](https://host/_security/user)

So we use the POST request of /\_security/user with username and password which we created earlier then kibana is allowing us to login.

Is this the way we can use it or bin/elasticsearch-users useradd will help ?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 1, 2023, 12:43pm UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/10 "2023-02-01T12:43:53Z")

</div>

The `elasticsearch-users` command only works if you are using the file-based user authentication, which uses the `file` realm.

If you use this command and you have more than one node, you will need to make sure that all the users are defined in every node.

This is explained in this [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/file-realm.html#file-realm).

The documentation also mentions this:

> You should also be aware that you cannot add or manage users in the `file` realm via the [user APIs](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api.html#security-user-apis)

So, the `_secruity/user` API will not reflect the users added using the `elasticsearch-users`.

Any reason to use the `file` realm? You could use the `nativel` realm which is [enabled by default](https://www.elastic.co/guide/en/elasticsearch/reference/current/realms.html) and add your users using the API or Kibana.

---

<div class="post-metadata">

**Author:** ![chelambarasan\_rajend](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chelambarasan_rajend/32/102262_2.png) [@chelambarasan\_rajend](https://discuss.elastic.co/u/chelambarasan_rajend)\
**Post date:** [February 3, 2023, 7:47am UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/11 "2023-02-03T07:47:07Z")

</div>

Thanks for responding. It makes clear now. I was confusing between file and native realm. Closing this thread. Resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2023, 7:55am UTC](https://discuss.elastic.co/t/logging-in-to-kibana-8-without-security-for-ldap-auth-es-cluster/324250/13 "2023-03-03T07:55:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.