# Need help with xpack security authentication in 6.3.1

**URL:** <https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286>\
**Category:** Elasticsearch\
**Created:** [February 21, 2020, 3:09am UTC](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286 "2020-02-21T03:09:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fory](https://avatars.discourse-cdn.com/v4/letter/f/6bbea6/32.png) [@fory](https://discuss.elastic.co/u/fory)\
**Post date:** [February 21, 2020, 3:09am UTC](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286/1 "2020-02-21T03:09:34Z")

</div>

I have two ElasticSearch server nodes configuration with "xpack.security.enabled: true"  
Created a transport\_client role user called "esi".  
When the ES server startup everything works fine as a single node, accessing requires username and password.

curl -u esi:'xxxx' -k -sS '[https://xx.xx.xx.xx:9200/\_xpack/security/\_authenticate?pretty](https://xx.xx.xx.xx:9200/_xpack/security/_authenticate?pretty)'  
{  
"username" : "esi",  
"roles" : [  
"transport\_client"  
],  
"full\_name" : null,  
"email" : null,  
"metadata" : { },  
"enabled" : true  
}

However as soon as zen-disco-elected-as-master succeeds, the authentication gets disabled. And I can access to the ES without ID/Pass.

curl -k -sS '[https://xx.xx.xx.xx:9200/\_xpack/security/\_authenticate?pretty](https://xx.xx.xx.xx:9200/_xpack/security/_authenticate?pretty)'  
{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "current license is non-compliant for [security]",  
"license.expired.feature" : "security"  
}  
],  
"type" : "security\_exception",  
"reason" : "current license is non-compliant for [security]",  
"license.expired.feature" : "security"  
},  
"status" : 403  
}

According to the audit log, the node is using a default\_file realm with transport\_client role, but after master discovery is done it changes to realm "\_\_attach" with superuser role :

[2020-02-21T00:41:18,561] [ESIB] [transport] [access\_granted] origin\_type=[rest], origin\_address=[xx.xx.xx.xx], principal=[esi], realm=[default\_file], roles=[transport\_client], action=[cluster:admin/xpack/security/user/authenticate], request=[AuthenticateRequest]  
[2020-02-21T00:41:37,830] [ESIB] [transport] [access\_granted] origin\_type=[rest], origin\_address=[xx.xx.xx.xx], principal=[esi], realm=[default\_file], roles=[transport\_client], action=[cluster:admin/xpack/security/user/authenticate], request=[AuthenticateRequest]  
[2020-02-21T00:41:38,112] [ESIB] [transport] [access\_granted] origin\_type=[local\_node], origin\_address=[xx.xx.xx.xx], principal=[\_xpack\_security], realm=[\_\_attach], roles=[superuser], action=[cluster:admin/xpack/security/realm/cache/clear], request=[ClearRealmCacheRequest]  
[2020-02-21T00:41:38,117] [ESIB] [transport] [access\_granted] origin\_type=[local\_node], origin\_address=[xx.xx.xx.xx], principal=[\_xpack\_security], realm=[\_\_attach], roles=[superuser], action=[cluster:admin/xpack/security/realm/cache/clear[n]], request=[Node]

In elasticsearch.yml, I have:

xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.key: /etc/elasticsearch/key.pem  
xpack.security.transport.ssl.certificate: /etc/elasticsearch/cert.pem  
xpack.security.transport.ssl.certificate\_authorities: ["/etc/elasticsearch/cacert.crt"]

xpack.security.http.ssl.enabled: true  
xpack.security.http.ssl.key: /etc/elasticsearch/key.pem  
xpack.security.http.ssl.certificate: /etc/elasticsearch/cert.pem  
xpack.security.http.ssl.certificate\_authorities: ["/etc/elasticsearch/cacert.crt"]  
xpack.security.http.ssl.supported\_protocols: ["TLSv1.2"]  
xpack.security.http.ssl.cipher\_suites: ["TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384"]

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [February 21, 2020, 3:48am UTC](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286/2 "2020-02-21T03:48:45Z")

</div>

Security licensing changed, but [according to this,](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free) only 6.8 and later.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2020, 3:48am UTC](https://discuss.elastic.co/t/need-help-with-xpack-security-authentication-in-6-3-1/220286/3 "2020-03-20T03:48:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.