# QUESTION : Disable access to Kibana Console when using ELK inside a webapp **URL:** \ **Category:** Kibana\ **Created:** [June 12, 2020, 7:44pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938 "2020-06-12T19:44:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![tenet\_testuser1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tenet_testuser1/32/67526_2.png) [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Post date:** [June 12, 2020, 7:44pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/1 "2020-06-12T19:44:49Z")
Need some proper guidance on setting up security in ELK. Problem Definition: I have a webapp that will display Kibana reports and dashbaords. The ""iframe" url is embedded to various menu/submenu in my app that will display reports. I am able to get this to work. However, when users go to [app.domain.com:5601](http://app.domain.com:5601) they can access the console... this is a serious issue I would like to address. I want to restrict users from accessing the console and just be able to view kibana reports. Any suggestions appreciated. I have taken many routes to address this problem with (TLS on ES, and KIbana), securing (Kibana to ES) etc which I am not sure is really addressing my core problem. Thanks in advance. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [June 16, 2020, 6:04pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/2 "2020-06-16T18:04:07Z")
Can you share a screenshot showing the problem? I'm unsure how the users might be doing this. Thanks, Matt ---
**Author:** ![tenet\_testuser1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tenet_testuser1/32/67526_2.png) [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Post date:** [June 16, 2020, 7:33pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/3 "2020-06-16T19:33:40Z")
![kibana-1](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f52a80f2b5cd316f2e20fc9d98c276ae1cbc196.png) ![Kibana-Report-shown](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a47ef1d9281d74f4b93be63dd1409b8f7f234b2.png) 1st screenshot shows , that when I clock on the buttons above (it invokes kibana report).... 2nd shows a working kibana report 1. shows how when the user updates the url and change it to domainname:5601, then can go to console. I purposefully did not show the url but I am sure its illustrative. ![kibana-wide-open](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a11ddee3d3e301160aef4fb03b12ccc9c96d6387.png) Here is what I have done. - When I enable xpack.security on elastic and kibana, then, clicking on the report buttons puts me on a login window. I prefer the users authenticated behind the scenes and the reports shows up. - I assume, with xpack enabled, the cannot reach the console/management pages by simply going to 5601. I can test it. But wanted to confirm as well. Thanks in advance. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [June 16, 2020, 7:55pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/4 "2020-06-16T19:55:00Z")
The first thing I recommend is making sure Kibana roles are set appropriately - [https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html) Past that, there still may be urls that you want to restrict. I'd recommend using a proxy server in front of kibana to address that. Thanks, Matt ---
**Author:** ![tenet\_testuser1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tenet_testuser1/32/67526_2.png) [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Post date:** [June 16, 2020, 8:15pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/5 "2020-06-16T20:15:09Z")
I am looking for a solution using an API call with an encrypted id/password credentails being passed to access the kibana reports. In my app, all registered users are OAUTH'd into the app, once they are logged in, they all have access to all reports. So having some sort of API call with a KEY that authenticates and displays the report is ideal. Any such options/steps you can suggest? thanks in advance. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [June 16, 2020, 10:44pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/6 "2020-06-16T22:44:48Z")
I assume you've implemented an OAUTH based authentication mechanism. Here are some ways to authenticate with kibana - [https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html) I'm not sure which options suits your needs best. ---
**Author:** ![tenet\_testuser1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tenet_testuser1/32/67526_2.png) [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Post date:** [June 17, 2020, 5:07pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/7 "2020-06-17T17:07:26Z")
so I need to have TLS - between kibana and elastic TLS- between kibana cluster (currently I don't have a cluster) but if I did... TLS between client (web browser) and elastic and then test the API based option? Is that the list of steps? I have some implemented but would like to know the overall steps to get this accomplished. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [June 18, 2020, 3:29pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/8 "2020-06-18T15:29:35Z")
@tenet_testuser1 Yes, you want security enabled on your ES cluster and between the cluster and Kibana. I would do that first and then work on automating authentication with kibana. ---
**Author:** ![tenet\_testuser1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tenet_testuser1/32/67526_2.png) [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Post date:** [June 24, 2020, 2:49pm UTC](https://discuss.elastic.co/t/question-disable-access-to-kibana-console-when-using-elk-inside-a-webapp/236938/9 "2020-06-24T14:49:54Z")
@mattkime Thanks for your pointers... with your help and the amazing post and links in these posts. we were able to achieve what we wanted. thanks again. posting the link for my fellow future kibanites... > [@Auto-authenticating to iframe-embedded Kibana dashboard](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091): > > I have a Shield-protected Kibana 4.5 dashboard that I'm embedding via iframe. Is there any way to programmatically provide the user/password so that the user automatically auths and the dashboard is displayed? I've attempted the following with no luck: \