# Restricting kibana access - iframe
**URL:** https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455
**Category:** Kibana
**Created:** [September 29, 2022, 1:20pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455 "2022-09-29T13:20:03Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [September 29, 2022, 1:20pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/1 "2022-09-29T13:20:03Z")
Hi,
We have a kibana instance and we are using kibana iframe embedding into our application page. This is working fine, the problem that we are facing is that we have different clients and for every client we have created different dashboards.
Now we know that if we want to bypass login in the iframe we need to use anonymous user, so I have implemented that as well. So now the anonymous user has access to all dashboards.
What we want to achieve is that the kibana URL shouldn't be accessible from public network, but it should be accessible from our DNS for e.g. lets say our application's URL is **[abc.com](http://abc.com)** and kibana is mapped to **[kibana.com](http://kibana.com)**.
We want to only access **[kibana.com](http://kibana.com)** when it is accessed from **[abc.com](http://abc.com)** i.e. accessed from the iframe, **[kibana.com](http://kibana.com)** should not be accessible from public networks, only from **[abc.com](http://abc.com)**.
_Now I know this is not a typical kibana issue, there is networking which needs to be done, but since I'm stuck on this issue for a very long time, I'm writing here in hopes of getting any kind of help._
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [October 5, 2022, 5:58pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/2 "2022-10-05T17:58:17Z")
By "accessed from [abc.com](http://abc.com)" do you mean if kibana is embedded as an iframe on [abc.com](http://abc.com) ?
You can configure these things using the x-frame-options header [X-Frame-Options - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) , but I'm not sure it's actually what you want - it relies on the client being "honest" about where it's coming from, and it's very easy to circumvent this check.
So is your question about making it impossible to stumble over the other dashboards by accident, or is it about making it impossible for one client to snoop into the dashboards of another client?
If it's the latter, then you will need to implement a proper access control which is possible even within an iframe.
---
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [October 6, 2022, 4:48am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/3 "2022-10-06T04:48:54Z")
Hi @flash1293,
Yes that's right, I'm embedding the **iframe** in **[abc.com](http://abc.com)** and as we know that we can have only one anonymous provider per **kibana** instance.
My main concern is that one **client** may **accidentally** stumble upon the **data** of other client and I need to **restrict** that because the **anonymous** user have access to all dashboards pertaining to several clients.
Regarding the **access control** you have mentioned, if you can suggest how to do that it would be really helpful for me.
Or if there is any way to **restrict dashboards** it would be useful to know as well.
Thanks
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [October 6, 2022, 7:47am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/4 "2022-10-06T07:47:47Z")
It seems like the best approach would be to have a user per client (see [Authentication in Kibana | Kibana Guide [8.4] | Elastic](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html)), then put the dashboards per client into separate spaces and restrict the user per client to only have access to their respective space. Spaces are the right level of isolation for multi tenancy: [Spaces | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/xpack-spaces.html)
---
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [October 6, 2022, 7:55am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/5 "2022-10-06T07:55:01Z")
Thanks for the response, but in this solution the client would need to login I guess to see the dashboard everytime.
I wanted to bypass authentication on the iframe, for bypassing we need to use anonymous authentication and that can only be one per kibana instance.
Is there anything else I can do?
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [October 6, 2022, 8:01am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/6 "2022-10-06T08:01:17Z")
You can do the spaces thing and only send each client to their own space. However, I highly recommend putting proper authentication in place. You can use single sign on approaches if the client is already authenticated elsewhere.
---
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [October 6, 2022, 9:14am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/7 "2022-10-06T09:14:13Z")
Hi @flash1293 ,
Even if I create spaces for different users, when I use anonymous authentication in iframe, I can only give credentials of one user in the kibana.yml.
Can you explain this a little bit more, maybe I'm not able to understand this properly?
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [October 6, 2022, 10:00am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/8 "2022-10-06T10:00:42Z")
You need to adjust the iframe url to point to the appropriate space for each user
---
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [October 6, 2022, 10:22am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/9 "2022-10-06T10:22:24Z")
Hi @flash1293
I tried that as well, but as there is one anonymous user and one role for that anonymous user, I have to give access to all spaces to that role. So still the client can stumble on to other client's data.
I'll explain how I have configured anonymous access in iframe, I created a role and gave that role the access to see dashboards. I assigned one user to that role and used that user's credentials in the kibana.yml in auth providers section for anonymous.
I really appreciate your help on this, if there is something else I can try please suggest or if I'm doing this all wrong you can correct me.
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [October 6, 2022, 7:15pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/10 "2022-10-06T19:15:03Z")
Hi @shivendra95,
I have seen examples where a keycloak was configured in front of the Kibana instance. Authentication was disabled in Kibana and sso was provided with keycloak. I have not dont this myself, but maybe it might be a solution for your problem.
Willem
---
### Author:  [@shivendra95](https://discuss.elastic.co/u/shivendra95)
#### Post date: [October 10, 2022, 11:25am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/11 "2022-10-10T11:25:10Z")
But even for keycloak, initially the user needs to be logged in. I don't think in iframe I will be able to bypass that, the login page would still come
---
### Author:  [@flash1293](https://discuss.elastic.co/u/flash1293)
#### Post date: [October 11, 2022, 12:27pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/12 "2022-10-11T12:27:02Z")
If you want to restrict access, then the data source needs to know who's trying to access in the first place. This is a fundamental requirement. I suspect the user is already logged in in your system, you can try to re-use that, with a solution like keycloak in front of Kibana.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 8, 2022, 4:47am UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/13 "2022-11-08T04:47:47Z")
---
### Author:  [@trm](https://discuss.elastic.co/u/trm)
#### Post date: [November 9, 2022, 9:32pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/14 "2022-11-09T21:32:02Z")
Hello,
We have a similar use case to @shivendra95. We would like to know, what is the recommended approach for interactive users accessing Kibana embedded in iframe while ensuring they do not have to explicitly enter passwords as they are already authenticated in our admin portal? We had planned on using API key authentication with some middleware, but see that it has been deprecated for interactive users.
Some requirements:
- No one should be able to access our Kibana URL directly (without providing credentials). Must be accessed through our admin portal.
- Users authenticated in admin portal will not need to enter credentials.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2022, 9:32pm UTC](https://discuss.elastic.co/t/restricting-kibana-access-iframe/315455/15 "2022-12-07T21:32:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.