# Secure my ELK - nginx credentials

**URL:** <https://discuss.elastic.co/t/secure-my-elk-nginx-credentials/170521>\
**Category:** Kibana\
**Created:** [March 1, 2019, 2:59pm UTC](https://discuss.elastic.co/t/secure-my-elk-nginx-credentials/170521 "2019-03-01T14:59:26Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Matt\_Vasquez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matt_vasquez/32/22088_2.png) [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\
**Post date:** [March 5, 2019, 9:37pm UTC](https://discuss.elastic.co/t/secure-my-elk-nginx-credentials/170521/3 "2019-03-05T21:37:54Z")

</div>

A popup authentication from NGINX or Kibana?

What you probably want is NGINX to pass its credentials from your web app to Kibana right?

If so you need to use the following configuration line in your elasticsearch.yml config file:

```
elasticsearch.requestHeadersWhitelist: [es-security-runas-user, authorization]

```

Then you should add a user in Kibana, I called mine "nginx"

Create a role for this user, I called mine "nginx" as well. Leave all everything default with no permissions to anything except add the users you want authenticated through NGINX to the "Run As privileges" section.

You need to base 64 encode the username:password for the NGINX account in Kibana.  
the one shown below ("bmdpbng6c2VjcmV0cGFzc3dvcmQ=") is base 64 encoding of nginx:secretpassword

$NAME\_OF\_HEADER\_WITH\_USER\_TO\_RUN\_AS shown below should be a named header that your application uses to pass the username you want authenticated into Kibana. The username from the web app and Kibana must match exactly, as this is what allows the NGINX user in Kibana to run as another user. This would be a header such as $http\_x\_forwarded\_user.

add these two lines to your nginx config:

```
proxy_set_header Authorization "Basic bmdpbng6c2VjcmV0cGFzc3dvcmQ=";
proxy_set_header es-security-runas-user $NAME_OF_HEADER_WITH_USER_TO_RUN_AS;

```

Hope this makes sense..

Check out this blog for more detail:

> **[User Impersonation with X-Pack: Integrating Third Party Auth with Kibana
	  	 |...](https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana)**
>
> X-Pack Security is a fantastic way to secure your cluster, providing both authentication and authorization via RBAC. The authentication aspect is managed by services known as realms. Security ships wi...

---

_[View the full topic](https://discuss.elastic.co/t/secure-my-elk-nginx-credentials/170521)._