# Segurity Problem using X-pack with 5.0.1 **URL:** \ **Category:** Elasticsearch\ **Created:** [December 7, 2016, 12:28pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298 "2016-12-07T12:28:15Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![olorasde](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olorasde/32/40103_2.png) [@olorasde](https://discuss.elastic.co/u/olorasde)\ **Post date:** [December 7, 2016, 12:28pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298/1 "2016-12-07T12:28:15Z")
Hi, Recently I start to configure my EL Cluster and Kibana aganist a AD. Im using 5.0.1 I preferred to start configuring my cluster aganist and simple LDAP. I use for this OpenDS. The main configuration in elasticsearch.yml is the next: > ``` > xpack.security.authc.realms: > ldap1: > type: ldap > order: 0 > url: "ldap://127.0.0.1:389" > user_dn_templates: > - "cn={0},ou=usuarios,dc=XXXXX,dc=com" > group_search: > base_dn: "ou=roles,dc=XXXXX,dc=com" > files: > role_mapping: "/XXXXX/cluster-elk/EL-node 1_MD-5.0.1/config/x-pack/role_mapping.yml" > unmapped_groups_as_roles: false > > ``` and my role-mapping.xml is like this; > ``` > role_app1: > - "cn=role_app1,ou=aplicacion,ou=roles,dc=XXXX,dc=com" > > ``` All is working good but my problem is: 1.- I log with my user asign to role\_app. Any problem 2.- I logout of kibana. 3.- In openDS, I change the password of my user. 4.- I try to login in kibana with the old password, and i can login.... Worst of all was that if I stop my openDS.... i can enter using old password.... If I have not made any configuration errors, I suspect that Xpack is internally saving the user and password and does not validate it against OpenDS anymore until a different user or password is entered. This is normal? Is there a way to force by configuration that you always have to validate the user and password against the external security provider? Thx! ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [December 7, 2016, 12:59pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298/2 "2016-12-07T12:59:52Z")
Hi @olorasde, The username and a hash of the password is being cached by x-pack for performance reasons. This can be disabled on a per realm basis. If you would like to disable it, in your `ldap1` realm settings, add `cache.ttl: -1`. Details about the cache settings: [https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html](https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html) ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [December 7, 2016, 1:12pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298/3 "2016-12-07T13:12:58Z")
One thing to keep in mind is that if you disable this cache, as @jaymode describes, _every request to Elasticsearch_ will make a request to your LDAP server to validate the user information, and this will slow your response times and put a lot of load on the LDAP server. ---
**Author:** ![olorasde](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olorasde/32/40103_2.png) [@olorasde](https://discuss.elastic.co/u/olorasde)\ **Post date:** [December 7, 2016, 2:16pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298/4 "2016-12-07T14:16:11Z")
Thx for information Jay and Steve. I assume that it is not currently possible to only force authentication in the login process, no? Using this configuration, in my elasticsearch log console has begun to appear this exceptions, any ideas? > ``` > [2016-12-07T15:31:36,713][ERROR][o.e.x.m.c.c.ClusterStatsCollector] [node-MD-1] collector [cluster-stats-collector] - failed collecting data > java.lang.NullPointerException > at org.elasticsearch.xpack.security.authc.support.CachingUsernamePasswordRealm.usageStats(CachingUsernamePasswordRealm.java:193) ~[?:?] > at org.elasticsearch.xpack.security.authc.ldap.support.AbstractLdapRealm.usageStats(AbstractLdapRealm.java:84) ~[?:?] > at org.elasticsearch.xpack.security.authc.ldap.LdapRealm.usageStats(LdapRealm.java:72) ~[?:?] > at org.elasticsearch.xpack.security.authc.Realms.lambda$usageStats$0(Realms.java:204) ~[?:?] > at org.elasticsearch.xpack.security.authc.Realms$$Lambda$1474/187280844.apply(Unknown Source) ~[?:?] > at java.util.HashMap.compute(HashMap.java:1188) ~[?:1.8.0_45] > at org.elasticsearch.xpack.security.authc.Realms.usageStats(Realms.java:202) ~[?:?] > at org.elasticsearch.xpack.security.SecurityFeatureSet.buildRealmsUsage(SecurityFeatureSet.java:118) ~[?:?] > at org.elasticsearch.xpack.security.SecurityFeatureSet.usage(SecurityFeatureSet.java:103) ~[?:?] > at org.elasticsearch.xpack.action.TransportXPackUsageAction$$Lambda$1473/1101385431.apply(Unknown Source) ~[?:?] > at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193) ~[?:1.8.0_45] > at java.util.Iterator.forEachRemaining(Iterator.java:116) ~[?:1.8.0_45] > at java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1801) ~[?:1.8.0_45] > at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:512) ~[?:1.8.0_45] > at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:502) ~[?:1.8.0_45] > at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_45] > at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_45] > at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_45] > at org.elasticsearch.xpack.action.TransportXPackUsageAction.masterOperation(TransportXPackUsageAction.java:65) ~[?:?] > at org.elasticsearch.xpack.action.TransportXPackUsageAction.masterOperation(TransportXPackUsageAction.java:39) ~[?:?] > at org.elasticsearch.action.support.master.TransportMasterNodeAction.masterOperation(TransportMasterNodeAction.java:86) ~[elasticsearch-5.0.1.jar:5.0.1] > at org.elasticsearch.action.support.master.TransportMasterNodeAction$AsyncSingleAction$3.doRun(TransportMasterNodeAction.java:170) ~[elasticsearch-5.0.1.jar:5.0.1] > at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:520) ~[elasticsearch-5.0.1.jar:5.0.1] > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-5.0.1.jar:5.0.1] > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[?:1.8.0_45] > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[?:1.8.0_45] > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_45] > > ``` Thx! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2017, 2:16pm UTC](https://discuss.elastic.co/t/segurity-problem-using-x-pack-with-5-0-1/68298/5 "2017-01-04T14:16:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.