# Session mangement in kibana server **URL:** \ **Category:** Kibana\ **Created:** [May 28, 2018, 6:21pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579 "2018-05-28T18:21:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sandhya\_kumari](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@sandhya\_kumari](https://discuss.elastic.co/u/sandhya_kumari)\ **Post date:** [May 28, 2018, 6:21pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/1 "2018-05-28T18:21:52Z")
If a user say (bob) logs in to kibana and then another user say (Alice) also logs in to kibana. How does kibana create dedicated sessions for both of them logged in to kibana at the same time? Moreover how does it differentiate those sessions and how does it kills those sessions when the user logs out of kibana? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [May 28, 2018, 6:52pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/2 "2018-05-28T18:52:09Z")
Hi @sandhya_kumari, If [**basic** authentication](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#_basic_authentication) is used then session information is encrypted and stored into the cookie, so it's purely client-side session. This cookie is sent by the browser with every request, so Kibana can decrypt it and properly authenticate the user. Depending on the value set in `xpack.security.sessionTimeout` session will auto expire after a predefined timeout or/and when user logs out (session cookie is cleared). The [**saml** authentication](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#_saml_single_sign_on) and logout are more complex, feel free to read through and ask here if you still have any questions. Best, Oleg ---
**Author:** ![sandhya\_kumari](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@sandhya\_kumari](https://discuss.elastic.co/u/sandhya_kumari)\ **Post date:** [May 28, 2018, 7:28pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/3 "2018-05-28T19:28:42Z")
ok.. I got it but when we create a user with the user mangement api , then the post request goes to say(localhost:9200/\_xpack/security/user/jacknich) which is the port of elasticsearch, so is the user created in kibana server or the elasticsearch ?. If kibana why we are submitting the request to 9200 and how does those users are seen in Management/security/users tab in kibana? ---
**Author:** ![sandhya\_kumari](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@sandhya\_kumari](https://discuss.elastic.co/u/sandhya_kumari)\ **Post date:** [May 28, 2018, 7:31pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/4 "2018-05-28T19:31:07Z")
One more query.. You said that it is purely client side session , so no session occurs in the server, then how does kibana server manages the requests of different users without overlapping them? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [May 28, 2018, 8:24pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/5 "2018-05-28T20:24:01Z")
> ok.. I got it but when we create a user with the user mangement api , then the post request goes to say(localhost:9200/\_xpack/security/user/jacknich) which is the port of elasticsearch, so is the user created in kibana server or the elasticsearch ?. If kibana why we are submitting the request to 9200 and how does those users are seen in Management/security/users tab in kibana? > One more query.. You said that it is purely client side session , so no session occurs in the server, then how does kibana server manages the requests of different users without overlapping them? When you create user through User Managemenet API all relevant information is stored in Elasticsearch, including username and password **hash**. When user logs in, Kibana **encrypts** username/password pair and stores it in the cookie. Then when Kibana receives subsequent requests, it decrypts cookie, extracts user information and asks Elasticsearch to verify whether username/password pair is correct. If it's then Elasticsearch returns all information that Kibana may want to know (e.g. user roles). That's how **basic** authentication works internally right now, that may and most likely will change in the future. Best, Oleg ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2018, 8:24pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579/6 "2018-06-25T20:24:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.