# Shield accepts any username/password combination **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 23, 2016, 6:01pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269 "2016-03-23T18:01:56Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 24, 2016, 7:29pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/21 "2016-03-24T19:29:00Z")
Why does the message say it can't authenticate the user to the domain? I thought the user does not need to exist on the domain (kibana4-server)? If not, that is a very misleading error message and I think Elastic should revisit how they're logging that. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [March 24, 2016, 7:40pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/22 "2016-03-24T19:40:14Z")
Realms are defined in a chain, so each realm that supports a type of token will be called in order until one has successful authentication or the chain ends. Can you share your full configuration? I am not sure but maybe docker plays an issue here. What image are you using? ---
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 24, 2016, 7:48pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/23 "2016-03-24T19:48:08Z")
ES config :: [cluster.name](http://cluster.name): TrainingProd [node.name](http://node.name): "Training1 - Wolverine" path.conf: /data/elk-conf path.data: /data/elasticsearch\_data path.logs: /data/elasticsearch\_data/elastic\_logs bootstrap.mlockall: true network.bind\_host: 0.0.0.0 network.publish\_host: 10.183.216.30 transport.tcp.port: 9300 http.port: 9200 gateway.recover\_after\_nodes: 3 gateway.recover\_after\_time: 5m gateway.expected\_nodes: 4 discovery.zen.minimum\_master\_nodes: 3 discovery.zen.ping.multicast.enabled: false discovery.zen.ping.unicast.hosts: ["10.183.216.30", "10.183.216.31", "10.183.216.32"] cloud: azure: storage: account: "account" key: "key" node.box\_type: hot shield.authc.realms: esusers: type: esusers order: 0 active\_directory: type: active\_directory order: 1 domain\_name: [mydomain.com](http://mydomain.com) unmapped\_groups\_as\_roles: true url: ldap://dc01.mydomain.com Kibana config :: port: 5601 host: "0.0.0.0" elasticsearch\_url: "[http://10.183.216.30:9200](http://10.183.216.30:9200)" elasticsearch\_preserve\_host: true elasticsearch.username: "kibana4-server" elasticsearch.password: "kibanaserverpw" server.ssl.key: /data/elk-conf/nginx-kibana.key server.ssl.cert: /data/elk-conf/nginx-kibana.crt shield.encryptionKey: "encryptionkeyhere" kibana\_index: ".kibana" default\_app\_id: "discover" request\_timeout: 600000 shard\_timeout: 0 verify\_ssl: true bundled\_plugin\_ids: - plugins/dashboard/index - plugins/discover/index - plugins/doc/index - plugins/kibana/index - plugins/markdown\_vis/index - plugins/metric\_vis/index - plugins/settings/index - plugins/table\_vis/index - plugins/vis\_types/index - plugins/visualize/index NGINX Reverse Proxy Config :: server { listen 80; return 301 https://$host$request\_uri; } server { listen 443; ssl\_certificate /data/elk-conf/nginx-kibana.crt; ssl\_certificate\_key /data/elk-conf/nginx-kibana.key; ssl on; ssl\_session\_cache builtin:1000 shared:SSL:10m; ssl\_protocols TLSv1 TLSv1.1 TLSv1.2; ssl\_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; ssl\_prefer\_server\_ciphers on; access\_log /data/nginx/log/access\_nginx-kibana.conf.log; location / { proxy\_set\_header Host $host; proxy\_set\_header X-Real-IP $remote\_addr; proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; proxy\_set\_header X-Forwarded-Proto $scheme; proxy\_connect\_timeout 600s; proxy\_read\_timeout 600s; proxy\_send\_timeout 600s; proxy\_next\_upstream\_timeout 600s; # Fix the ???It appears that your reverse proxy set up is broken" error. proxy\_pass [https://10.183.216.30:5601](https://10.183.216.30:5601); } } /etc/elasticsearch/shield/role\_mapping.yml :: power\_user: - "cn=TheGroup,OU=TheOU,OU=Security Groups,OU=AnotherOU,DC=mydomain,DC=com" ---
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 24, 2016, 7:53pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/24 "2016-03-24T19:53:33Z")
ES 2.2 Kibana 4.4 CentOS 7.1 ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [March 25, 2016, 10:24am UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/25 "2016-03-25T10:24:26Z")
> [@Michael1](#): > > path.conf: /data/elk-conf This is what is causing the esusers realm to fail. If you have a `/etc/sysconfig/elasticsearch` file, then it most likely defines the `CONF_DIR` as `/etc/elasticsearch` so this is what the `esusers` CLI tool thinks is the configuration directory but your elasticsearch instance is actually using `/data/elk-conf`. At runtime Shield does not find the users or users\_roles files. To fix this: 1. Copy/move the directory `/etc/elasticsearch/shield` to `/data/elk-conf/shield`. This should result in file paths like `/data/elk-conf/shield/users` and `/data/elk-conf/shield/roles.yml` 2. Update the `/etc/sysconfig/elasticsearch` file to point to the proper `CONF_DIR`. Alternatively, you can always pass the option `-Des.path.conf=/data/elk-conf` when using the esusers tool. For example: `bin/shield/esusers useradd michael -r admin -Des.path.conf=/data/elk-conf` ---
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 25, 2016, 2:55pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/26 "2016-03-25T14:55:27Z")
I tried that, but this happened :: ERROR: Unrecognized option: -Des.path.conf=/data/elk-conf Also, inside of the elasticsearch container, I do not have an /etc/sysconfig, on the host VM I do, but there is no elasticsearch file ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [March 25, 2016, 3:05pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/27 "2016-03-25T15:05:45Z")
My apologies, that option was for a different tool. Just verified that this works: `bin/shield/esusers useradd michael -r admin --path.conf=/data/elk-conf` Before using this command make sure `/data/elk-conf/shield` exists and is writeable by the user who is running the esusers command. ---
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 25, 2016, 3:56pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/28 "2016-03-25T15:56:54Z")
I was able to get in after I copied the folder...I suppose this --path.conf flag will need to be added for any esusers created, since the folder needed to be copied. Well, I guess it wouldn't be a big deal now since we can authenticate via AD. Hooray to being able to get to logs using my AD account! ---
**Author:** ![Michael1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael1/32/29279_2.png) [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Post date:** [March 25, 2016, 4:23pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/29 "2016-03-25T16:23:07Z")
When you generate a self-signed certificate, and configure it via the following way :: shield.ssl.keystore.path: /etc/elasticsearch/self-signed.jks shield.ssl.keystore.password: $password shield.ssl.hostname\_verification: false shield.transport.ssl: true shield.http.ssl: true Is this encrypting the initial authentication of the esuser before Active Directory authentication is attempted? So to have total encryption we would need to do this + configure encryption for Active Directory? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269/30 "2017-07-06T13:45:38Z")
Closed on July 6, 2017, 1:45pm UTC [Previous page](https://discuss.elastic.co/t/shield-accepts-any-username-password-combination/45269.md?page=1)