# \[SHIELD\] Kibana to Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 28, 2016, 3:07pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368 "2016-11-28T15:07:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [November 28, 2016, 3:07pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/1 "2016-11-28T15:07:21Z")
Hi Everyone, I stuck on an issue connection Kibana and Elasticsearch with Shield. Shield version is 2.4 Kibana version is 4.6.1 Elasticsearch version is 2.4 I have configured an ldap for authentication in elasticsearch. From now, I can see I error when I try to log into kibana with a user: [security\_exception] action [cluster:monitor/nodes/info] is unauthorized for user [kibana-server] In ElasticSearch logs I have: [2016-11-28 15:48:34,746][DEBUG][indices.cluster] [node\_serverlog] [logstash-2016.11.22] adding mapping [logs] (source suppressed due to length, use TRACE level if needed) [2016-11-28 15:48:34,761][DEBUG][shield.authc.support] [node\_serverlog] the roles [[]], are mapped from these [ldap] groups [[]] for realm [ldap/ldap1] [2016-11-28 15:48:34,762][DEBUG][shield.authc.support] [node\_serverlog] the roles [[]], are mapped from the user [ldap] for realm [uid=kibana-server,ou=xxxx,ou=yyyyyy,ou=zzzzzz,dc=exemple,dc=com/ldap] [2016-11-28 15:48:34,779][DEBUG][shield.authc.ldap] [node\_serverlog] authenticated user [kibana-server], with roles [[]] [2016-11-28 15:48:34,796][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine. In Kibana logs I have: {"type":"log","@timestamp":"2016-11-28T14:48:21Z","tags":["error","elasticsearch"],"pid":573,"message":"Request error, retrying -- connect ECONNREFUSED 192.116.9.16:9200"} {"type":"log","@timestamp":"2016-11-28T14:48:21Z","tags":["status","plugin:elasticsearch@1.0.0","error"],"pid":573,"state":"red","message":"Status changed from red to red - Unable to connect to Elasticsearch at [https://node:9200](https://node:9200).","prevState":"red","prevMsg":"[security\_exception] action [cluster:monitor/nodes/info] is unauthorized for user [kibana-server]"} {"type":"log","@timestamp":"2016-11-28T14:48:34Z","tags":["status","plugin:elasticsearch@1.0.0","error"],"pid":573,"state":"red","message":"Status changed from red to red - [security\_exception] action [cluster:monitor/nodes/info] is unauthorized for user [kibana-server]","prevState":"red","prevMsg":"Unable to connect to Elasticsearch at [https://oslxlog22.sogecap.socgen:9200](https://oslxlog22.sogecap.socgen:9200)."} Is this a SSL issue or a role mapping issue? I'm a bit lost... 😥 I thank you for any help anyone can give me on this issue... Best Regards, Del ---
**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\ **Post date:** [November 28, 2016, 11:39pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/2 "2016-11-28T23:39:38Z")
Hi @Del could you share your configuration .yml files? Perhaps first thing to check into; for LDAP integration, check that your distinguished names match your config. [https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html#mapping-roles-ldap](https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html#mapping-roles-ldap) ---
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [November 29, 2016, 8:26am UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/3 "2016-11-29T08:26:19Z")
Hello @thomasneirynck, Thanks for your reply! Here are my .yml config files * * * role\_mapping.yml kibana4\_server: - "cn=kibana-server, ou=xxx,ou=yyy,ou=zzz,dc=exemple,dc=com " kibana\_user: - " cn=un\_groupe\_anonymisé , ou=xxx,ou=yyy,ou=zzz,dc=exemple,dc=com " * * * roles.yml kibana4\_server: cluster: - monitor indices: - names: '.kibana' privileges: - all kibana\_user: cluster: - monitor indices: - names: 'logstash-_' privileges: - view\_index\_metadata - read - names: 'kibana-int' privileges: - view\_index\_metadata - read - names: '.kibana_' privileges: - manage - read - index * * * Shield configuration in elasticsearch.yml shield.http.ssl: true ### LDAP shield: authc: realms: ldap1: type: ldap order: 0 url: "ldap://serverldap:1389" bind\_dn: "uid=kibana-server,ou=xxx,ou=yyy,ou=zzz,dc=exemple,dc=com" bind\_password: "un\_secret\_anonymisé" user\_search: base\_dn: "ou=xxx,ou=yyy,ou=zzz,dc=exemple,dc=com " attribute: uid group\_search: base\_dn: "cn=grp-ES, ou=xxx,ou=yyy,ou=zzz,dc=exemple,dc=com " attribute: uid files: role\_mapping: "/appservers/conf/shield/role\_mapping.yml" unmapped\_groups\_as\_roles: true Writing my config files makes me having a question : Is it ok to have same ldap group in elasticsearch.yml and role\_mapping.yml? Thanks a lot for your help! Best Regards, Del ---
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [November 29, 2016, 3:09pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/4 "2016-11-29T15:09:16Z")
Ok I have chance to move forward, and get the user map to a role. In fact, I did have user 'kibana-server' declared in kibana.yml. I just delete these 2lines and I was able to get the user map to [my\_kibana\_user] role. But always have 'Failed to clean up SSLEngine'. I was thinking of cert issue, so I did make new cert and keystore. But now It appears that I can't establish the connection from kibana to elasticsearch -\> Do I need to create new topic? Thks a lot in advance. Del ---
**Author:** ![imHarshj](https://avatars.discourse-cdn.com/v4/letter/i/e495f1/32.png) [@imHarshj](https://discuss.elastic.co/u/imHarshj)\ **Post date:** [November 29, 2016, 3:19pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/5 "2016-11-29T15:19:36Z")
I see two things.. your kibana4-server should have access to '.kibana\*' index. You have '.kibana' Also the port for the ldap server is usually 386 for non-ssl, and 636 for ssl enabled. Please check these two. I think this is an issue with the role/role\_mapping/Ldap. SSL seems fine. ---
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [November 29, 2016, 4:10pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/6 "2016-11-29T16:10:21Z")
damn you rock @imHarshj ! you have good eyes I move again one step forward 😄 now I have: [2016-11-29 17:05:51,629][DEBUG][shield.authc.ldap] [node\_oslxlog22] authenticated user [kibana-server], with roles [[kibana4\_server]] [2016-11-29 17:05:51,630][DEBUG][rest.suppressed] path: /kibana4-int/config/\_search, params: {index=kibana4-int, type=config} ElasticsearchSecurityException[action [indices:data/read/search] is unauthorized for user [kibana-server]] I see there's other topics with this same problem. Again thanks a lot for your help ! Best Regards, Del ---
**Author:** ![imHarshj](https://avatars.discourse-cdn.com/v4/letter/i/e495f1/32.png) [@imHarshj](https://discuss.elastic.co/u/imHarshj)\ **Post date:** [November 29, 2016, 7:47pm UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/7 "2016-11-29T19:47:28Z")
In the elasticsearch.yml, do you have: elasticsearch.username: "kibana-server" elasticsearch.password: "yourpassword" Restart kibana/elasticsearch service if you haven't. Seems like the role/role\_mapping are setup right. ---
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [November 30, 2016, 9:11am UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/8 "2016-11-30T09:11:01Z")
Hello, I now have it. I will let you know if it works better. Thanks @imHarshj ---
**Author:** ![Del](https://avatars.discourse-cdn.com/v4/letter/d/bb73d2/32.png) [@Del](https://discuss.elastic.co/u/Del)\ **Post date:** [December 2, 2016, 10:51am UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/9 "2016-12-02T10:51:34Z")
Hello, Just a little confirmation, It works much better now. Thanks a lot guys for your help! I just have a little with ldap group authentication (to restrict the index view and who can log in) I posted another topic with that issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 30, 2016, 10:52am UTC](https://discuss.elastic.co/t/shield-kibana-to-elasticsearch/67368/10 "2016-12-30T10:52:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.