# Sporadic failures with X-Pack/Shield **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [February 23, 2017, 3:46pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259 "2017-02-23T15:46:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Greek0](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Greek0](https://discuss.elastic.co/u/Greek0)\ **Post date:** [February 23, 2017, 3:46pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/1 "2017-02-23T15:46:53Z")
We started using xpack/shield with ElasticSearch 5.2. Unfortunately, we get random auth errors and can't even get logstash running because of it (it was running fine before). When requesting [http://kibana:9200/\_template/my-index-template](http://kibana:9200/_template/my-index-template) with correct auth headers via Postman, we sometimes get a successful result, the rest of the time we get the following error. It's the exact same request both times, once it works, once it doesn't. ``` { "error": { "root_cause": [ { "type": "security_exception", "reason": "error attempting to authenticate request", "header": { "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\"" } } ], "type": "security_exception", "reason": "error attempting to authenticate request", "caused_by": { "type": "illegal_state_exception", "reason": "authentication is already present in the context" }, "header": { "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\"" } }, "status": 401 } ``` Logs: ``` [2017-02-23T15:37:14,191] [transport] [access_granted] origin_type=[rest], origin_address=[10.15.66.199], principal=[logstash_internal], action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] [2017-02-23T15:37:15,365] [transport] [access_granted] origin_type=[rest], origin_address=[10.15.66.199], principal=[logstash_internal], action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] [2017-02-23T15:37:15,936] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-23T15:37:16,375] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] ``` We use the "logstash\_internal" user with role "logstash\_writer", taken from [this setup](https://www.elastic.co/guide/en/x-pack/current/logstash.html#ls-http-auth-basic). I've temporarily given logstash\_writer all privileges I could find. Given the sporadic nature of the problem, I guess that's not the cause. \_xpack/security/role/logstash\_writer: ``` {"logstash_writer":{"cluster":["manage_index_templates","monitor","all","manage","manage_security"],"indices":[{"names":["logstash-*","otherindex1-*","thing-requests-new-*","thing-requests-*"],"privileges":["write","delete","create_index","all"],"field_security":{"grant":["*"]}}],"run_as":[],"metadata":{},"transient_metadata":{"enabled":true}}} ``` \_xpack/security/user/logstash\_internal: ``` {"logstash_internal":{"username":"logstash_internal","roles":["logstash_writer"],"full_name":"Internal Logstash User","email":"devnull@dev-null.at","metadata":{},"enabled":true}} ``` Elasticsearch config: ``` path.data: /var/lib/elasticsearch/data network.host: localhost network.bind_host: 0.0.0.0 http.port: 9200 node.max_local_storage_nodes: 1 action.destructive_requires_name: true indices.fielddata.cache.size: 20% xpack.security.audit.enabled: true xpack: security: authc: realms: ldap1: type: ldap order: 0 url: "ldaps://XXXXXXXXXX:636" bind_dn: "uid=kibana,ou=XXXXXXX" bind_password: XXXXXXXXX user_search: base_dn: "XXXXXXX" attribute: uid group_search: base_dn: "XXXXXXXXX" files: role_mapping: "CONFIG_DIR/x-pack/role_mapping.yml" unmapped_groups_as_roles: true xpack: security: authc: realms: native1: type: native order: 1 action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history* ``` ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 27, 2017, 12:44pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/2 "2017-02-27T12:44:31Z")
Hi @Greek0, I am sorry that you're seeing this error. Do you happen to have access to the elasticsearch log file? If so there should hopefully be a stacktrace for this. Also, is this 5.2.0 or 5.2.1? ---
**Author:** ![Greek0](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Greek0](https://discuss.elastic.co/u/Greek0)\ **Post date:** [February 27, 2017, 3:25pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/3 "2017-02-27T15:25:51Z")
Hi @jaymode, thanks a lot for your reply! Neither elasticsearch.log nor elasticsearch\_access.log contained much interesting information: ``` [2017-02-27T15:16:38,369][INFO][o.e.p.PluginsService] [KB_AfTW] loaded plugin [x-pack] [2017-02-27T15:16:39,764][DEBUG][o.e.a.ActionModule] Using REST wrapper from plugin org.elasticsearch.xpack.XPackPlugin [2017-02-27T15:16:40,961][INFO][o.e.n.Node] initialized ``` access.log: ``` [2017-02-27T15:17:37,449] [transport] [access_granted] origin_type=[rest], origin_address=[10.15.66.199], principal=[logstash_internal], action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] [2017-02-27T15:17:42,136] [transport] [access_granted] origin_type=[rest], origin_address=[10.15.66.199], principal=[logstash_internal], action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] [2017-02-27T15:17:42,301] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:42,492] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:42,687] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:42,859] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:43,048] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:43,224] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:17:43,418] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:18:18,237] [rest] [authentication_failed] origin_address=[10.15.66.199], principal=[logstash_internal], uri=[/_template/my-index-template] [2017-02-27T15:22:06,227] [transport] [access_granted] origin_type=[rest], origin_address=[10.15.66.199], principal=[logstash_internal], action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] ``` All those times, I sent exactly the same request with postman. Puzzling ☹ ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 27, 2017, 4:40pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/4 "2017-02-27T16:40:13Z")
Do you mind trying to reproduce with the `?error_trace=true` appended to the URL? ---
**Author:** ![Greek0](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Greek0](https://discuss.elastic.co/u/Greek0)\ **Post date:** [February 28, 2017, 7:36am UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/5 "2017-02-28T07:36:12Z")
I didn't know about error\_trace, thanks. I added it and got [this](http://pastebin.com/GC95EQmy) (content too long for Discourse). ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 28, 2017, 12:22pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/6 "2017-02-28T12:22:07Z")
Thanks for the stack trace. Edit: looks like you already added your config. Sorry. We're looking into this. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 28, 2017, 7:51pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/7 "2017-02-28T19:51:53Z")
@Greek0 Can you try adding `user_search.pool.enabled: false` to your LDAP realm's configuration? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 28, 2017, 7:51pm UTC](https://discuss.elastic.co/t/sporadic-failures-with-x-pack-shield/76259/8 "2017-03-28T19:51:58Z")
Closed on March 28, 2017, 7:51pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.