# Startup files location

**URL:** https://discuss.elastic.co/t/startup-files-location/209073
**Category:** Kibana
**Created:** [November 22, 2019, 2:07pm UTC](https://discuss.elastic.co/t/startup-files-location/209073 "2019-11-22T14:07:06Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![julio.a.l](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@julio.a.l](https://discuss.elastic.co/u/julio.a.l)
#### Post date: [November 22, 2019, 2:07pm UTC](https://discuss.elastic.co/t/startup-files-location/209073/1 "2019-11-22T14:07:06Z")

</div>

Hi,  
I am developing an web application which has an embedded iframe with a dashboard from kiabana.  
As many others developers I nedd to bypass login of kibana and reverse proxy solution is not ok for me, so I cloned the repository from github and I would like modify the behavior of the kibana at startup so I can include a check for a cookie which is setted previously and with that cookie authenticate the user.  
My problem is that the project is very big and I am not able to find the files y have to modify. So could any one tell me which are the files in charge of init the app and show login page if necessary and the files involve in the process of set the session cookie once a valid user is logged in.  
Thank you so much.  
Greetings

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [November 22, 2019, 6:18pm UTC](https://discuss.elastic.co/t/startup-files-location/209073/2 "2019-11-22T18:18:10Z")

</div>

Hey @julio.a.l, have you investigated using either [SAML](https://www.elastic.co/guide/en/elasticsearch/reference/master/saml-guide.html) or [OpenID Connect](https://www.elastic.co/guide/en/elasticsearch/reference/master/oidc-guide.html) to facilitate single-sign-on between Kibana and the application embedding Kibana in an iframe? This doesn't require you to use a reverse-proxy.

Sharing cookies in the manner you've described has quite a few restrictions imposed by browsers, and it's generally fraught with issues. SAML and OIDC are well supported and documented protocols to enable this.

---

<div class="post-metadata">

### Author: ![julio.a.l](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@julio.a.l](https://discuss.elastic.co/u/julio.a.l)
#### Post date: [November 24, 2019, 5:39pm UTC](https://discuss.elastic.co/t/startup-files-location/209073/3 "2019-11-24T17:39:21Z")

</div>

Thank you @Brandon_Kobel, I will take a look at that.  
Just for the case it didn't work for me, could anyone tell me what are the files I was looking for?  
Thank you so much.  
Greetings.

---

<div class="post-metadata">

### Author: ![julio.a.l](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@julio.a.l](https://discuss.elastic.co/u/julio.a.l)
#### Post date: [November 27, 2019, 3:24pm UTC](https://discuss.elastic.co/t/startup-files-location/209073/4 "2019-11-27T15:24:05Z")

</div>

There is no one who can help me to find those files?.  
Thank you.

---

<div class="post-metadata">

### Author: ![julio.a.l](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@julio.a.l](https://discuss.elastic.co/u/julio.a.l)
#### Post date: [December 12, 2019, 10:51am UTC](https://discuss.elastic.co/t/startup-files-location/209073/5 "2019-12-12T10:51:45Z")

</div>

Just for any one who has a similar issue, I found that /{kibana\_path}/x-pack/legacy/plugins/security/public/views/login/, is a good start point in order to modify login behavior.  
I hope this helps.  
Greetings.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2020, 10:51am UTC](https://discuss.elastic.co/t/startup-files-location/209073/6 "2020-01-09T10:51:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
