# Status code 403 unauthorized for user \[\_anonymous\] is returned for anonymous user with a custom role which is Stack Management plugin not displayed

**URL:** <https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586>\
**Category:** Kibana\
**Created:** [March 18, 2021, 1:46am UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586 "2021-03-18T01:46:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thiton](https://avatars.discourse-cdn.com/v4/letter/t/b38774/32.png) [@thiton](https://discuss.elastic.co/u/thiton)\
**Post date:** [March 18, 2021, 1:46am UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586/1 "2021-03-18T01:46:53Z")

</div>

Is that possible to configure Elasticsearch and Kibana for anonymous user with a custom role which is Stack Management plugin in NOT displayed when security is turned off? Many thanks in advance.

Below are my steps:

1. Create a custom role  
curl -XPUT [http://server:9200/security/role/CUSTOM\_ROLE](http://server:9200/security/role/CUSTOM_ROLE) -H 'Content-Type: application/json' -d'  
{  
"cluster" : ,  
"indices" : [  
{  
"names" : ,  
"privileges" : [  
"view\_index\_metadata",  
"read"  
],  
"field\_security" : {  
"grant" : [  
"\*"  
],  
"except" :   
},  
"allow\_restricted\_indices" : false  
}  
],  
"applications" : [  
{  
"application" : "kibana-.kibana",  
"privileges" : [  
"feature\_discover.all",  
"feature\_dashboard.all",  
"feature\_canvas.all",  
"feature\_maps.all",  
"feature\_ml.all",  
"feature\_graph.all",  
"feature\_visualize.all"  
],  
"resources" : [  
"space:default"  
]  
}  
],  
"run\_as" : ["\_anonymous"],  
"metadata" : { },  
"transient\_metadata" : {  
"enabled" : true  
}  
}  
'

2. Set up in ElasticSearch.yml with

- xpack.security.authc.anonymous.username: \_anonymous
- xpack.security.authc.anonymous.roles: CUSTOM\_ROLE

1. Set up in Kibana.yml with

- xpack.security.enabled: false

\*\*\* Actual Result:

- Kibana UI returns with {"statusCode":403,"error":"Forbidden","message":"action [indices:data/read/search] is unauthorized for user [\_anonymous]: security\_exception"}

- 

```
     Kibana’s log returns ",\"statusCode\":403,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"action [cluster:monitor/xpack/info] is unauthorized for user [_anonymous]”
```

---

<div class="post-metadata">

**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\
**Post date:** [March 18, 2021, 3:30pm UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586/2 "2021-03-18T15:30:17Z")

</div>

Hello!

I believe in the `kibana.yml` file you actually need to leave `xpack.security.enabled: true` and also set:

```auto
xpack.security.authc.providers:
  anonymous.anonymous1:
    order: 0
    credentials: "_anonymous"

```

FYI the docs for this feature in Kibana are here: [Authentication in Kibana | Kibana Guide [7.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#anonymous-authentication)

---

<div class="post-metadata">

**Author:** ![thiton](https://avatars.discourse-cdn.com/v4/letter/t/b38774/32.png) [@thiton](https://discuss.elastic.co/u/thiton)\
**Post date:** [March 18, 2021, 5:51pm UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586/3 "2021-03-18T17:51:53Z")

</div>

@joshdover Thanks so much for response.  
Unfortunately I am still getting error 403 when xpack.security.enabled: true and xpack.security.authc.providers:  
anonymous.anonymous1:  
order: 0  
credentials: "elastisearch\_anonymous\_user"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2021, 5:52pm UTC](https://discuss.elastic.co/t/status-code-403-unauthorized-for-user-anonymous-is-returned-for-anonymous-user-with-a-custom-role-which-is-stack-management-plugin-not-displayed/267586/4 "2021-04-15T17:52:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.