# TLS and user authentication

**URL:** <https://discuss.elastic.co/t/tls-and-user-authentication/213362>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 30, 2019, 3:02pm UTC](https://discuss.elastic.co/t/tls-and-user-authentication/213362 "2019-12-30T15:02:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Post date:** [December 30, 2019, 3:02pm UTC](https://discuss.elastic.co/t/tls-and-user-authentication/213362/1 "2019-12-30T15:02:36Z")

</div>

Is there a way to enable login access to kibana and create users and assign roles to them without configuring the TLS?

There is a load balancer in front of the cluster and the IT admin is not very supportive of enabling TLS. He says that it will mess up things performance wise. The cluster is never exposed to outer world. Only people from within the company network access kibana.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 31, 2019, 3:26am UTC](https://discuss.elastic.co/t/tls-and-user-authentication/213362/2 "2019-12-31T03:26:31Z")

</div>

There is no requirement to configure TLS for the HTTP port (9200) of your nodes.  
You _must_ enable TLS for the traffic within the cluster that runs on the "transport" port (9300). That will not affect your load balancer.

---

<div class="post-metadata">

**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Post date:** [January 1, 2020, 11:34pm UTC](https://discuss.elastic.co/t/tls-and-user-authentication/213362/3 "2020-01-01T23:34:45Z")

</div>

Thanks for the info. Somehow I missed it in the documentation.

Just to make sure that I have understood it right:  
We send the data via serilog shipper to the loadbalancer.  
This is how the relevant section settings.json for the serilog looks like.

Current setup still remains as it is after ssl enabling internally.

```
"Args": {
          "nodeUris": "http://loadbalance:9200",
.
.
.

```

And kibana url will remains the http based like before:  
`http://kibanainstance:5601/`

But then the user login feature gets enabled and I can create users and assign roles to them.

Also I am referring to this [blog](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash):

My understanding is that I comment the lines below to keep the http based communications betweent the client and the cluster.

```
[root@node1 elasticsearch]# vi elasticsearch.yml 
## add the following contents
node.name: node1
network.host: node1.elastic.test.com
xpack.security.enabled: true
## xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true
## xpack.security.http.ssl.key: certs/node1.key
## xpack.security.http.ssl.certificate: certs/node1.crt
## xpack.security.http.ssl.certificate_authorities: certs/ca.crt
xpack.security.transport.ssl.key: certs/node1.key
xpack.security.transport.ssl.certificate: certs/node1.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca.crt
discovery.seed_hosts: ["node1.elastic.test.com"]
cluster.initial_master_nodes: ["node1"]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 29, 2020, 11:47pm UTC](https://discuss.elastic.co/t/tls-and-user-authentication/213362/4 "2020-01-29T23:47:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.