# Turn on Anonymous access

**URL:** <https://discuss.elastic.co/t/turn-on-anonymous-access/343822>\
**Category:** SIEM\
**Created:** [September 26, 2023, 2:38am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822 "2023-09-26T02:38:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gabrielpicagevicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabrielpicagevicz/32/126008_2.png) [@gabrielpicagevicz](https://discuss.elastic.co/u/gabrielpicagevicz)\
**Post date:** [September 26, 2023, 2:38am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/1 "2023-09-26T02:38:54Z")

</div>

I currently have version 8.9.1 of Kibana (basic license) installed on my machine. I created an anonymous user with full access to testing

I've added the following to Elasticsearch.yml

```auto
xpack.security.authc:
  anonymous:
    username: anonymous_user 
    roles: admin
    authz_exception: true

```

And I added the following to kibana.yml

```auto
xpack.security.authc.providers:
  basic.basic1:
    order: 0
  anonymous.anonymous1:
    order: 1
    credentials:
      username: "anonymous_service_account"
      password: "anonymous_service_account_password"

```

When I click on the anonymous login option on the login screen, I get the following error

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/ccf5a91f339da1ee0713bc67cfc44f3ea40678bf.png)

```auto
Error: [security_exception
	Root causes:
		security_exception: unable to authenticate user [anonymous_user1] for REST request [/_security/_authenticate]]: unable to authenticate user [anonymous_user1] for REST request [/_security/_authenticate]
    at login_form_LoginForm.loginWithSelector (http://localhost:5601/64802/bundles/plugin/security/1.0.0/security.chunk.7.js:3:14315)

```

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [September 26, 2023, 11:33am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/2 "2023-09-26T11:33:45Z")

</div>

Hi @gabrielpicagevicz,

Welcome to the community! Can you confirm the user and password is setup in Kibana and that those credentials match those in your `kibana.yml`?

---

<div class="post-metadata">

**Author:** ![gabrielpicagevicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabrielpicagevicz/32/126008_2.png) [@gabrielpicagevicz](https://discuss.elastic.co/u/gabrielpicagevicz)\
**Post date:** [September 30, 2023, 10:34pm UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/3 "2023-09-30T22:34:16Z")

</div>

Hello Carly Richmond,

Thank you for the response. The previous issue has been completely resolved by creating a user in Kibana. However, I have a new question.

I have created a dashboard with a heat map and populated it with some data. I need to implement this dashboard in an external application through an iframe (I was able to create an iframe by sharing the dashboard). However, when I add the iframe to the HTML, it keeps loading infinitely.

HTML embedding the dashboard:

```auto
<!DOCTYPE html>
<html>
<head>
    <title> Kibana</title>
</head>
<body>
    <iframe src="http://localhost:5601/app/dashboards?auth_provider_hint=anonymous1#/view/28f244b0-5a55-11ee-9d0f-2df0c1692a5f?_g=()&_a=(panels:!((embeddableConfig:(enhancements:(),hiddenLayers:!(),isLayerTOCOpen:!t,mapBuffer:(maxLat:-23.56399,maxLon:-46.4502,minLat:-23.68477,minLon:-46.62598),mapCenter:(lat:-23.62215,lon:-46.54096,zoom:12.43),openTOCDetails:!('4c320114-8722-40fe-accb-2f2e2d21601f')),gridData:(h:20,i:f3ac19b8-0dba-4aaa-889f-8945c476e13c,w:29,x:0,y:0),id:'9781f710-5a4e-11ee-9d0f-2df0c1692a5f',panelIndex:f3ac19b8-0dba-4aaa-889f-8945c476e13c,type:map,version:'8.9.1'))" width="800" height="600"></iframe>
</body>
</html>

```

When I run it, the following screen remains stuck infinitely:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71428f19a5af6421e48e76bfdea5cbf4f3bb517a.png)

In my Kibana.bat console, the same message keeps incrementing:

[2023-09-30T19:38:16.534-03:00][INFO][plugins.security.routes] Logging in with provider "anonymous1" (anonymous)

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [October 2, 2023, 8:51am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/4 "2023-10-02T08:51:05Z")

</div>

Can you try to add the `xpack.security.sameSiteCookies` and `xpack.security.secureCookies` options [as per this thread](https://discuss.elastic.co/t/kibana-login-loop-while-use-iframe/296542)? Let us know if this resolves your loop issue.

---

<div class="post-metadata">

**Author:** ![gabrielpicagevicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabrielpicagevicz/32/126008_2.png) [@gabrielpicagevicz](https://discuss.elastic.co/u/gabrielpicagevicz)\
**Post date:** [October 3, 2023, 12:19am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/5 "2023-10-03T00:19:46Z")

</div>

Hi, I added both lines as requested; however, the issue persisted...

Out of curiosity, I changed my address from 127.0.0.1:5500/index.html to localhost:5500/index.html, and guess what? The problem was resolved...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/6/467a1e961e3eb47cc1ebef26206c0790d7d910b5.png)

I appreciate your help!!!

I am working on my college thesis, and your support in these situations has been extremely valuable!

Thank you, Carly

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2023, 12:20am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822/6 "2023-10-31T00:20:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.