# Unable to authenticate user \[kibana\_system\] for REST request \[/\_xpack\] error **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [May 15, 2023, 11:07am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441 "2023-05-15T11:07:26Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![daniela09](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniela09/32/120636_2.png) [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Post date:** [May 15, 2023, 11:07am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/1 "2023-05-15T11:07:26Z")
I am using EFK stack on Kubernetes, Elastic and Kibana 8.7.0: 1. I changed the passwords for built-in users elastic and kibana\_system with ./bin/elasticsearch-reset-password user --username kibana\_system and ./bin/elasticsearch-reset-password user --username elastic 2. Then I added them to the elasticsearch-keystore with ./bin/elasticsearch-keystore add kibana\_pass and ./bin/elasticsearch-keystore add elastic\_pass 3. I have created Secretc with both passwords And everything is working fine, but after restart I get this error in my kibana logs: ```auto [2023-05-15T06:54:11.417+00:00][ERROR][plugins.security.authentication] License is not available, authentication is not possible. [2023-05-15T06:54:11.429+00:00][WARN][plugins.licensing] License information could not be obtained from Elasticsearch due to ResponseError: security_exception Root causes: security_exception: unable to authenticate user [kibana_system] for REST request [/_xpack] error ``` and this is my elastic log: ```auto {"@timestamp":"2023-05-15T09:25:40.548Z", "log.level": "INFO", "message":"Authentication of [kibana_system] was terminated by realm [reserved] - failed to authenticate user [kibana_system]", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[elasticsearch-client][transport_worker][T#7]","log.logger":"org.elasticsearch.xpack.security.authc.RealmsAuthenticator","trace.id":"5451638a596cc9a373336ecc3552088a","elasticsearch.cluster.uuid":"6h24ceJZS6-w0WZ3EPg8PA","elasticsearch.node.id":"Cu3XJpMASA20AMH2QcnvoQ","elasticsearch.node.name":"elasticsearch-client","elasticsearch.cluster.name":"elasticsearch"} ``` And I need to change the passwords again and create new Secrets so I can authenticate both users, I need help how to make them persistent so I dont have to do this everytime a node restarts ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 16, 2023, 4:02am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/2 "2023-05-16T04:02:36Z")
> [@daniela09](#): > > Then I added them to the elasticsearch-keystore with ./bin/elasticsearch-keystore add kibana\_pass and ./bin/elasticsearch-keystore add elastic\_pass Elasticsearch keystore is not the place for storing these passwords. What are you trying to achieve? Maybe you were looking for [kibana-keystore](https://www.elastic.co/guide/en/kibana/current/secure-settings.html#creating-keystore)? ---
**Author:** ![daniela09](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniela09/32/120636_2.png) [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Post date:** [May 16, 2023, 8:34am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/3 "2023-05-16T08:34:56Z")
Hi, I want to make the passwords persistent, so when the cluster fails or restarts they still to remain the same. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 16, 2023, 8:58am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/4 "2023-05-16T08:58:51Z")
> [@daniela09](#): > > Hi, I want to make the passwords persistent, so when the cluster fails or restarts they still to remain the same. It's persistant already since `./bin/elasticsearch-reset-password` saves the new password to the security index which is on disk and available across restart (assuming you don't actively delete data between restarts). ---
**Author:** ![daniela09](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniela09/32/120636_2.png) [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Post date:** [May 16, 2023, 9:32am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/5 "2023-05-16T09:32:48Z")
I don't delete data, but when my cluster fails or I restart it, I get the logs above and I need to reset the password again so elastic can authenticate the user kibana\_system ---
**Author:** ![kiel](https://avatars.discourse-cdn.com/v4/letter/k/ac8455/32.png) [@kiel](https://discuss.elastic.co/u/kiel)\ **Post date:** [May 28, 2023, 5:14pm UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/6 "2023-05-28T17:14:55Z")
Did you found any solution for that problem? I have the same problem and kibana doesn´t start. It shows your error, too. ---
**Author:** ![daniela09](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniela09/32/120636_2.png) [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Post date:** [May 29, 2023, 11:57am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/7 "2023-05-29T11:57:18Z")
No, I still haven't found a solution for this problem. If I solve it I will write here ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2023, 11:57am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441/8 "2023-06-26T11:57:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.