# Unable to use User Authentication in Elasticsearch and Elastic-App-Search

**URL:** <https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [July 1, 2021, 9:12am UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531 "2021-07-01T09:12:21Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![shubamraina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubamraina/32/91049_2.png) [@shubamraina](https://discuss.elastic.co/u/shubamraina)\
**Post date:** [July 1, 2021, 9:12am UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/1 "2021-07-01T09:12:21Z")

</div>

I have installed Elasticsearch and Elastic-App-Search. Currently it is open to public(i.e: Anyone with the url can see the engines. I want to have User Authentication on the url so that it cannot be accessed by anyone. I am following the document link [Manage users and access to App Search | Elastic App Search Documentation [8.4] | Elastic](https://www.elastic.co/guide/en/app-search/current/security-and-users.html#app-search-self-managed-security-and-user-management-standard) . The steps mentioned in this link is done but when I am restarting the elastic-app-search it is not restarting and giving me the error that "unable to authenticate user with elastic" I am using correct elastic user and creds in the enterprise-search.yaml. Can anyone help me with this issue. I am using elastic-app-search with basic(standard) license.  
Thanks in Advance for the help!

---

<div class="post-metadata">

**Author:** ![Vadim\_Yakhin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vadim_yakhin/32/56723_2.png) [@Vadim\_Yakhin](https://discuss.elastic.co/u/Vadim_Yakhin)\
**Post date:** [July 1, 2021, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/2 "2021-07-01T13:44:51Z")

</div>

Hi!

Could you please attach the content of your config files from 1) Elasticsearch and 2) Elastic App Search? Make sure to hide all sensitive data.

---

<div class="post-metadata">

**Author:** ![shubamraina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubamraina/32/91049_2.png) [@shubamraina](https://discuss.elastic.co/u/shubamraina)\
**Post date:** [July 1, 2021, 3:34pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/3 "2021-07-01T15:34:22Z")

</div>

Hi,  
Here is the elasticsearch.yml file:(Path /etc/elasticsearch/elasticsearch.yml)

```auto
***********************************************
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 0.0.0.0
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["127.0.0.1", "::1"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

xpack.security.enabled: true
#xpack.security.authc.api_key.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true

******************************************

```

---

<div class="post-metadata">

**Author:** ![shubamraina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubamraina/32/91049_2.png) [@shubamraina](https://discuss.elastic.co/u/shubamraina)\
**Post date:** [July 1, 2021, 3:42pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/4 "2021-07-01T15:42:02Z")

</div>

AND Here is the yaml file of enterprise-search.yml: (/use/share/enterprise-search/config/enterprise-search.yml)

```auto
## ================= Elastic Enterprise Search Configuration ==================

# ---------------------------------- Secrets ----------------------------------
#
# Encryption keys to protect your application secrets. This field is required.
#
secret_management.encryption_keys: [c594eb6169dc48fc35e06f550db0cc1a796bbfb4fa258be2baf0cbe2a46e8098]
#
# ------------------------------- Elasticsearch -------------------------------

#
allow_es_settings_modification: true
#
# Elasticsearch full cluster URL:
#
elasticsearch.host: http://0.0.0.0:9200
#
# Elasticsearch credentials:
#
elasticsearch.username: elastic
elasticsearch.password: elastic-password
#
# Elasticsearch custom HTTP headers to add to each request:
#
#elasticsearch.headers:
# X-My-Header: Contents of the header
#
# Elasticsearch SSL settings:
#
#elasticsearch.ssl.enabled: false
#elasticsearch.ssl.certificate:
#elasticsearch.ssl.certificate_authority:
#elasticsearch.ssl.key:
#elasticsearch.ssl.key_passphrase:
#elasticsearch.ssl.verify: true
#
# Elasticsearch startup retry:
#
#elasticsearch.startup_retry.enabled: true
#elasticsearch.startup_retry.interval: 5 # seconds
#elasticsearch.startup_retry.fail_after: 600 # seconds
#
# ---------------------------------- Kibana -----------------------------------
#
# The primary URL at which users interact with Kibana. This is used when
# Enterprise Search links users to Kibana.
#
#kibana.external_url: http://localhost:5601
#
# ------------------------------- Hosting & Network ---------------------------
#
# Define the exposed URL at which users will reach Enterprise Search.
# Defaults to localhost:3002 for testing purposes.
# Most cases will use one of:
#
# * An IP: http://255.255.255.255
# * A FQDN: http://example.com
# * Shortname defined via /etc/hosts: http://ent-search.search
#
ent_search.external_url: http://ServerPublicIp:3002
#
# Web application listen_host and listen_port.
# Your application will run on this host and port.
#
# * ent_search.listen_host: Must be a valid IPv4 or IPv6 address.
# * ent_search.listen_port: Must be a valid port number (1-65535).
#
ent_search.listen_host: 0.0.0.0
ent_search.listen_port: 3002
#
# ------------------------------ Authentication -------------------------------

#ent_search.auth.<auth_name>
#
# The origin of authenticated Enterprise Search users.
# Options are standard, elasticsearch-native, and elasticsearch-saml.
#
# Docs: https://www.elastic.co/guide/en/workplace-search/current/workplace-search-security.html
#
# * standard: Users are created within the Enterprise Search dashboard.
# * elasticsearch-native: Users are managed via the Elasticsearch native realm.
# * elasticsearch-saml: Users are managed via the Elasticsearch SAML realm.
#
#ent_search.auth.<auth_name>.source:
ent_search.auth.default.source: standard
#
#
#ent_search.auth.<auth_name>.order:
#
# The name to be displayed on the login screen associated with this provider.
#
#ent_search.auth.<auth_name>.description:
#
# The URL to an icon to be displayed on the login screen associated with this
# provider.
#
#ent_search.auth.<auth_name>.icon:
#
#
#ent_search.auth.<auth_name>.hidden: false
#
#
#ent_search.login_assistance_message:
#
# ---------------------------------- Limits -----------------------------------
#
# Configurable limits for Enterprise Search.
#
#workplace_search.content_source.document_size.limit: 100kb
#
# Configure how many fields a content source can have.
# NOTE: The Elasticsearch/Lucene setting `indices.query.bool.max_clause_count`
# might also need to be adjusted if "Max clause count exceeded" errors start
# occurring. See more here: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-settings.html
#
#workplace_search.content_source.total_fields.limit: 64
#
#workplace_search.content_source.sync.max_errors: 1000
#
#
#workplace_search.content_source.sync.max_consecutive_errors: 10
#
#
#workplace_search.content_source.sync.max_error_ratio: 0.15
#
# Configure how large of a window to consider when calculating an error ratio
# (see `workplace_search.content_source.sync.max_error_ratio`).
#
#workplace_search.content_source.sync.error_ratio_window_size: 100
#
# Configure whether or not a content source should generate thumbnails for the documents
# it syncs. Not all file types/sizes/content or Content Sources support thumbnail generation,
# even if this is enabled.
#
#workplace_search.content_source.sync.thumbnails.enabled: true
#
#### App Search
#
# Configure the maximum allowed document size.
#
#app_search.engine.document_size.limit: 100kb
#
#app_search.engine.total_fields.limit: 64
#
# Configure how many source engines a meta engine can have.
#
#app_search.engine.source_engines_per_meta_engine.limit: 15
#
# Configure how many facet values can be returned by a search.
#
#app_search.engine.total_facet_values_returned.limit: 250
#
#app_search.engine.query.limit: 128
#
# Configure total number of synonym sets an engine can have.
#
#app_search.engine.synonyms.sets.limit: 256
#
# Configure total number of terms a synonym set can have.
#
#app_search.engine.synonyms.terms_per_set.limit: 32
#
# Configure how many analytics tags can be associated with a single query or clickthrough.
#
#app_search.engine.analytics.total_tags.limit: 16
#
# ---------------------------------- Workers ----------------------------------
#
# Configure the number of worker threads.
#
#worker.threads: 1
#
# ----------------------------------- APIs ------------------------------------
#
# Set to true hide product version information from API responses.
#
#hide_version_info: false
#
# ---------------------------------- Mailer -----------------------------------
#
# Connect Enterprise Search to a mailer.
# Docs: https://www.elastic.co/guide/en/workplace-search/current/workplace-search-smtp-mailer.html
#
#
# ---------------------------------- Logging ----------------------------------
#
# Choose your log export path.
#
log_directory: /var/log/enterprise-search
#
# Log level can be: debug, info, warn, error, fatal, or unknown.
#
#log_level: info
#
# Log format can be: default, json
#
#log_format: default
#
# Choose your Filebeat logs export path.
#
filebeat_log_directory: /var/log/enterprise-search
#
# Use Index Lifecycle Management (ILM) to manage analytics and API logs
# retention.
#
# Docs: https://www.elastic.co/guide/en/app-search/current/logs.html
#
#ilm.enabled: auto
#
# Enable logging app logs to stdout (enabled by default).
#
#enable_stdout_app_logging: true
#
# The number of files to keep on disk when rotating logs. When set to 0, no
# rotation will take place.
#
#log_rotation.keep_files: 7
#
#log_rotation.rotate_every_bytes: 1048576 # 1 MiB
#
# ---------------------------------- TLS/SSL ----------------------------------
#
# Configure TLS/SSL encryption.
#
#ent_search.ssl.enabled: false
#ent_search.ssl.keystore.path:
#ent_search.ssl.keystore.password:
#ent_search.ssl.keystore.key_password:
#ent_search.ssl.redirect_http_from_port:
#
# ---------------------------------- Session ----------------------------------
#
# Set a session key to persist user sessions through process restarts.
#
#secret_session_key:
#
# --------------------------------- Telemetry ---------------------------------
#
# Reporting your basic feature usage statistics helps us improve your user
# experience. Your data is never shared with anyone.
#
# Set to false to disable telemetry capabilities entirely. You can alternatively
# opt out through the Settings page.
#
#telemetry.enabled: true
#
#telemetry.opt_in: true
#telemetry.allow_changing_opt_in_status: true
#
# ----------------------------- Diagnostics report ----------------------------
#
# Path where diagnostic reports will be generated.
#
#diagnostic_report_directory: diagnostics
#
# ------------------------------ Crawler Preview ------------------------------
#
# The User-Agent HTTP Header used for the Crawler.
#
#crawler.http.user_agent: Elastic Crawler (<crawler_version_number>)
#
#crawler.http.user_agent_platform:
#
# The number of parallel crawls allowed per instance of Enterprise Search.
# By default, it is set to 2x the number of available CPU cores.
#
#crawler.workers.pool_size.limit: N
#
# -------------------------
# Per-crawl Resource Limits
# -------------------------
#
#crawler.crawl.max_duration.limit: 86400 # seconds
#
#
#crawler.crawl.max_crawl_depth.limit: 10
#
#
#crawler.crawl.max_url_length.limit: 2048
#
#
#crawler.crawl.max_url_segments.limit: 16
#
#
#crawler.crawl.max_url_params.limit: 32
#
# The maximum number of unique URLs the crawler will index during a single crawl.
# Beyond this limit, the crawler will stop.
#
#crawler.crawl.max_unique_url_count.limit: 100000
#
# -------------------------
# Advanced Per-crawl Limits
# -------------------------
#
# The number of parallel threads to use for each crawl.
# The main effect from increasing this value will be an increased throughput
# of the crawler at the expense of higher CPU load on Enterprise Search and
# Elasticsearch instances as well as higher load on the website being crawled.
#
#crawler.crawl.threads.limit: 10
#
# The maximum size of the crawl frontier - the list of URLs the crawler needs to visit.
# The list is stored in Elasticsearch, so the limit could be increased as long
# as the Elasticsearch cluster has enough resources (disk space) to hold the queue index.
#
#crawler.crawl.url_queue.url_count.limit: 100000
#
# ---------------------------
# Per-Request Timeout Limits
# ---------------------------
#
# The maximum period to wait until abortion of the request, when a connection is being initiated.
#
#crawler.http.connection_timeout: 10 # seconds
#
# The maximum period of inactivity between two data packets, before the request is aborted.
#
#crawler.http.read_timeout: 10 # seconds
#
# The maximum period of the entire request, before the request is aborted.
#
#crawler.http.request_timeout: 60 # seconds
#
# ---------------------------
# Per-Request Resource Limits
# ---------------------------
#
# The maximum size of an HTTP response (in bytes) supported by the crawler.
#
#crawler.http.response_size.limit: 10485760
#
# The maximum number of HTTP redirects before a request is failed.
#
#crawler.http.redirects.limit: 10
#
# ----------------------------------
# Content Extraction Resource Limits
# ----------------------------------
#
# The maximum size (in bytes) of some fields extracted from crawled pages
#
#crawler.extraction.title_size.limit: 1024
#crawler.extraction.body_size.limit: 5242880
#crawler.extraction.keywords_size.limit: 512
#crawler.extraction.description_size.limit: 1024
#
# The maximum number of links extracted from each page for further crawling
#
#crawler.extraction.extracted_links_count.limit: 1000
#
# The maximum number of links extracted from each page and indexed in a document
#
#crawler.extraction.indexed_links_count.limit: 25
#
# The maximum number of HTML headers to be extracted from each page
#
#crawler.extraction.headings_count.limit: 25
#
# Document fields used to compare documents during de-duplication
#
#crawler.extraction.content_hash_include: ['document_title', 'document_body', 'meta_keywords', 'meta_description', 'links', 'headings']
#
# -----------------------------
# Crawler DNS Security Controls
# -----------------------------
#
# WARNING: The settings in this section could make your deployment vulnerable to
# SSRF attacks (especially in cloud environments) from the owners of any domains
# you crawl. Do not enable any of the settings here unless you fully control DNS
# domains you access with the crawler.
#
# See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery for
# more details on the SSRF attack and the risks associated with it.
#
# Allow crawler to access the localhost (127.0.0.0/8 IP namespace)
#
#crawler.security.dns.allow_loopback_access: false
#
# Allow crawler to access the private IP space: link-local, network-local addresses, etc
# (see https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4 for more details)
#
#crawler.security.dns.allow_private_networks_access: false
#
# ------------------------------ Read-only mode -------------------------------
#
# If true, pending migrations can be executed without enabling read-only mode.
# Proceeding with migrations while indices are allowing writes can have
# unintended consequences. Use at your own risk, should not be set to true when
# upgrading a production instance with ongoing traffic.
#
#skip_read_only_check: false
#

```

---

<div class="post-metadata">

**Author:** ![shubamraina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubamraina/32/91049_2.png) [@shubamraina](https://discuss.elastic.co/u/shubamraina)\
**Post date:** [July 2, 2021, 10:24am UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/5 "2021-07-02T10:24:28Z")

</div>

When i am trying to enable the things which are mentioned in the [Security & Users | Elastic App Search Documentation [7.13] | Elastic](https://www.elastic.co/guide/en/app-search/current/security-and-users.html#app-search-self-managed-security-and-user-management-reset-default-password)

It's giving me the error when starting up the elasticsearch. Below is the attached screenshort.

> **[elasticsearch-issues.PNG](https://drive.google.com/file/d/1Vo0mwBmmwBBG2tDICEiPlXpGE2UvcAhF/view?usp=sharing)**
>
> Google Drive file.

---

<div class="post-metadata">

**Author:** ![Vadim\_Yakhin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vadim_yakhin/32/56723_2.png) [@Vadim\_Yakhin](https://discuss.elastic.co/u/Vadim_Yakhin)\
**Post date:** [July 2, 2021, 3:42pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/6 "2021-07-02T15:42:47Z")

</div>

I noticed that you have `xpack.security.authc.api_key.enabled: true` commented out in elasticsearch.yml config. Based on the installation documentation, this is a required flag for running Enterprise Search (see step 2 here: [Installation | Elastic Enterprise Search Documentation [7.13] | Elastic](https://www.elastic.co/guide/en/enterprise-search/current/installation.html#installation-self-managed)).

I didn't find anything wrong with enterprise-search.yml config.

---

<div class="post-metadata">

**Author:** ![shubamraina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubamraina/32/91049_2.png) [@shubamraina](https://discuss.elastic.co/u/shubamraina)\
**Post date:** [July 2, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/7 "2021-07-02T17:47:01Z")

</div>

If i uncommecnt the "xpack.security.authc.api\_key.enabled: true" Elasticsearch is not restarting and giving the error shared above in the link. Here is the link

> **[elasticsearch-issues.PNG](https://drive.google.com/file/d/1Vo0mwBmmwBBG2tDICEiPlXpGE2UvcAhF/view?usp=sharing)**
>
> Google Drive file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-use-user-authentication-in-elasticsearch-and-elastic-app-search/277531/8 "2021-07-30T17:47:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.