# Using Basic Auth Reverse Proxy for iframe Kibana Dashboard

**URL:** <https://discuss.elastic.co/t/using-basic-auth-reverse-proxy-for-iframe-kibana-dashboard/140945>\
**Category:** Kibana\
**Created:** [July 20, 2018, 4:22pm UTC](https://discuss.elastic.co/t/using-basic-auth-reverse-proxy-for-iframe-kibana-dashboard/140945 "2018-07-20T16:22:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![synack.d](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/synack.d/32/33590_2.png) [@synack.d](https://discuss.elastic.co/u/synack.d)\
**Post date:** [July 20, 2018, 4:22pm UTC](https://discuss.elastic.co/t/using-basic-auth-reverse-proxy-for-iframe-kibana-dashboard/140945/1 "2018-07-20T16:22:10Z")

</div>

I'm developing an application that embeds one of my company's internal Kibana dashboards into an `iframe` so that the application's users have restricted access to only a specific dashboard.

I'm using an Nginx reverse proxy to pass a basic authentication header using a hard-coded user to Kibana for automatic authentication as described [here](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4):

```nginx
proxy_set_header Authorization "Basic Y3N..." # base64 of user:pass

```

However, the browser still prompts me for credentials and none that I try will work:

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/2/9/29fb318d8b10ddab00d1ec794190f1badcfc1929.PNG)

I click "Cancel" and I get this response from the browser:

```javascript
{
    "statusCode": 401,
    "error": "Unauthorized",
    "message": "[security_exception] unable to authenticate user [cs_api_user] for REST request [/_xpack/security/_authenticate], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } }"
}

```

To eliminate the proxy as the cause, I tried to send a request using `curl`, getting the same response:

```bash
$ curl -k -H "Authorization: Basic Y3N..." -X GET https://<kbn-ip>:5601
$ curl -k -H "Authorization: Basic Y3N..." -X GET https://<kbn-ip>:5601 -u cs_api_user

```

Is this an issue on my end or do I need to configure Kibana in some way?

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [August 6, 2018, 2:55pm UTC](https://discuss.elastic.co/t/using-basic-auth-reverse-proxy-for-iframe-kibana-dashboard/140945/2 "2018-08-06T14:55:50Z")

</div>

Seems like maybe the iframe source is not pointed at the reverse proxy? That setup should work if all Kibana traffic is going through it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2018, 3:01pm UTC](https://discuss.elastic.co/t/using-basic-auth-reverse-proxy-for-iframe-kibana-dashboard/140945/3 "2018-09-03T15:01:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.