Using tokens with the endpoint /internal/security/login for logging instead of basic authentication

[DMinovski]

In this post, Kibana 7.10 login issues, there is an example of using basic authentication to log through the /internal/security/login API endpoint by using:

--data-raw '{"providerType":"basic","providerName":"basic","currentURL":"","params":{"username":"***","password":"***"}}'

I can generate tokens with:

curl -u username:password -X POST "localhost:9200" -H 'Content-Type: application/json' -d'
{"grant_type" : "client_credentials"}

I tried setting "providersType" and "providersName" to "token" and using the keyword "token" instead of "username" and "password", but it returns 400 bad request in the Chrome web console. What are the keywords?

[azasypkin]

Hey @DMinovski,

Can you tell me more about your use case and what you want to achieve? And what version of the Stack you're using?

It sounds like you can just use Token authentication provider or HTTP authentication, but maybe your requirements are slightly different.

Best,
Oleg

[DMinovski]

@azasypkin,
I'm using version 7.10.1 of the stack, Kibana is connected to cloud Elasticsearch hosted by https://elastic.co.
I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security.
I'm using the index.html code from here, but the data object in the big brackets is replaced with the one in the link in the opening post of this topic:

Hitting Security API Endpoint

Alright, I got something to work. I'm probably not going to list out every single step I did, but I found an IIS solution that worked for me. Sorry if you use Apache or NGinX. I'm not familiar with those web servers so I can't help there. You must have a valid SSL Cert for IIS and IIS must be installed on the same server that your ELK stack is installed on. You may be able to spin up a free trial of this on an Azure VM and use Let's Encrypt to get an SSL Cert (or perhaps Azure has a way to let …

According to the schema here, it should be possible to use tokens:

Kibana 7.10 login issues

Hey @KevSex, Yeah, as @flash1293 already noted, it's an internal API and we reserve the right to make any breaking changes to it even though we try hard to not do that without a strong need. Back to your original question, here is the definition of request body schema: schema.object({ providerType: schema.string(), providerName: schema.string(), currentURL: schema.string(), params: schema.conditional( schema.siblingRef('providerType'), schema.oneOf([ schema.literal(Basic…

[azasypkin]

@DMinovski

I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security.

The fact that it won't improve security, since you'll still have token in this HTML and it's pretty much the same. Not to mention that token is valid for max 1 hour. But why aren't you using usual proxy setup that just stores credentials on the reverse proxy side and credentials are never exposed to the end user?

Also since 7.11 you'll be able to use anonymous access instead of Kibana + reverse proxy.

Best,
Oleg

[DMinovski]

I looked at the schema here, https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135, I tried using the value token for providerType and it worked with the username and password. It seems that the keyword token can be used as a value for the type, but actual tokens can't be sent as parameters to the endpoint /internal/security/login. The code below works, but further changes to the parameter names or structure return Bad Request or Unauthorized.

{"providerType":"token","providerName":"basic","currentURL":"","params":{"username":"elastic","password":"******"}}