# Using tokens with the endpoint /internal/security/login for logging instead of basic authentication **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [December 30, 2020, 6:55pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909 "2020-12-30T18:55:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![DMinovski](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Post date:** [December 30, 2020, 6:55pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/1 "2020-12-30T18:55:30Z")
In this post, [Kibana 7.10 login issues](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/5), there is an example of using basic authentication to log through the `/internal/security/login` API endpoint by using: ``` --data-raw '{"providerType":"basic","providerName":"basic","currentURL":"","params":{"username":" ***","password":"***"}}' ``` I can generate tokens with: ``` curl -u username:password -X POST "localhost:9200" -H 'Content-Type: application/json' -d' {"grant_type" : "client_credentials"} ``` I tried setting `"providersType"` and `"providersName"` to `"token"` and using the keyword `"token"` instead of `"username"` and `"password"`, but it returns `400 bad request` in the Chrome web console. What are the keywords? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [December 31, 2020, 9:13am UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/2 "2020-12-31T09:13:26Z")
Hey @DMinovski, Can you tell me more about your use case and what you want to achieve? And what version of the Stack you're using? It sounds like you can just use [Token authentication provider](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#token-authentication) or [HTTP authentication](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#http-authentication), but maybe your requirements are slightly different. Best, Oleg ---
**Author:** ![DMinovski](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Post date:** [December 31, 2020, 9:59am UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/3 "2020-12-31T09:59:15Z")
@azasypkin, I'm using version 7.10.1 of the stack, Kibana is connected to cloud Elasticsearch hosted by [https://elastic.co](https://elastic.co). I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security. I'm using the `index.html` code from here, but the data object in the big brackets is replaced with the one in the link in the opening post of this topic: > [@Hitting Security API Endpoint](https://discuss.elastic.co/t/hitting-security-api-endpoint/241952/8): > > Alright, I got something to work. I'm probably not going to list out every single step I did, but I found an IIS solution that worked for me. Sorry if you use Apache or NGinX. I'm not familiar with those web servers so I can't help there. You must have a valid SSL Cert for IIS and IIS must be installed on the same server that your ELK stack is installed on. You may be able to spin up a free trial of this on an Azure VM and use Let's Encrypt to get an SSL Cert (or perhaps Azure has a way to let … According to the schema here, it should be possible to use tokens: > [@Kibana 7.10 login issues](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/3): > > Hey @KevSex, Yeah, as @flash1293 already noted, it's an internal API and we reserve the right to make any breaking changes to it even though we try hard to not do that without a strong need. Back to your original question, [here is the definition](https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135) of request body schema: schema.object({ providerType: schema.string(), providerName: schema.string(), currentURL: schema.string(), params: schema.conditional( schema.siblingRef('providerType'), schema.oneOf([ schema.literal(Basic… ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [December 31, 2020, 12:22pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/4 "2020-12-31T12:22:47Z")
> [@DMinovski](#): > > I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security. The fact that _it won't improve_ security, since you'll still have token in this HTML and it's pretty much the same. Not to mention that token is valid for max 1 hour. But why aren't you using [usual proxy setup](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4) that just stores credentials on the reverse proxy side and credentials are never exposed to the end user? Also since 7.11 you'll be able to use [anonymous access](https://www.elastic.co/guide/en/kibana/7.11/kibana-authentication.html#anonymous-authentication) instead of Kibana + reverse proxy. Best, Oleg ---
**Author:** ![DMinovski](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Post date:** [January 4, 2021, 5:29pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/6 "2021-01-04T17:29:28Z")
I looked at the schema here, [https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135](https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135), I tried using the value `token` for `providerType` and it worked with the username and password. It seems that the keyword token can be used as a value for the type, but actual tokens can't be sent as parameters to the endpoint `/internal/security/login`. The code below works, but further changes to the parameter names or structure return `Bad Request` or `Unauthorized`. ``` {"providerType":"token","providerName":"basic","currentURL":"","params":{"username":"elastic","password":" ******"}} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 1, 2021, 5:29pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/7 "2021-02-01T17:29:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.