# What dose "realm\_authentication\_failed" really mean?

**URL:** <https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 18, 2022, 3:18am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334 "2022-08-18T03:18:01Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\
**Post date:** [August 18, 2022, 3:18am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/1 "2022-08-18T03:18:01Z")

</div>

In auditlog,I saw the log below, what dose "realm\_authentication\_failed" really mean, this query was normal，why "realm\_authentication\_failed"?

```auto
{
    "type":"audit",
    "timestamp":"2022-08-18T02:35:15,041+0000",
    "node.id":"xxxxxxxx",
    "event.type":"rest",
    "event.action":"realm_authentication_failed",
    "user.name":"xxxxxxx",
    "origin.type":"rest",
    "origin.address":"xxxxxxx",
    "realm":"reserved",
    "url.path":"/indexAAA/_search",
    "url.query":"typed_keys=true&ignore_unavailable=false&expand_wildcards=open&allow_no_indices=true&ignore_throttled=true&search_type=query_then_fetch&batched_reduce_size=512&ccs_minimize_roundtrips=true",
    "request.method":"POST",
    "request.body":"{\"from\":10,\"size\":10,\"query\":{\"bool\":{\"must\":[{\"term\":{\"logname\":{\"value\":\"xxxxxx\",\"boost\":1.0}}},{\"range\":{\"logtime-UTC\":{\"from\":\"2022-08-11 00:00:00\",\"to\":\"2022-08-18 10:34:56\",\"include_lower\":true,\"include_upper\":true,\"time_zone\":\"Asia/Shanghai\",\"format\":\"yyyy-MM-dd HH:mm:ss\",\"boost\":1.0}}},{\"bool\":{\"should\":[{\"term\":{\"serverid\":{\"value\":\"xxxx\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"match\":{\"userid\":{\"query\":\"xxxxxxx\",\"operator\":\"OR\",\"prefix_length\":0,\"max_expansions\":50,\"fuzzy_transpositions\":true,\"lenient\":false,\"zero_terms_query\":\"NONE\",\"auto_generate_synonyms_phrase_query\":true,\"boost\":1.0}}},{\"match\":{\"roleid\":{\"query\":\"xxxxxx\",\"operator\":\"OR\",\"prefix_length\":0,\"max_expansions\":50,\"fuzzy_transpositions\":true,\"lenient\":false,\"zero_terms_query\":\"NONE\",\"auto_generate_synonyms_phrase_query\":true,\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"boost\":1.0}},\"sort\":[{\"logtime\":{\"order\":\"asc\"}}],\"track_total_hits\":2147483647}",
    "request.id":"xxxxxxx"
}

```

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [August 18, 2022, 3:55am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/2 "2022-08-18T03:55:36Z")

</div>

`realm_authentication_failed` is **not** enabled by default in audit logs. It is logged if a realm’s attempt to authenticate a user, but is not successful. This may not be a problem at all because another realm may later successfully authenticate the user.

---

<div class="post-metadata">

**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\
**Post date:** [August 18, 2022, 6:00am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/3 "2022-08-18T06:00:47Z")

</div>

I'm pretty sure there's nothing wrong with the username and password,so what caused this " `realm_authentication_failed`"

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 18, 2022, 7:20am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/4 "2022-08-18T07:20:11Z")

</div>

It almost certainly means that the user (which you've masked out from your log) doesn't exist in the `reserved` realm. Therefore the `reserved` realm failed to authenticate the user.

As @Yang_Wang said:

> This may not be a problem at all because another realm may later successfully authenticate the user.

---

<div class="post-metadata">

**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\
**Post date:** [August 18, 2022, 7:41am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/5 "2022-08-18T07:41:59Z")

</div>

Why verify that a user exists in the `reserved` realm？Or what is the point of this log

---

<div class="post-metadata">

**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\
**Post date:** [August 18, 2022, 7:53am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/6 "2022-08-18T07:53:44Z")

</div>

Thanks for your reply，I have another problem，what dose " **anonymous\_access\_denied**" really mean?  
In the auditlog, I saw the log below. But the query executes successfully,why dose "anonymous\_access\_denied" recorded in logs?

```auto
{
    "type":"audit",
    "timestamp":"2022-08-18T07:30:41,843+0000",
    "node.id":"xxxxxxxxx",
    "event.type":"rest",
    "event.action":"anonymous_access_denied",
    "origin.type":"rest",
    "origin.address":"xxxxxxxx",
    "url.path":"/idnexBBBB/_search",
    "url.query":"pre_filter_shard_size=128&typed_keys=true&max_concurrent_shard_requests=5&ignore_unavailable=false&expand_wildcards=open&allow_no_indices=true&ignore_throttled=true&scroll=1m&search_type=query_then_fetch&batched_reduce_size=512&ccs_minimize_roundtrips=true",
    "request.method":"POST",
    "request.body":"{\"size\":10000,\"query\":{\"bool\":{\"must\":[{\"term\":{\"jobid\":{\"value\":xxxxxx,\"boost\":1.0}}},{\"range\":{\"logtime\":{\"from\":\"2022-08-18 14:30:43\",\"to\":\"2022-08-19 14:30:43\",\"include_lower\":true,\"include_upper\":true,\"time_zone\":\"+08:00\",\"format\":\"yyyy-MM-dd HH:mm:ss\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"boost\":1.0}},\"sort\":[{\"logtime\":{\"order\":\"asc\"}},{\"linenum\":{\"order\":\"asc\"}}]}",
    "request.id":"xxxxxxxxxx"
}

```

---

<div class="post-metadata">

**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\
**Post date:** [August 18, 2022, 7:59am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/7 "2022-08-18T07:59:08Z")

</div>

It is described as follows in official documents：  
`anonymous_access_denied`：  
"Logged when a request is denied `due to missing authentication credentials`.",However, the query in the log above was successfully executed and authenticated，so I'm confused.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2022, 7:59am UTC](https://discuss.elastic.co/t/what-dose-realm-authentication-failed-really-mean/312334/8 "2022-09-15T07:59:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.