# X-pack security fallback realm configuration?

**URL:** <https://discuss.elastic.co/t/x-pack-security-fallback-realm-configuration/163934>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 11, 2019, 4:51pm UTC](https://discuss.elastic.co/t/x-pack-security-fallback-realm-configuration/163934 "2019-01-11T16:51:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jharrisonpnnl](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@jharrisonpnnl](https://discuss.elastic.co/u/jharrisonpnnl)\
**Post date:** [January 11, 2019, 4:51pm UTC](https://discuss.elastic.co/t/x-pack-security-fallback-realm-configuration/163934/1 "2019-01-11T16:51:46Z")

</div>

Hi all,  
I'm trying to set up tiered realms in my elasticsearch.yml. I'd think that the following realm config:

> ```
> xpack.security.authc.realms:
> native1:
> type: native
> order: 1
> pki1:
> type: pki
> order: 0
> 
> ```

Would give me the ability to preferentially log in with PKI, with a fallback to native auth. As it is, I'm only getting PKI prompts, even when explicitly specifying the elastic user credentials.  
Is there a way to tell Elasticsearch that I want to authenticate via PKI OR via native, whichever the client can supply?

---

<div class="post-metadata">

**Author:** ![jharrisonpnnl](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@jharrisonpnnl](https://discuss.elastic.co/u/jharrisonpnnl)\
**Post date:** [January 11, 2019, 7:56pm UTC](https://discuss.elastic.co/t/x-pack-security-fallback-realm-configuration/163934/2 "2019-01-11T19:56:20Z")

</div>

Scratch that - setting  
xpack.security.http.ssl.client\_authentication: required  
instead of  
xpack.security.http.ssl.client\_authentication: optional

is the cause of the issue.  
Once set to optional, I'm able to successfully authenticate with either option

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2019, 7:56pm UTC](https://discuss.elastic.co/t/x-pack-security-fallback-realm-configuration/163934/3 "2019-02-08T19:56:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.