# Xpack File realm user cant login

**URL:** <https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266>\
**Category:** Elasticsearch\
**Created:** [June 21, 2017, 10:39am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266 "2017-06-21T10:39:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jerry\_Huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry_huang/32/19366_2.png) [@Jerry\_Huang](https://discuss.elastic.co/u/Jerry_Huang)\
**Post date:** [June 21, 2017, 10:39am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/1 "2017-06-21T10:39:22Z")

</div>

HI i saw some of the similar question like

> [@Xpack File User is not authorized](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/2):
>
> There's not anything obvious, so we're going to need to do some debugging. The fact that you're getting errors that say unable to authenticate user [myadmin] Indicates that this is an authentication problem. Either the x-pack authentication module either thinks that myadmin doesn't exist, or it thinks you're entering the wrong password. So, for now we can ignore everything to do will roles, and just focus on the realm and user/password setup. First we can check that your realm configurati…

but still cant work so please help LOL

i use file realm to add a new user

 ![](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba10a478d6d77978d5c1ce1d9069faaf8eb70f5a.png)  
and in ./users list i have  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/0/3/033a507dda0ae2a0eea1a7611732302b12a88a5b.png)  
then i go to check my users and users roles file  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef1110a955a63e1b7e76d7ab0740a66e56f83f52.png)  
they both look normal...

then when i test my account i get an error said unable to authenticate user

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e33cbc4a61a4ac9eeeeb02f214f8282c11f72c46.png)

if i test the default user elastic with the password changme . it's work

oh and all my version is 5.4.1

any suggestion????

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 21, 2017, 10:57am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/2 "2017-06-21T10:57:15Z")

</div>

Please don't paste screenshots. Copy and paste from your terminal - apart from being easier for those of us who read on mobile devices, it also makes it much easier for us to post replies like this:

You ran

```auto
./users useradd admin -p passowrd -r superuser

```

You misspelt `password`.

---

<div class="post-metadata">

**Author:** ![Jerry\_Huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry_huang/32/19366_2.png) [@Jerry\_Huang](https://discuss.elastic.co/u/Jerry_Huang)\
**Post date:** [June 21, 2017, 12:03pm UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/3 "2017-06-21T12:03:17Z")

</div>

Sorry Tim my bad first ask question in community  
I tried one more time,delete the orignally misspelt user  
`./user userdel admin`  
and add new user  
`./users useradd admin -p password -r superuser`  
then check ./users list result is  
`superuser:admin`  
then I check users in xpack ,it different now  
`admin:$2a$10$0m.G/whh9Yw7xf9cbDtlUu80g2yDWdbtmIrGsGf/lsOJNTvEfWPfi`  
user\_roles inside is  
`admin:superuser`  
In the end I use  
`curl -XGET --user admin:password -k 'https://172.16.1.244:9200/sales_record/_search?pretty'`  
but sill got the error message  
[root@localhost x-pack]# curl -XGET --user admin:password -k '[https://172.16.1.244:9200/sales\_record/\_search?pretty](https://172.16.1.244:9200/sales_record/_search?pretty)'  
{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [admin] for REST request [/sales\_record/\_search?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
}  
],  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [admin] for REST request [/sales\_record/\_search?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
},  
"status" : 401  
}

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 22, 2017, 1:11am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/4 "2017-06-22T01:11:40Z")

</div>

What does your `elasticsearch.yml` config file look like?

Per [the documentation for the file realm](https://www.elastic.co/guide/en/x-pack/current/file-realm.html):

[quote]  
When you configure realms in elasticsearch.yml, only the realms you specify are used for authentication. To use the file realm as a fallback, you must include it in the realm chain.[/quote]

If you have configured anything under `xpack.security.authc.realms.*` then you need to explicitly list the file realm as well.

---

<div class="post-metadata">

**Author:** ![Jerry\_Huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry_huang/32/19366_2.png) [@Jerry\_Huang](https://discuss.elastic.co/u/Jerry_Huang)\
**Post date:** [June 22, 2017, 3:40am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/5 "2017-06-22T03:40:27Z")

</div>

I did add a file realm call my\_realm in the end of my `elasticsearch.yml`

here is my `elasticsearch.yml`

```
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please see the documentation for further information on configuration options:
# <https://www.elastic.co/guide/en/elasticsearch/reference/5.0/settings.html>
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
network.host: 172.16.1.244
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, see the documentation at:
# <https://www.elastic.co/guide/en/elasticsearch/reference/5.0/modules-network.html>
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
#
#discovery.zen.minimum_master_nodes: 3
#
# For more information, see the documentation at:
# <https://www.elastic.co/guide/en/elasticsearch/reference/5.0/modules-discovery-zen.html>
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, see the documentation at:
# <https://www.elastic.co/guide/en/elasticsearch/reference/5.0/modules-gateway.html>
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#configsync.config_path: /var/lib/elasticsearch/elasticsearch/config
script.engine.groovy.inline.update: on
#------------------------------------xpack----------------------
#xpack.security.audit.enabled: true
#xpack.security.audit.outputs: [index, logfile]

#xpack.security.audit.index.settings:
# index:
# number_of_shards: 1
# number_of_replicas: 1

#xpack.security.audit.logfile.events.exclude: [access_granted]
#xpack.security.audit.index.events.exclude: [access_granted]

xpack:
    ssl:
        key: /usr/share/elasticsearch/config/localhost.key
        certificate: /usr/share/elasticsearch/config/localhost.crt
      # This points to where the CA cert is - every node shares this
        certificate_authorities: /usr/share/elasticsearch/config/ca.crt

# We need to ensure that the transport (port 9300) and HTTP (port
# 9200) protocols secure communication is enabled:
xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.enabled: true

xpack:
  security:
    authc:
      realms:
        my_realm:
          type: file
          order: 0

```

And I tried to remove ca and ssl .but still get the same result.  
Any ideas??

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 3:40am UTC](https://discuss.elastic.co/t/xpack-file-realm-user-cant-login/90266/6 "2017-07-20T03:40:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.