# Xpack File User is not authorized

**URL:** <https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891>\
**Category:** Elasticsearch\
**Created:** [February 21, 2017, 1:51pm UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891 "2017-02-21T13:51:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sgarap](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@sgarap](https://discuss.elastic.co/u/sgarap)\
**Post date:** [February 21, 2017, 1:51pm UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/1 "2017-02-21T13:51:31Z")

</div>

Hi,

I am staring elasticsearch cluster with kubernetes and docker. While running the docker, I created an admin user using /usr/share/elasticsearch/bin/x-pack/users useradd myadmin -p secret -r admin. The following output is returned after executing users list command from inside the container.

bash-4.2$ /usr/share/elasticsearch/bin/x-pack/users list  
**myadmin** : admin

In elasticsearch.yml, I also added  
xpack.security.authc:  
realms:  
file:  
type: file  
order: 0  
native:  
type: native  
order: 1

My roles.yml looks like

admin:  
cluster: ['all']  
indices:  
- names: ['\*']  
privileges: ['all']

I am successfully able to retrieve the cluster health using built in superuser elastic, but when I tried to do the same with my file user, I got

{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [**myadmin**] for REST request [/\_cluster/health?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
}  
],  
"type" : "security\_exception",  
"reason" : "unable to authenticate user [myadmin] for REST request [/\_cluster/health?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
},  
"status" : 401  
}

Any idea about what I am missing here?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 22, 2017, 1:44am UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/2 "2017-02-22T01:44:06Z")

</div>

There's not anything obvious, so we're going to need to do some debugging.

The fact that you're getting errors that say

> unable to authenticate user [myadmin]

Indicates that this is an authentication problem. Either the x-pack authentication module either thinks that `myadmin` doesn't exist, or it thinks you're entering the wrong password.

So, for now we can ignore everything to do will _roles_, and just focus on the realm and user/password setup.

First we can check that your realm configuration is being applied to the elasticsearch server. Run:

```auto
curl -XGET -u elastic 'localhost:9200/_xpack/usage?pretty'

```

The output _should_ look something like this:

```auto
{
  "security": {
    "available": true,
    "enabled": true,
    "realms": {
       "file": { "name":["file"], "available":true, "size":[0], "enabled":true, "order":[0] },
       // ... more realm types
    },
    // more security details
  },
  // more x-pack details
}

```

If that's the case, then we want to check that the file that was being updates by `bin/x-pack/users` is the same file that elasticsearch is reading from.

Look for the file `${CONFIG_DIR}/x-pack/users` where `${CONFIG_DIR}` is the directory that has your `elasticsearch.yml`. Depending on how you installed elasticsearch, and where things are configured, it's possible that the `users` tool is updating a file in a different location, so make sure you look at the file in the config directory that is being used by your elasticsearch server.

That file should look something like:

```auto
myadmin:$2a$10$0aBiV9GUAGPqxaRxRwvWveBk1HzytTVmsss.LsyL62Fe63xkGK2Ae

```

The bit before the `:` is the userid, the bit after the `:` is the bcrypt-ed password.

If that's all in place, then the most likely cause is a password issue.  
You could use a bcrypt tool (there's some online if you need) to check whether that bcrypt hash matches the password that you think it's supposed to be ("secret").

---

<div class="post-metadata">

**Author:** ![sgarap](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@sgarap](https://discuss.elastic.co/u/sgarap)\
**Post date:** [February 22, 2017, 9:49am UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/3 "2017-02-22T09:49:47Z")

</div>

Hi Tim,

curl -XGET -u elastic 'localhost:9200/\_xpack/usage?pretty' has  
"realms" : {  
"file" : {  
"name" : [  
"file"  
],  
"available" : true,  
"size" : [  
0  
],  
"enabled" : true,  
"order" : [  
0  
]  
}

I copied elasticsearch.yml file to **/usr/share/elasticsearch/config** , where as I found that there is a default (everything commented out) elasticsearch.yml at **/etc/elasticsearch**. I used rpm for installing elasticsearch, but it seems elastic search is using the elasticsearch.yml from /usr/share/elasticsearch/config, I added file realm settings to the file in /usr/share/elasticsearch/config and curl -XGET -u elastic 'localhost:9200/\_xpack/usage?pretty' is showing the file realm as enabled.

On the other hand users tool created users file at **/etc/elasticsearch/x-pack** and this file has the correct user name and password for myadmin user.

How can i tell users tool to also create the users file at /usr/share/elasticsearch/config instead of /etc/elasticsearch/

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 24, 2017, 1:46am UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/4 "2017-02-24T01:46:13Z")

</div>

> [@sgarap](#):
>
> How can i tell users tool to also create the users file at /usr/share/elasticsearch/config instead of /etc/elasticsearch/

Try one of these:

```auto
CONF_DIR=/usr/share/elasticsearch/config bin/x-pack/users useradd myadmin -p secret -r admin

```

or

```auto
bin/x-pack/users useradd -Epath.conf=/usr/share/elasticsearch/config myadmin -p secret -r admin

```

---

<div class="post-metadata">

**Author:** ![sgarap](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@sgarap](https://discuss.elastic.co/u/sgarap)\
**Post date:** [March 8, 2017, 12:40pm UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/5 "2017-03-08T12:40:24Z")

</div>

Hi Tim,

bin/x-pack/users useradd -Epath.conf=/usr/share/elasticsearch/config myadmin -p secret -r admin worked. May Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2017, 12:40pm UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/6 "2017-04-05T12:40:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.