# Xpack File User is not authorized

**URL:** <https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891>\
**Category:** Elasticsearch\
**Created:** [February 21, 2017, 1:51pm UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891 "2017-02-21T13:51:31Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 22, 2017, 1:44am UTC](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891/2 "2017-02-22T01:44:06Z")

</div>

There's not anything obvious, so we're going to need to do some debugging.

The fact that you're getting errors that say

> unable to authenticate user [myadmin]

Indicates that this is an authentication problem. Either the x-pack authentication module either thinks that `myadmin` doesn't exist, or it thinks you're entering the wrong password.

So, for now we can ignore everything to do will _roles_, and just focus on the realm and user/password setup.

First we can check that your realm configuration is being applied to the elasticsearch server. Run:

```auto
curl -XGET -u elastic 'localhost:9200/_xpack/usage?pretty'

```

The output _should_ look something like this:

```auto
{
  "security": {
    "available": true,
    "enabled": true,
    "realms": {
       "file": { "name":["file"], "available":true, "size":[0], "enabled":true, "order":[0] },
       // ... more realm types
    },
    // more security details
  },
  // more x-pack details
}

```

If that's the case, then we want to check that the file that was being updates by `bin/x-pack/users` is the same file that elasticsearch is reading from.

Look for the file `${CONFIG_DIR}/x-pack/users` where `${CONFIG_DIR}` is the directory that has your `elasticsearch.yml`. Depending on how you installed elasticsearch, and where things are configured, it's possible that the `users` tool is updating a file in a different location, so make sure you look at the file in the config directory that is being used by your elasticsearch server.

That file should look something like:

```auto
myadmin:$2a$10$0aBiV9GUAGPqxaRxRwvWveBk1HzytTVmsss.LsyL62Fe63xkGK2Ae

```

The bit before the `:` is the userid, the bit after the `:` is the bcrypt-ed password.

If that's all in place, then the most likely cause is a password issue.  
You could use a bcrypt tool (there's some online if you need) to check whether that bcrypt hash matches the password that you think it's supposed to be ("secret").

---

_[View the full topic](https://discuss.elastic.co/t/xpack-file-user-is-not-authorized/75891)._