{"action":"created","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/191","repository_url":"https://api.github.com/repos/floragunncom/search-guard","labels_url":"https://api.github.com/repos/floragunncom/search-guard/issues/191/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard/issues/191/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard/issues/191/events","html_url":"https://github.com/floragunncom/search-guard/issues/191","id":168938964,"number":191,"title":"Authentication not being passed to kibana plugins","user":{"login":"djtecha","id":3084627,"avatar_url":"https://avatars.githubusercontent.com/u/3084627?v=3","gravatar_id":"","url":"https://api.github.com/users/djtecha","html_url":"https://github.com/djtecha","followers_url":"https://api.github.com/users/djtecha/followers","following_url":"https://api.github.com/users/djtecha/following{/other_user}","gists_url":"https://api.github.com/users/djtecha/gists{/gist_id}","starred_url":"https://api.github.com/users/djtecha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djtecha/subscriptions","organizations_url":"https://api.github.com/users/djtecha/orgs","repos_url":"https://api.github.com/users/djtecha/repos","events_url":"https://api.github.com/users/djtecha/events{/privacy}","received_events_url":"https://api.github.com/users/djtecha/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-02T17:11:42Z","updated_at":"2016-08-02T18:06:24Z","closed_at":null,"body":" #Versions\r\njava version \"1.8.0_92\"\r\nJava(TM) SE Runtime Environment (build 1.8.0_92-b14)\r\nJava HotSpot(TM) 64-Bit Server VM (build 25.92-b14, mixed mode)\r\nelasticsearch-2.3.4\r\n search-guard-2-2.3.4.4\r\nsearch-guard-ssl-2.3.4.14\r\nkibana-4.5.3\r\n\r\nInstall the marvel plugin (or timelion), restart kibana then try to use the plugins using the drop down from kibana. This leads to a http basic auth window dropping down even though I am already logged in, and since I use SSO the authentication can not be completed and results in a 401 unauthorized.\r\n\r\n> [2016-08-02 09:57:46,201][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[test@gmail.com not found] \r\ncom.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[daniel.kasen@redfin.com not found]\r\n\tat com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2203)\r\n\tat com.google.common.cache.LocalCache.get(LocalCache.java:3937)\r\n\tat com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)\r\n\tat com.floragunn.searchguard.auth.BackendRegistry.authenticate(BackendRegistry.java:401)\r\n\tat com.floragunn.searchguard.filter.SearchGuardRestFilter.process(SearchGuardRestFilter.java:56)\r\n\tat org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:263)\r\n\tat org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:176)\r\n\tat org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:128)\r\n\tat org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:86)\r\n\tat org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:449)\r\n\tat org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:61)\r\n\tat org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)\r\n\tat org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)\r\n\tat org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)\r\n\tat org.jboss.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)\r\n\tat org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)\r\n\tat org.jboss.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)\r\n\tat org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)\r\n\tat org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)\r\n\tat org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)\r\n\tat org.jboss.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)\r\n\tat org.jboss.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)\r\n\tat org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)\r\n\tat org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)\r\n\tat org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)\r\n\tat org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)\r\n\tat org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)\r\n\tat org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)\r\n\tat org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)\r\n\tat org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)\r\n\tat org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)\r\n\tat org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)\r\n\tat org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)\r\n\tat org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\n\r\nsg_config:\r\n\r\nsearchguard:\r\n\r\n  dynamic:\r\n    http:\r\n      xff:\r\n        enabled: true\r\n        trustedProxies: '.*'\r\n        internalProxies: '.*'\r\n        remoteIpHeader:  'x-forwarded-for'\r\n        proxiesHeader:   'x-forwarded-by'\r\n    authc:\r\n      authentication_domain_proxy:\r\n        enabled: true\r\n        order: 1\r\n        http_authenticator:\r\n          type: proxy\r\n          challenge: false\r\n          config:\r\n            user_header: \"x-proxy-user\"\r\n            roles_header: \"x-proxy-roles\"\r\n        authentication_backend:\r\n          type: noop\r\n      authentication_domain_basic_internal:\r\n        enabled: true\r\n        order: 2\r\n        http_authenticator:\r\n          type: basic\r\n          challenge: false\r\n        authentication_backend:\r\n          type: intern\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/comments/236990415","html_url":"https://github.com/floragunncom/search-guard/issues/191#issuecomment-236990415","issue_url":"https://api.github.com/repos/floragunncom/search-guard/issues/191","id":236990415,"user":{"login":"djtecha","id":3084627,"avatar_url":"https://avatars.githubusercontent.com/u/3084627?v=3","gravatar_id":"","url":"https://api.github.com/users/djtecha","html_url":"https://github.com/djtecha","followers_url":"https://api.github.com/users/djtecha/followers","following_url":"https://api.github.com/users/djtecha/following{/other_user}","gists_url":"https://api.github.com/users/djtecha/gists{/gist_id}","starred_url":"https://api.github.com/users/djtecha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djtecha/subscriptions","organizations_url":"https://api.github.com/users/djtecha/orgs","repos_url":"https://api.github.com/users/djtecha/repos","events_url":"https://api.github.com/users/djtecha/events{/privacy}","received_events_url":"https://api.github.com/users/djtecha/received_events","type":"User","site_admin":false},"created_at":"2016-08-02T18:06:24Z","updated_at":"2016-08-02T18:06:24Z","body":"I have noticed that if I enable anonymous_auth_enabled: true and add that user to the correct permissions it is able to pass though directly to port 5601, so not going through my nginx frontend. Seems as if kibana is dropping the x-proxy-user when it passes to applications that are not kibana itself. "}}
{"actor":{"display_login":"djtecha"}}