{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/32699","repository_url":"https://api.github.com/repos/elastic/elasticsearch","labels_url":"https://api.github.com/repos/elastic/elasticsearch/issues/32699/labels{/name}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/32699/comments","events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/32699/events","html_url":"https://github.com/elastic/elasticsearch/issues/32699","id":348569250,"node_id":"MDU6SXNzdWUzNDg1NjkyNTA=","number":32699,"title":"Unexpected basic auth prompt with SPNEGO (kerberos) enabled in browser","user":{"login":"robgil","id":1257843,"node_id":"MDQ6VXNlcjEyNTc4NDM=","avatar_url":"https://avatars1.githubusercontent.com/u/1257843?v=4","gravatar_id":"","url":"https://api.github.com/users/robgil","html_url":"https://github.com/robgil","followers_url":"https://api.github.com/users/robgil/followers","following_url":"https://api.github.com/users/robgil/following{/other_user}","gists_url":"https://api.github.com/users/robgil/gists{/gist_id}","starred_url":"https://api.github.com/users/robgil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robgil/subscriptions","organizations_url":"https://api.github.com/users/robgil/orgs","repos_url":"https://api.github.com/users/robgil/repos","events_url":"https://api.github.com/users/robgil/events{/privacy}","received_events_url":"https://api.github.com/users/robgil/received_events","type":"User","site_admin":false},"labels":[{"id":912837951,"node_id":"MDU6TGFiZWw5MTI4Mzc5NTE=","url":"https://api.github.com/repos/elastic/elasticsearch/labels/:Security/Authentication","name":":Security/Authentication","color":"0e8a16","default":false},{"id":912911731,"node_id":"MDU6TGFiZWw5MTI5MTE3MzE=","url":"https://api.github.com/repos/elastic/elasticsearch/labels/v6.4.0","name":"v6.4.0","color":"DDDDDD","default":false}],"state":"open","locked":false,"assignee":{"login":"bizybot","id":902768,"node_id":"MDQ6VXNlcjkwMjc2OA==","avatar_url":"https://avatars2.githubusercontent.com/u/902768?v=4","gravatar_id":"","url":"https://api.github.com/users/bizybot","html_url":"https://github.com/bizybot","followers_url":"https://api.github.com/users/bizybot/followers","following_url":"https://api.github.com/users/bizybot/following{/other_user}","gists_url":"https://api.github.com/users/bizybot/gists{/gist_id}","starred_url":"https://api.github.com/users/bizybot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bizybot/subscriptions","organizations_url":"https://api.github.com/users/bizybot/orgs","repos_url":"https://api.github.com/users/bizybot/repos","events_url":"https://api.github.com/users/bizybot/events{/privacy}","received_events_url":"https://api.github.com/users/bizybot/received_events","type":"User","site_admin":false},"assignees":[{"login":"bizybot","id":902768,"node_id":"MDQ6VXNlcjkwMjc2OA==","avatar_url":"https://avatars2.githubusercontent.com/u/902768?v=4","gravatar_id":"","url":"https://api.github.com/users/bizybot","html_url":"https://github.com/bizybot","followers_url":"https://api.github.com/users/bizybot/followers","following_url":"https://api.github.com/users/bizybot/following{/other_user}","gists_url":"https://api.github.com/users/bizybot/gists{/gist_id}","starred_url":"https://api.github.com/users/bizybot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bizybot/subscriptions","organizations_url":"https://api.github.com/users/bizybot/orgs","repos_url":"https://api.github.com/users/bizybot/repos","events_url":"https://api.github.com/users/bizybot/events{/privacy}","received_events_url":"https://api.github.com/users/bizybot/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-08-08T04:17:34Z","updated_at":"2018-08-08T04:24:49Z","closed_at":null,"author_association":"NONE","body":"<!-- Feature request -->\r\n\r\n**Describe the feature**:\r\n\r\n<!-- Bug report -->\r\n\r\n**Elasticsearch version** (`bin/elasticsearch --version`): 6.4\r\n\r\n**Plugins installed**: []\r\n\r\n**JVM version** (`java -version`):\r\n\r\n**OS version** (`uname -a` if on a Unix-like system):\r\n\r\n**Description of the problem including expected versus actual behavior**: With kerberos enabled, basic auth still has first priority and issues a popup for user/pass in the browser. Moving kerberos to order 0 doesn't change this behavior.\r\n\r\n**Steps to reproduce**:\r\n_elasticsearch.yml_\r\n```\r\nxpack.security.audit.enabled: true\r\nxpack.security.audit.outputs: [ logfile ]\r\nxpack.security.enabled: true\r\nxpack:\r\n  security:\r\n    authc:\r\n      realms:\r\n        kerberos:\r\n            type: kerberos\r\n            order: 0\r\n            keytab.path: /Users/rgil/Downloads/elasticsearch-6.4.0/config/elasticsearch.test.keytab\r\n            remove_realm_name: true\r\n            krb.debug: true\r\n            enabled: true\r\n```\r\n_role mapping_\r\n```\r\n{\r\n  \"roles\" : [ \"superuser\"],\r\n  \"enabled\": true,\r\n  \"rules\" : {\r\n    \"field\" : { \"username\" : \"*\" }\r\n  }\r\n}\r\n```\r\nAfter hitting cancel on the basic auth, the SPNEGO auth passes just fine. \r\n\r\nWith SPNEGO enabled, I would expect no authentication popups/prompts\r\n\r\nFor Firefox `firefox network.negotiate-auth.trusted-uris` needs to be set correctly for the service principal being used (in my testing I used `elasticsearch.test`)\r\n\r\nConfiguration for kerberos is using FreeIPA\r\n\r\nClient OS is OSX (_not_ MIT kerberos)\r\n\r\nPlease include a *minimal* but *complete* recreation of the problem, including\r\n(e.g.) index creation, mappings, settings, query etc.  The easier you make for\r\nus to reproduce it, the more likely that somebody will take the time to look at it.\r\n\r\n- Create keytab\r\n- Configure /etc/krb5.conf on server (hosting elasticsearch)\r\n- Grant permissions to service principal\r\n- Configure ES\r\n- Set Role\r\n- kinit <user>@<realm>\r\n- `curl -s --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt  http://elasticsearch.test:9200/_xpack/security/_authenticate|jq` to validate\r\n- Test in browser with proper configuration mentioned above \r\n\r\n**Provide logs (if relevant)**:\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments/411280309","html_url":"https://github.com/elastic/elasticsearch/issues/32699#issuecomment-411280309","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/32699","id":411280309,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTI4MDMwOQ==","user":{"login":"robgil","id":1257843,"node_id":"MDQ6VXNlcjEyNTc4NDM=","avatar_url":"https://avatars1.githubusercontent.com/u/1257843?v=4","gravatar_id":"","url":"https://api.github.com/users/robgil","html_url":"https://github.com/robgil","followers_url":"https://api.github.com/users/robgil/followers","following_url":"https://api.github.com/users/robgil/following{/other_user}","gists_url":"https://api.github.com/users/robgil/gists{/gist_id}","starred_url":"https://api.github.com/users/robgil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robgil/subscriptions","organizations_url":"https://api.github.com/users/robgil/orgs","repos_url":"https://api.github.com/users/robgil/repos","events_url":"https://api.github.com/users/robgil/events{/privacy}","received_events_url":"https://api.github.com/users/robgil/received_events","type":"User","site_admin":false},"created_at":"2018-08-08T04:24:49Z","updated_at":"2018-08-08T04:24:49Z","author_association":"NONE","body":"@tvernum makes sense, but perhaps its possible to change the order / priority? "}}
{"actor":{"display_login":"robgil"}}