Authentication finally failed for kibanaserver

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue:

Hi guys, /var/log/opensearch/graylog_server.json gets flooded with:

{"type": "server", "timestamp": "2023-07-28T08:39:47,597+02:00", "level": "WARN", "component": "o.o.s.a.BackendRegistry", "cluster.name": "graylog", "node.name": "whale.mine.priv", "message": "Authentication finally failed for kibanaserver from 127.0.0.1:33274", "cluster.uuid": "6KjyqnWzQly9jSGNwYWBKg", "node.id": "gFlLQt6hSh2mzBX_RpqzKA"

Is that - with dashboards up&running - because the instructions from official does been followed, namely, removing all “demo” users except from ‘admin’ ?
In other words: ‘kibanaserver’ must ! exist in “opensearch-security/internal_users.yml” - which docs do not mention or I failed to find that bit?

many thanks, L.

Configuration:

Relevant Logs or Screenshots:

Hi @lejeczek !

You can use the kibanaserver user or another user that has the same permissions as the kibanaserver user.

You need the internal_users.yml file in order to upload user’s data to the cluster. After applying changes, you can remove this file. User’s credentials will be stored in your cluster.

It’s not that I can, it seems that, that user must exists if dashboards is used - it seems to me be the case and I was looking/asking for confirmation of that.
I was saying also that official docs - if devel or whomever does the docs - howto setup says remove all users but ‘admin’ and dashboards specific docs do not cover those parts - or I failed to find them - which makes it necessarily confusing for novices like myself.

@lejeczek Could you send the link to the documentation where it says that demo users must be removed?

Hello,
I had a similar problem. I deleted the kibanaserver user and couldn’t get the Dashbord working later. It’s mentionned here :

=> in the “Configure a user” section.
Cheers,
M

Hi @Moma

Sorry about that. Thank you for the link. Please add the kibanaserver user to your internal_users.yml file. It definitely should be changed in the documentation. I will create the task for that.

Thanks a lot, I kind of figured it out when I saw this kibanaserver user in the opensearch-dashboard.yml file, but it would help if there were more explanations about those users, especially for newbies.
M.