Issue with kibana multitenancy when enabled with ingress

Pratiksha · March 4, 2021, 10:36am

I am using kibana security plugin 1.9.0 and have enabled multitenancy. I have ingress enabled in cluster. With this, after selecting a tenant in Tenants Tab through SELECT button and then navigating to any screen (visualize/dashoboard screens) from sidebar menu in kibana getting error as below saying 404 not found:

I observed that the url is getting reformed when I select from sidebar menu after selecting a tenant from SELECT button, the server.basePath specified in ingress section gets removed from url.
For eg. the url before the issue: https:///ingresspath/app/kibana
After following the above sceanrio, the url becomes: https:///app/kibana

Please have a look and suggest.
Thanks

oscark · March 4, 2021, 1:23pm

I’m on 1.12 AFAIK the url should be /app/visualize not /app/kibana/ . I have no clue but I’m wondering if you are using some proxy and you have server.rewriteBasePath configured as false when it should be true.

pablo · March 12, 2021, 12:49pm

@Pratiksha Could you share your config files? (elastic, kibana and config.yml)

Pratiksha · March 24, 2021, 7:06am

Hi @pablo
Please find below multitenancy configuration done.
Elasticsearch config:
config:
dynamic:
kibana:
multitenancy_enabled: true
server_username: kibanaserver
Kibana config:
opendistro_security.multitenancy.enabled: true
elasticsearch.requestHeadersWhitelist: [ “Authorization”, “securitytenant”, “x-forwarded-for”, “x-proxy-user”, “x-proxy-roles” ]

Pratiksha · June 7, 2021, 5:52am

Any update on this. Please check.

Pratiksha · June 7, 2021, 2:54pm

PFB multitenancy configuration in elasticsearch and kibana section:
Elasticsearch config:

Kibana config:

We have server.rewriteBasePath set to false in our case, as kibana is behind a proxy (ingress) and it does the rewriting correctly. We see all pages redirect correctly.
Except the case , when from multitenancy page we select a custom tenant and move to dashboard/discover/visualize tabs from sidebar menu, it strips off the base-url.

I have looked into the security-kibana-plugin code -

github.com

opendistro-for-elasticsearch/security-kibana-plugin/blob/c2136d70cc19196a8b1fb14f9eb12ef1c8ad70ec/public/apps/multitenancy/multitenancy.js#L202


      
                  });
              }
          );
          
          
this.selectTenant = function (tenantLabel, tenant, redirect) {
              $http.post(`${API_ROOT}/multitenancy/tenant`, {tenant: tenant, username: this.username})
                  .then(
                  (response) => {
                      this.tenantLabel = "Active tenant: " + resolveTenantName(response.data, this.username);
                      this.currentTenant = response.data;
                      // clear lastUrls from nav links to avoid not found errors
                      const appsToReset = ['kibana:visualize', 'kibana:dashboard', 'kibana:discover', 'timelion'];
                      chromeWrapper.getNavLinks().forEach((navLink) => {
                          if (appsToReset.indexOf(navLink.id) > -1) {
                              chromeWrapper.resetLastSubUrl(navLink.id);
                          }
                      });
          
          
            if(chrome.getInjected("timelion.ui.enabled")) {
                          chromeWrapper.getNavLinkById("timelion").lastSubUrl = chromeWrapper.getNavLinkById("timelion").url;
                      }

There is something done specifically in multitenantcy.js to avoid not found errors for dashboard/discover/visualize/timelion pages. - is this causing this selective behaviour for these pages?
Please have a look on urgent basis and respond.
Thanks in advance.

Topic		Replies	Views
To access global tenant when multitenancy is enabled Security	8	1633	April 9, 2021
Kibana Multi-Tenant "Tenant Indices migration failed" Security	9	2142	February 8, 2021
When kibana is enabled with multitenancy then after upgrade kibana tenant index gets migrated and after that it is not working properly Security	1	389	April 12, 2021
Kibana: Annoying tenant selection pop-up even though multitenancy is disabled Security	3	900	August 25, 2021
Multitenancy cannot find specific .kibana index Security	6	493	February 8, 2021

Issue with kibana multitenancy when enabled with ingress

Related Topics