# Issue with login to kibana through JWT **URL:** \ **Category:** Security\ **Created:** [March 10, 2020, 6:10am UTC](https://forum.opensearch.org/t/issue-with-login-to-kibana-through-jwt/2380 "2020-03-10T06:10:38Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![mirathod](https://avatars.discourse-cdn.com/v4/letter/m/b3f665/32.png) [@mirathod](https://forum.opensearch.org/u/mirathod)\ **Post date:** [March 10, 2020, 6:10am UTC](https://forum.opensearch.org/t/issue-with-login-to-kibana-through-jwt/2380/1 "2020-03-10T06:10:38Z")
I am unable to login (or access any kibana apis) through JWT. Below are configurations which i used. SecurityConfiguration in kibana **security.config.yml** > jwt\_auth\_domain: > enabled: true > http\_enabled: true > transport\_enabled: true > order: 0 > http\_authenticator: > type: jwt > challenge: false > config: > signing\_key: “MIIBIjANBgkqhkiG9w0BA…” > jwt\_header: “access\_token” > roles\_key: “authorities” > subject\_key: “user\_name” > authentication\_backend: > type: noop **elasticsearch.yml** > ######## Start OpenDistro for Elasticsearch Security Demo Configuration ######## > > # WARNING: revise all the lines below before you go into production > opendistro\_security.authcz.admin\_dn: - “CN=elasticsearch,OU=NetWitness,O=RSA,L=Reston,ST=VA,C=US” - “CN=rsa-nw-metrics-server,OU=NetWitness,O=RSA,L=Reston,ST=VA,C=US” # RBAC config for Kibana > opendistro\_security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”] > opendistro\_security.unsupported.restapi.allow\_securityconfig\_modification: true **kibana.yml** # Description: # Default Kibana configuration for Open Distro. > elasticsearch.hosts: “[https://localhost:9200](https://localhost:9200)” > elasticsearch.ssl.certificateAuthorities: /etc/pki/nw/trust/truststore.pem > elasticsearch.ssl.verificationMode: certificate > elasticsearch.username: kibanaserver > elasticsearch.password: kibanaserver > elasticsearch.requestHeadersWhitelist: [“securitytenant”,“Authorization”,“access\_token”] > opendistro\_security.allow\_client\_certificates: true > opendistro\_security.multitenancy.enabled: true > opendistro\_security.multitenancy.tenants.preferred: [“Private”, “Global”] > opendistro\_security.readonly\_mode.roles: [“kibana\_read\_only”] > opendistro\_security.jwt.enabled: true > opendistro\_security.auth.type: “jwt” > server.host: “0.0.0.0” > server.ssl.enabled: true > server.ssl.key: /etc/kibana/kibana-key.pem > server.ssl.certificate: /etc/kibana/kibana-cert.pem Below is my jwt token: > Header: > { > “alg”: “RS256”, > “typ”: “JWT” > } > { > “exp”: 1583847013752, > “iss”: “security-server-3272677e-1552-4b8e-9dee-8563c127be21”, > “iat”: 1583818213752, > “authorities”: [ > “Administrators” > ], > “user\_name”: “admin” > } # Encoded JWT Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1ODM4NDcwMTM3NTIsImlzcyI6InNlY3VyaXR5LXNlcnZlci0zMjcyNjc3ZS0xNTUyLTRiOGUtOWRlZS04NTYzYzEyN2JlMjEiLCJpYXQiOjE1ODM4MTgyMTM3NTIsImF1dGhvcml0aWVzIjpbIkFkbWluaXN0cmF0b3JzIl0sInVzZXJfbmFtZSI6ImFkbWluIn0.YOxUPRyhXlJIKcIYLimAZnciEw3drVXjQDTJz-8TjHu0GSoD7SlJeY4azEhnUogGjVwXV\_vh–ROb\_dwVMme173R-6Hn6ynOTDsfKN61l3DXXyp1FZu-FV8H8ziLaY9B-ULUbqw9e8Cq21FGkhhyux6JPqfC3GR9-DaLAgVRo7QyHK9a-HTBi9wWelzN\_XHI91agI0d83mOPqKcGMEDVQdyfam-BsY0dgLm7jJ5Mgmu8SwwwK4YzMLyoshO1QZYAcrIdPka5tfFPmDIdE3cTxx-fM-mw8pZ2CykdkHBn1dZyBD-lXqbZ4QYHEfLJMR5vvcLMv9Sh4UyVdbiWsd44Sg I can successfully able to access elastic apis through this token. Below is the Request and Response for elastic apis # Request: curl --location --request GET ‘[https://10.125.250.205:9200/\_cat/indices](https://10.125.250.205:9200/_cat/indices)’ –header ‘access\_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1ODM4NDcwMTM3NTIsImlzcyI6InNlY3VyaXR5LXNlcnZlci0zMjcyNjc3ZS0xNTUyLTRiOGUtOWRlZS04NTYzYzEyN2JlMjEiLCJpYXQiOjE1ODM4MTgyMTM3NTIsImF1dGhvcml0aWVzIjpbIkFkbWluaXN0cmF0b3JzIl0sInVzZXJfbmFtZSI6ImFkbWluIn0.YOxUPRyhXlJIKcIYLimAZnciEw3drVXjQDTJz-8TjHu0GSoD7SlJeY4azEhnUogGjVwXV\_vh–ROb\_dwVMme173R-6Hn6ynOTDsfKN61l3DXXyp1FZu-FV8H8ziLaY9B-ULUbqw9e8Cq21FGkhhyux6JPqfC3GR9-DaLAgVRo7QyHK9a-HTBi9wWelzN\_XHI91agI0d83mOPqKcGMEDVQdyfam-BsY0dgLm7jJ5Mgmu8SwwwK4YzMLyoshO1QZYAcrIdPka5tfFPmDIdE3cTxx-fM-mw8pZ2CykdkHBn1dZyBD-lXqbZ4QYHEfLJMR5vvcLMv9Sh4UyVdbiWsd44Sg’ # Response Status 200 with correct response i.e. yellow open nw-security-analytics B16YAAL6TR-3AxY3cxSXrA 1 1 18167 0 3.1mb 3.1mb yellow open .opendistro-alerting-alert-history-2020.03.05-000009 FumANqDBQPqHoI-wRWN4SA 1 1 0 0 283b 283b yellow open .opendistro-alerting-alert-history-2020.03.04-000008 IUSDDU2-QFCOf6TfEhWiDg 1 1 0 0 283b 283b green open .opendistro\_security n1TBIlpYTCObhztEbsRyzw 1 0 6 2 56.1kb 56.1kb But when i try to access kibana apis # REQUEST curl --location --request GET ‘[https://10.125.250.205:5601/api/features](https://10.125.250.205:5601/api/features)’ –header ‘access\_token: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1ODM4NDcwMTM3NTIsImlzcyI6InNlY3VyaXR5LXNlcnZlci0zMjcyNjc3ZS0xNTUyLTRiOGUtOWRlZS04NTYzYzEyN2JlMjEiLCJpYXQiOjE1ODM4MTgyMTM3NTIsImF1dGhvcml0aWVzIjpbIkFkbWluaXN0cmF0b3JzIl0sInVzZXJfbmFtZSI6ImFkbWluIn0.YOxUPRyhXlJIKcIYLimAZnciEw3drVXjQDTJz-8TjHu0GSoD7SlJeY4azEhnUogGjVwXV\_vh–ROb\_dwVMme173R-6Hn6ynOTDsfKN61l3DXXyp1FZu-FV8H8ziLaY9B-ULUbqw9e8Cq21FGkhhyux6JPqfC3GR9-DaLAgVRo7QyHK9a-HTBi9wWelzN\_XHI91agI0d83mOPqKcGMEDVQdyfam-BsY0dgLm7jJ5Mgmu8SwwwK4YzMLyoshO1QZYAcrIdPka5tfFPmDIdE3cTxx-fM-mw8pZ2CykdkHBn1dZyBD-lXqbZ4QYHEfLJMR5vvcLMv9Sh4UyVdbiWsd44Sg’ # RESPONSE {“type”:“response”,“@timestamp”:“2020-03-10T05:31:41Z”,“tags”:,“pid”:14734,“method”:“get”,“statusCode”:302,“req”:{“url”:“/api/features”,“method”:“get”,“headers”:{“access\_token”:“Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1ODM4NDcwMTM3NTIsImlzcyI6InNlY3VyaXR5LXNlcnZlci0zMjcyNjc3ZS0xNTUyLTRiOGUtOWRlZS04NTYzYzEyN2JlMjEiLCJpYXQiOjE1ODM4MTgyMTM3NTIsImF1dGhvcml0aWVzIjpbIkFkbWluaXN0cmF0b3JzIl0sInVzZXJfbmFtZSI6ImFkbWluIn0.YOxUPRyhXlJIKcIYLimAZnciEw3drVXjQDTJz-8TjHu0GSoD7SlJeY4azEhnUogGjVwXV\_vh–ROb\_dwVMme173R-6Hn6ynOTDsfKN61l3DXXyp1FZu-FV8H8ziLaY9B-ULUbqw9e8Cq21FGkhhyux6JPqfC3GR9-DaLAgVRo7QyHK9a-HTBi9wWelzN\_XHI91agI0d83mOPqKcGMEDVQdyfam-BsY0dgLm7jJ5Mgmu8SwwwK4YzMLyoshO1QZYAcrIdPka5tfFPmDIdE3cTxx-fM-mw8pZ2CykdkHBn1dZyBD-lXqbZ4QYHEfLJMR5vvcLMv9Sh4UyVdbiWsd44Sg”,“user-agent”:“PostmanRuntime/7.22.0”,“accept”:“_/_”,“cache-control”:“no-cache”,“postman-token”:“c3453a60-283b-4145-9d83-493e690d6ef7”,“host”:“10.125.250.205:5601”,“accept-encoding”:“gzip, deflate, br”,“connection”:“keep-alive”,“securitytenant”:“ **user** ”},“remoteAddress”:“10.91.33.121”,“userAgent”:“10.91.33.121”},“res”:{“statusCode”:302,“responseTime”:26,“contentLength”:9},“message”:“GET /api/features 302 26ms - 9.0B”} {“type”:“response”,“@timestamp”:“2020-03-10T05:31:41Z”,“tags”:,“pid”:14734,“method”:“get”,“statusCode”:200,“req”:{“url”:“/customerror?type=authError”,“method”:“get”,“headers”:{“access\_token”:“Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1ODM4NDcwMTM3NTIsImlzcyI6InNlY3VyaXR5LXNlcnZlci0zMjcyNjc3ZS0xNTUyLTRiOGUtOWRlZS04NTYzYzEyN2JlMjEiLCJpYXQiOjE1ODM4MTgyMTM3NTIsImF1dGhvcml0aWVzIjpbIkFkbWluaXN0cmF0b3JzIl0sInVzZXJfbmFtZSI6ImFkbWluIn0.YOxUPRyhXlJIKcIYLimAZnciEw3drVXjQDTJz-8TjHu0GSoD7SlJeY4azEhnUogGjVwXV\_vh–ROb\_dwVMme173R-6Hn6ynOTDsfKN61l3DXXyp1FZu-FV8H8ziLaY9B-ULUbqw9e8Cq21FGkhhyux6JPqfC3GR9-DaLAgVRo7QyHK9a-HTBi9wWelzN\_XHI91agI0d83mOPqKcGMEDVQdyfam-BsY0dgLm7jJ5Mgmu8SwwwK4YzMLyoshO1QZYAcrIdPka5tfFPmDIdE3cTxx-fM-mw8pZ2CykdkHBn1dZyBD-lXqbZ4QYHEfLJMR5vvcLMv9Sh4UyVdbiWsd44Sg”,“user-agent”:“PostmanRuntime/7.22.0”,“accept”:“_/_”,“cache-control”:“no-cache”,“postman-token”:“c3453a60-283b-4145-9d83-493e690d6ef7”,“accept-encoding”:“gzip, deflate, br”,“referer”:“[https://10.125.250.205:5601/api/features",“host”:“10.125.250.205:5601”,“connection”:“keep-alive”,“securitytenant”:“\_\_user\_\_”},“remoteAddress”:“10.91.33.121”,“userAgent”:“10.91.33.121”,“referer”:“https://10.125.250.205:5601/api/features”},“res”:{“statusCode”:200,“responseTime”:291,“contentLength”:9},“message”:"GET](https://10.125.250.205:5601/api/features%22,%22host%22:%2210.125.250.205:5601%22,%22connection%22:%22keep-alive%22,%22securitytenant%22:%22 __user__ %22%7D,%22remoteAddress%22:%2210.91.33.121%22,%22userAgent%22:%2210.91.33.121%22,%22referer%22:%22https://10.125.250.205:5601/api/features%22%7D,%22res%22:%7B%22statusCode%22:200,%22responseTime%22:291,%22contentLength%22:9%7D,%22message%22:%22GET) /customerror?type=authError 200 291ms - 9.0B”} ---
**Author:** ![yashreddy](https://avatars.discourse-cdn.com/v4/letter/y/a9adbd/32.png) [@yashreddy](https://forum.opensearch.org/u/yashreddy)\ **Post date:** [March 11, 2020, 3:57am UTC](https://forum.opensearch.org/t/issue-with-login-to-kibana-through-jwt/2380/2 "2020-03-11T03:57:29Z")
Hi hello , I am facing a different issue of a kind. [https://stackoverflow.com/questions/60622018/opendistro-throwing-an-error-on-accepting-a-jwt-token-from-keycloak](https://stackoverflow.com/questions/60622018/opendistro-throwing-an-error-on-accepting-a-jwt-token-from-keycloak)