# JWT authentication for Kibana

**URL:** <https://forum.opensearch.org/t/jwt-authentication-for-kibana/5515>\
**Category:** Security\
**Created:** [April 2, 2021, 1:03pm UTC](https://forum.opensearch.org/t/jwt-authentication-for-kibana/5515 "2021-04-02T13:03:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Potapyc](https://avatars.discourse-cdn.com/v4/letter/p/59ef9b/32.png) [@Potapyc](https://forum.opensearch.org/u/Potapyc)\
**Post date:** [April 2, 2021, 1:03pm UTC](https://forum.opensearch.org/t/jwt-authentication-for-kibana/5515/1 "2021-04-02T13:03:46Z")

</div>

Hi, I am new to Opendistro and I am trying to set up the jwt authentication mode for Kibana.  
In my config.yml i have:

> Blockquote  
> jwt\_auth\_domain:  
> enabled: true  
> http\_enabled: true  
> transport\_enabled: true  
> order: 0  
> http\_authenticator:  
> type: jwt  
> challenge: false  
> config:  
> signing\_key: "oeRaYY7Wo24sDqKSX3IM9ASGmdGPmkTd9jo1QTy4b7P9Ze5\_9hKolVX8xNrQDcNRfVEdTZNOuOyqEGhXEbdJI-ZQ19k\_o9MI0y3eZN2lp9jow55FfXMiINEdt1XR85VipRLSOkT6kSpzs2x-jbLDiz9iFVzkd81YKxMgPA7VfZeQUm4n-mOmnWMaVX30zGFU4L3oPBctYKkl4dYfqY\>  
> jwt\_header: “Authorization”  
> jwt\_url\_parameter: null  
> roles\_key: “roles”  
> subject\_key: “sub”  
> authentication\_backend:  
> type: noop

The kibana.yml is:

> Blockquote  
> server.name: kibana  
> server.host: “0”  
> elasticsearch.hosts: [https://localhost:9200](https://localhost:9200)  
> elasticsearch.ssl.verificationMode: none  
> elasticsearch.username: kibanaserver  
> elasticsearch.password: kibanaserver  
> elasticsearch.requestHeadersWhitelist: [“securitytenant”,“Authorization”]  
> opendistro\_security.multitenancy.enabled: true  
> opendistro\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
> opendistro\_security.readonly\_mode.roles: [“kibana\_read\_only”]  
> opendistro\_security.auth.type: “jwt”  
> opendistro\_security.cookie.secure: false  
> newsfeed.enabled: false  
> telemetry.optIn: false  
> telemetry.enabled: false  
> security.showInsecureClusterWarning: false

Finally, i executed a GET request with Postman to my client after generating a valid access token and I got the following error:

{

```
"statusCode": 401,

"error": "Unauthorized",

"message": "Authentication error"

```

}

Can anyone please help me? Thank you

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [April 8, 2021, 10:49am UTC](https://forum.opensearch.org/t/jwt-authentication-for-kibana/5515/2 "2021-04-08T10:49:18Z")

</div>

Hi @Potapyc can you please confirm that the value in signing\_key (in config.yml) is base64 encoded. Can you please also check if you are missing closing quotations marks in signing\_key.

If this is all in order, can you confirm that the JWT includes a role under “roles” which is mapped in odfe via roles mapping. For testing purposes I’d recommend to put role as admin in jwt as this will be automatically mapped to admin with full access (assuming this part of odfe was not changed). Also make sure the expiration timestamps are valid in JWT.

---

<div class="post-metadata">

**Author:** ![Potapyc](https://avatars.discourse-cdn.com/v4/letter/p/59ef9b/32.png) [@Potapyc](https://forum.opensearch.org/u/Potapyc)\
**Post date:** [April 14, 2021, 2:36pm UTC](https://forum.opensearch.org/t/jwt-authentication-for-kibana/5515/3 "2021-04-14T14:36:31Z")

</div>

Hi @Anthony, thank you for taking the time to answer and sorry for the delay :-).  
Yes, I have verified that the signing\_key is base64 encoded and I’m not missing quotation marks.  
As for the JWT, here is the unencoded JSON of the payload:

> {  
> “roles”: “admin”,  
> “iss”: “[http://localhost](http://localhost)”,  
> “sub”: “admin”,  
> “exp”: 1618493640  
> }

So, following your suggestion, I have the admin role under “roles”. However I keep getting the same error:

> { “statusCode”: 401, “error”: “Unauthorized”, “message”: “Authentication Exception” }

I should also mention that my OpenDistro version is 1.13.1 and that I am following this guide to set up the configuration:

[Use JSON Web Tokens (JWTs) to Authenticate in Open Distro for Elasticsearch and Kibana | AWS Open Source Blog (amazon.com)](https://aws.amazon.com/it/blogs/opensource/json-web-tokens-jwt-authenticate-open-distro-for-elasticsearch-kibana/)

It is not clear to me from your answer whether I need to make changes to the roles\_mapping.yml, which until now I have not modified. Perhaps the roles mapping is not done correctly?  
Thanks again for your help