HTTP auth proxy (nginx) not working

[hathaway]

Based on the sample/nginx.conf example and comments, I have an nginx proxy setup with http auth. The only difference being that I have http auth required on the entire proxy but the comments indicate this is fine. I can go directly to the proxy at http://fqdn:8080 which prompts or the username/password and after authenticating I can receive responses in json from the elasticsearch server. But when I use this in the config.js nothing loads and the requests fail with a 401 error.

If I use the http://fqdn:9200 directly in config.js everything works fine but I'd like to put elasticsearch behind a proxy with http auth.

One the server nginx is logging the following error:

2013/06/26 21:24:36 [error] 5481#0: *1 no user/password was provided for basic authentication, client: 1.2.3.4, server: elasticsearch, request: "GET /_aliases HTTP/1.1", host: "fqdn:8080", referrer: "http://kibana.dev/"

It appears since kibana isn't sending a username/password the request for /_aliases is just failing instead of the browser prompting for authentication.

This seems like a bug but I may be missing something. Has anyone been able to get a similar setup working?

[rashidkpc]

Interesting. Which browser is this?

[hathaway]

I've tried in the latest versions of Chrome and Safari.

[rashidkpc]

Not sure why this is happening, Kibana isn't responsible for sending the username/password. The browser should prompt for it. I'm using the same setup on demo.kibana.org.

[hathaway]

I don't get a username/password prompt on demo.kibana.org. Is it just using a proxy without http auth? That seems to work fine. It's when I require HTTP auth to get to the ES server that Kibana stops working because it is not authenticating (401 error). However, when I hit the urls for the ES server directly in the browser, it does prompt for the username/password and works when I provide the credentials.

[rashidkpc]

Try saving a dashboard, you should get a l/p prompt

[hathaway]

No luck. It doesn't prompt for credentials. It flashes the green dialog saying it saved but doesn't actually save it. The list of dashboards remains empty. When I point directly to the ES server (no http auth) and do the same thing, it saves successfully and shows in the list.

I did also notice this in the console for Chrome:

XMLHttpRequest cannot load http://fqdn:8080/_aliases. Origin http://kibana.dev is not allowed by Access-Control-Allow-Origin.

I wonder if that could be affecting the browser prompting for the credentials? I'm running it locally for testing using pow.cx (that's where the .dev hostname comes from). The request is still making it the server as shown in the logs:

2013/07/08 14:28:01 [error] 5481#0: *1613 no user/password was provided for basic authentication, client: 1.2.3.4, server: elasticsearch, request: "GET /_aliases HTTP/1.1", host: "fqdn:8080", referrer: "http://kibana.dev/"

Does kibana have to run on the same hostname that it will be connecting to for ES?

[rashidkpc]

Sorry, I meant try saving a dashboard on demo.kibana.org

And no, unless you've turned off the cors settings of elasticsearch, it does not need to run on the same host.

[hathaway]

Ah, I see the prompt when saving a dashboard on the demo site. Should the same thing be happening when kibana initially loads and tries to pull data from ES via the http auth proxy?

[rashidkpc]

I've just tested it with auth on both the static assets (kibana's files) and the proxy, and it works, correctly prompting me for a username and password before displaying anything

[hathaway]

I must be doing something different.

Here is the nginx configuration I'm using. It is being installed by the elasticsearch::proxy recipe in the ES cookbook. This is setup on a server at fqdn.

Then I'm pointing the config.js.file to that proxy like this:

var config = new Settings(
{
  // By default this will attempt to reach ES at the same host you have
  // elasticsearch installed on. You probably want to set it to the FQDN of your
  // elasticsearch host
  //elasticsearch:    "http://"+window.location.hostname+":9200",
  elasticsearch: 'http://fqdn:8080',
  kibana_index:     "kibana-int",
  modules:          ['histogram','map','pie','table','stringquery','sort',
                    'timepicker','text','fields','hits','dashcontrol',
                    'column','derivequeries','trends','bettermap'],
  }
);

Any idea why this never prompts for the username/password in kibana?

[rashidkpc]

Closing this as inactive.