Anonymous access in Kibana (7.17.3, ECK) - full description

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

Hi there,

I know this topic is mentioned there many times and I tried to find the correct configuration there but I'm still missing some small step/config to finish anonymous access. So I decided to ask you for help.

ECK managed Kibana and ES on version 7.17.3

This is may configuration:
elastic.yaml

- config:
      cluster.routing.allocation.disk.watermark.high: "0.92"
      cluster.routing.allocation.disk.watermark.low: "0.85"
      node.store.allow_mmap: false
      reindex.remote.whitelist: elasticsearch-master.logging.svc:9200
      xpack.security.authc.anonymous.authz_exception: false
      xpack.security.authc.anonymous.roles:
      - chuck
      xpack.security.authc.anonymous.username: wldf

kibana.yaml

spec:
  config:
    xpack.reporting.csv.maxSizeBytes: 250000000
    xpack.security.authc.providers:
      anonymous.anonymous1:
        credentials:
          password: wldf
          username: wldf
        order: 1
      basic.basic1:
        order: 0

Creating chuck role:

PUT /_security/role/chuck
{
  "cluster": ["all"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["all"]
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": ["all"],
      "resources": ["*"]
    }
  ]
}
{
  "role" : {
    "created" : false
  }
}

Verifying that user wldf exists:

GET /_security/user/wldf
{
  "wldf" : {
    "username" : "wldf",
    "roles" : [
      "chuck"
    ],
    "full_name" : null,
    "email" : null,
    "metadata" : {
      "_reserved" : true
    },
    "enabled" : true
  }
}

When I open Kibana URL I see this screen that offers two types of login:

image
image732×487 17.2 KB

When I click on Guest I get this error:

Could not perform login.
[security_exception: [security_exception] Reason: unable to authenticate user [wldf] for REST request [/_security/_authenticate]]: unable to authenticate user [wldf] for REST request [/_security/_authenticate]
Error: [security_exception: [security_exception] Reason: unable to authenticate user [wldf] for REST request [/_security/_authenticate]]: unable to authenticate user [wldf] for REST request [/_security/_authenticate]
    at login_form_LoginForm.loginWithSelector (http://localhost:5601/46815/bundles/plugin/security/8.0.0/security.chunk.5.js:3:19657)

When I try to login with creds wldf/wldf I get 401:

kibana-eck-kb-549d7585f6-86772 kibana {"type":"response","@timestamp":"2025-05-15T16:26:44+00:00","tags":[],"pid":7,"method":"post","statusCode":401,"req":{"url":"/internal/security/login","method":"post","headers":{"host":"localhost:5601","connection":"keep-alive","content-length":"153","sec-ch-ua-platform":"\"Linux\"","user-agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","sec-ch-ua":"\"Chromium\";v=\"136\", \"Google Chrome\";v=\"136\", \"Not.A/Brand\";v=\"99\"","content-type":"application/json","kbn-version":"7.17.3","sec-ch-ua-mobile":"?0","accept":"*/*","origin":"http://localhost:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"http://localhost:5601/login?msg=LOGGED_OUT","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9"},"remoteAddress":"127.0.0.1","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","referer":"http://localhost:5601/login?msg=LOGGED_OUT"},"res":{"statusCode":401,"responseTime":26,"contentLength":263},"message":"POST /internal/security/login 401 26ms - 263.0B"}

I have no idea what I did wrong or missed. Your help is very appreciated. Thank you in advance!

2

I found it! I had to change kibana.yaml config:

spec:
  config:
    xpack.security.authc.providers:
      anonymous.anonymous1:
        credentials: elasticsearch_anonymous_user # <<== built-in default user
        order: 1
      basic.basic1:
        order: 0

The error I got comes from the fact that Kibana is trying to log in to Elasticsearch with Basic-Auth credentials (user = wldf, password =wldf), but the user it is talking to is the special anonymous user that Elasticsearch creates automatically.
That anonymous user elasticsearch_anonymous_user is _reserved and it never has a password and it cannot be used with Basic authentication, so every request that contains a Authorization: Basic … header for it is rejected with [security_exception] unable to authenticate user [wldf].

Important documentation:
kibana ... there is mentioned default elasticsearch_anonymous_user user managed by Kibana
elasticsearch ... basic concept described here