Elasticsearch behind proxy with basic auth

[joerg]

Using kibana with elasticsearch behind a proxy with basic auth is currently not possible. I configured the elasticsearch_url in kibana.yml to "https://user:pass@host.com:443/", but when I access kibana (which is also behind a proxy with basic auth) I get asked for the elasticsearch password for each request. It seems to me that for each request (image, css, etc.) the basic auth is requested and I thus have to enter the kibana and the elasticsearch auth information alternatingly.

[joerg]

Ok, sorry for being to unspecific here. Kibana is latest v4 installed via the elkstack chef cookbook by rackspace. Both, kibana and elasticsearch are accessed behind an https proxy (nginx). They are currently both running on the same machine, which is for testing purposes only, so in the future the plan would be to have everything run on separate instances.
Configs for nginx and kibana are here: http://pastebin.com/mC0u1GtQ
Browser is Google Chrome, latest, but I just tested with Firefox and had the same result. If it is possible to have kibana use elasticsearch behind a proxy with basic auth, could you point to and example config?

[rashidkpc]

Kibana should work no problem with a proxy as long as its probably configured. Unfortunately we can't really debug your proxy setup here, but we've tested it with a light weight node proxy and everything is working as expected.

For what its worth, you really don't need this proxy:

1. the backend already restricts read and write access to where its should be allowed
2. the backend supports SSL
3. You can drop a .htpasswd file into the server directory and kibana will use it.

[ngrennan-inflection]

Kibana 4 elasticsearch basic auth support is broken. It is caused by the url being reconstructed for no good reason in routes/proxy.js, and the reconstruction striping out the username and password. Which is also known as uri.auth.

What makes this even worse is that because elasticsearch is proxied by kibana, it will ask the user for the username and password via http auth. Then for the cherry on top if you use basic http auth with kibana, then they override each other.

routes/proxy.js:62:
url: uri.protocol + '//' + uri.host + path,

Works:
url: uri.protocol + '//' + uri.auth + '@' + uri.host + path,

Better:
url: config.elasticsearch + path

[ngrennan-inflection]

To get it fully working I had to use the additional code below. Otherwise proxy.js reads headers from the client and overrides the configuration.

routes/proxy.js:61:
var auth = new Buffer(uri.auth);
base64_auth = auth.toString('base64');
req.headers.authorization = "Basic " + base64_auth;

[ngrennan-inflection]

I created PR #3329 with my changes.