failed to authenticate user [elastic] after enabling xpack.security in elasticsearch

Question

I Use Kibana 7.11.1 stack. this problem is related to elasticsearch alone.

I added xpack.security.enabled: true to elasticsearch.yml and ran elasticsearch-setup-passwords auto to set the default users password. but now when I start elasticsearch I keep seeing the message:

[o.e.x.s.a.AuthenticationService] [SERVER_NAME] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]

i see this only when elasticsearch service is up, so I assumed that I need to set the new elastic user password in elasticsearch.yml file, but i have no idea how..

any ideas ?

thanks

Answer 1

I missed one service that is part of the kibana stack. the elastic-agent.

so the database wasn't trying to connect to itself! :) elastic-agent was trying to connect to elasticsearch without the proper credentials.

once i resolved that and restart elastic-agent, the problem resolved.

Answer 2

The error message indicates that the credentials with which you are trying to authenticate do not match the saved username and password.

After turning on the xpack.security.enabled setting, you can set the built-in user credentials, using the below command

bin/elasticsearch-setup-passwords interactive