An unexpected authentication error occurred. Please log in again.

MeikelLP commented 1 year ago

Kibana version: 8.3.3 (docker)

Elasticsearch version: 8.3.2

Server OS version: Microsoft Windows Server 2019 Standard (Version 10.0.17763 Build 17763)

Browser version: Microsoft Edge Version 107.0.1418.62

Browser OS version: Microsoft Windows 10 Enterprise 10.0.19044 Build 19044

Original install method (e.g. download page, yum, from source, etc.): Elastic with the default Windows installer Kibana via docker-compose

Describe the bug: The user is very frequently being logged out ever single time. A session last 5s to 1min depending on when Kibana decides to kick me out. I tried to hunt this issue down but got very few to none results on Google. I found this: https://discuss.elastic.co/t/kibana-keeps-logging-users-out-with-message-an-unexpected-authentication-error-occurred-please-log-in-again/299729

Which suggest syncing the encryption key on all Kibana instances. I have only 1 instance running. Also, only 1 elastic.

The logs didn't say any error. However, when set to debug (which is like super verbose) I saw a "couldn't decrypt cookie" or something. But this should be fine because a newly correctly encrypted cookie would be generated on the next login, right?

From inspecting the network tab in Edge I noticed that the cookie is cleared once a 401 gets returned from the server. The first request sends the cookie and gets a 200. However, the same request will be sent a second time, this time without the cookie (why?) which will result in a 401 and the frontend will kick me out. This behaves the same on all pages.

I tried to set xpack.security.encryptionKey but with or without it I get the same error every time.

Steps to reproduce: I don't know how to exactly reproduce this, but I will give you my configs:

# docker-compose.yml
version: "3.8"
services:
  kibana:
    image: kibana:8.3.3
    ports:
      - "5601:5601"
    volumes:
      - ./kibana.yml:/usr/share/kibana/config/kibana.yml

# kibana.yml
server:
  host: '0.0.0.0'

logging.root.level: info
telemetry.optIn: false

elasticsearch:
  hosts: ['http://our-server:9200']
  username: kibana_system
  password: SOME_PASSWORD

# elasticsearch.yml
xpack:
  security:
    authc:
      realms:
        native:
          native1:
            order: 0
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: false
xpack.security.transport.ssl:
  enabled: false
cluster.initial_master_nodes: ["ELASTIC"]
http.host: 0.0.0.0

Expected behavior: Not being kicked :)

Screenshots (if relevant):

Errors in browser console (if relevant): Got none sadly

Provide logs and/or server output (if relevant):

Any additional context:

elasticmachine commented 1 year ago

Pinging @elastic/kibana-security (Team:Security)

azasypkin commented 1 year ago

@thomheymann can you please help to triage this one?

thomheymann commented 1 year ago

@MeikelLP Thanks for taking the time to report this issue.

Based purely on your description it would be difficult for me to understand why your users are being kicked out of Kibana so frequently.

Could you please share some additional information to help me debug the issue?

Record and share a HAR file in your browser attempting to login and being kicked out
Kibana log files during that timeframe

Please make sure your files don't contain any private information before posting them here since this is a public forum.

MeikelLP commented 1 year ago

@thomheymann sorry for the bad/good news but I am currently unable to reproduce this issue. Before it happened like all the time and Kibana was not usable at all. Now this issue doesn't occur no matter what I try.

If you want to wait, I might be able to reproduce it in the future as I most likely will need to work with Kibana again

MeikelLP commented 1 year ago

Well it just came back: Redirected to http://localhost:5601/login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR

kibana-hars.txt

Please tell me if I can provide any other information

MeikelLP commented 1 year ago

Could it be related to timezones? I'm seeing the "expires" field being set to 1969-12-31T23:59:59.000Z which is like -1s from 1970 (Datetime zero).

thomheymann commented 1 year ago

Please tell me if I can provide any other information

@MeikelLP Can you provide me with the Kibana logs while you're being logged out?

Could it be related to timezones? I'm seeing the "expires" field being set to 1969-12-31T23:59:59.000Z which is like -1s from 1970 (Datetime zero).

What's the response of GET kbn:/internal/security/session in your dev tools after logging in?

MeikelLP commented 1 year ago

@thomheymann

@MeikelLP Can you provide me with the Kibana logs while you're being logged out?

Click to expand

2023-01-03 12:50:37 [2023-01-03T11:50:37.708+00:00][INFO ][plugins.security.routes] Logging in with provider "basic" (basic)
2023-01-03 12:50:37 [2023-01-03T11:50:37.708+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:37 [2023-01-03T11:50:37.708+00:00][DEBUG][plugins.security.basic.basic] Trying to perform a login.
2023-01-03 12:50:37 [2023-01-03T11:50:37.714+00:00][DEBUG][plugins.security.basic.basic] Login has been successfully performed.
2023-01-03 12:50:37 [2023-01-03T11:50:37.717+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Creating a new session.
2023-01-03 12:50:38 [2023-01-03T11:50:38.347+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully created a new session.
2023-01-03 12:50:38 [2023-01-03T11:50:38.348+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:38 [2023-01-03T11:50:38.349+00:00][DEBUG][http.server.response] POST /internal/security/login 200 644ms - 60.0B
2023-01-03 12:50:38 [2023-01-03T11:50:38.373+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /app/management/data/index_management/indices.
2023-01-03 12:50:38 [2023-01-03T11:50:38.373+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:38 [2023-01-03T11:50:38.378+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:38 [2023-01-03T11:50:38.378+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:38 [2023-01-03T11:50:38.379+00:00][DEBUG][plugins.spaces] Verifying access to space "default"
2023-01-03 12:50:38 [2023-01-03T11:50:38.398+00:00][DEBUG][plugins.security.app-authorization] not authorizing - "management" isn't a protected application
2023-01-03 12:50:38 [2023-01-03T11:50:38.434+00:00][DEBUG][http.server.response] GET /app/management/data/index_management/indices 200 72ms - 150.8KB
2023-01-03 12:50:38 [2023-01-03T11:50:38.496+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 8ms
2023-01-03 12:50:38 [2023-01-03T11:50:38.498+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 8ms
2023-01-03 12:50:38 [2023-01-03T11:50:38.520+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap.js.
2023-01-03 12:50:38 [2023-01-03T11:50:38.520+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:38 [2023-01-03T11:50:38.526+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:38 [2023-01-03T11:50:38.527+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:38 [2023-01-03T11:50:38.555+00:00][DEBUG][http.server.response] GET /bootstrap.js 304 61ms - 19.3KB
2023-01-03 12:50:40 [2023-01-03T11:50:40.008+00:00][DEBUG][http.server.response] GET /translations/en.json 304 3ms - 29.0B
2023-01-03 12:50:40 [2023-01-03T11:50:40.552+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:50:40 [2023-01-03T11:50:40.552+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.557+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.560+00:00][DEBUG][http.server.response] GET /internal/security/me 200 28ms - 321.0B
2023-01-03 12:50:40 [2023-01-03T11:50:40.579+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities.
2023-01-03 12:50:40 [2023-01-03T11:50:40.580+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.588+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.589+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:40 [2023-01-03T11:50:40.704+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/licensing/info.
2023-01-03 12:50:40 [2023-01-03T11:50:40.705+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.716+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:40 [2023-01-03T11:50:40.720+00:00][DEBUG][http.server.response] GET /api/licensing/info 200 71ms
2023-01-03 12:50:40 [2023-01-03T11:50:40.749+00:00][DEBUG][http.server.response] POST /api/core/capabilities 200 195ms - 5.0KB
2023-01-03 12:50:41 [2023-01-03T11:50:41.012+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/licensing/feature_usage/register.
2023-01-03 12:50:41 [2023-01-03T11:50:41.012+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.018+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/licensing/info.
2023-01-03 12:50:41 [2023-01-03T11:50:41.018+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.019+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/banners/info.
2023-01-03 12:50:41 [2023-01-03T11:50:41.019+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.021+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.022+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.028+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.031+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/security_checkup/state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.031+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.033+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.033+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.037+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:50:41 [2023-01-03T11:50:41.038+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.041+00:00][DEBUG][http.server.response] POST /internal/licensing/feature_usage/register 200 62ms - 16.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.042+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.042+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.052+00:00][DEBUG][http.server.response] GET /api/licensing/info 200 70ms
2023-01-03 12:50:41 [2023-01-03T11:50:41.053+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.053+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.058+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.062+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.062+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.086+00:00][DEBUG][http.server.response] GET /internal/security/security_checkup/state 200 95ms - 22.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.088+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 200 96ms - 106.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.103+00:00][DEBUG][http.server.response] GET /internal/security/session 200 113ms - 88.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.118+00:00][DEBUG][http.server.response] GET /api/banners/info 200 135ms - 118.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.128+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:50:41 [2023-01-03T11:50:41.128+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.133+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects_tagging/tags.
2023-01-03 12:50:41 [2023-01-03T11:50:41.133+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.135+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.138+00:00][DEBUG][http.server.response] GET /internal/security/me 200 78ms - 321.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.139+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:50:41 [2023-01-03T11:50:41.139+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.140+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.152+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.152+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.195+00:00][DEBUG][http.server.response] POST /api/saved_objects/_bulk_get 200 91ms - 277.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.197+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:50:41 [2023-01-03T11:50:41.197+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.204+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/spaces/_active_space.
2023-01-03 12:50:41 [2023-01-03T11:50:41.205+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.206+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Collected [0] saved objects
2023-01-03 12:50:41 [2023-01-03T11:50:41.207+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Closing PIT for types [tag]
2023-01-03 12:50:41 [2023-01-03T11:50:41.208+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.211+00:00][DEBUG][http.server.response] GET /internal/security/me 200 61ms - 321.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.212+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.212+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.218+00:00][DEBUG][http.server.response] GET /api/saved_objects_tagging/tags 200 150ms - 11.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.240+00:00][DEBUG][http.server.response] GET /internal/spaces/_active_space 200 82ms - 134.0B
2023-01-03 12:50:41 [2023-01-03T11:50:41.320+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/index_management/indices.
2023-01-03 12:50:41 [2023-01-03T11:50:41.321+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.332+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:41 [2023-01-03T11:50:41.332+00:00][DEBUG][plugins.security.session.y6tizjQBs=] Successfully extended existing session.
2023-01-03 12:50:41 [2023-01-03T11:50:41.345+00:00][DEBUG][elasticsearch.deprecation] Elasticsearch deprecation: 299 Elasticsearch-8.3.2-8b0b1f23fbebecc3c88e4464319dea8989f374fd "this request accesses system indices: [.async-search, .security-7, .tasks, .transform-internal-007], but in a future major version, direct access to system indices will be prevented by default"
2023-01-03 12:50:41 Origin:kibana
2023-01-03 12:50:41 Stack trace:
2023-01-03 12:50:41     at processTicksAndRejections (node:internal/process/task_queues:96:5)
2023-01-03 12:50:41     at KibanaTransport.request (/usr/share/kibana/src/core/server/elasticsearch/client/create_transport.js:58:16)
2023-01-03 12:50:41     at Indices.get (/usr/share/kibana/node_modules/@elastic/elasticsearch/lib/api/api/indices.js:506:16)
2023-01-03 12:50:41     at fetchIndicesCall (/usr/share/kibana/x-pack/plugins/index_management/server/lib/fetch_indices.js:20:19)
2023-01-03 12:50:41     at fetchIndices (/usr/share/kibana/x-pack/plugins/index_management/server/lib/fetch_indices.js:70:19)
2023-01-03 12:50:41     at /usr/share/kibana/x-pack/plugins/index_management/server/routes/api/indices/register_list_route.js:35:23
2023-01-03 12:50:41     at Router.handle (/usr/share/kibana/src/core/server/http/router/router.js:163:30)
2023-01-03 12:50:41     at handler (/usr/share/kibana/src/core/server/http/router/router.js:124:50)
2023-01-03 12:50:41     at exports.Manager.execute (/usr/share/kibana/node_modules/@hapi/hapi/lib/toolkit.js:60:28)
2023-01-03 12:50:41     at Object.internals.handler (/usr/share/kibana/node_modules/@hapi/hapi/lib/handler.js:46:20)
2023-01-03 12:50:41     at exports.execute (/usr/share/kibana/node_modules/@hapi/hapi/lib/handler.js:31:20)
2023-01-03 12:50:41     at Request._lifecycle (/usr/share/kibana/node_modules/@hapi/hapi/lib/request.js:371:32)
2023-01-03 12:50:41     at Request._execute (/usr/share/kibana/node_modules/@hapi/hapi/lib/request.js:281:9)
2023-01-03 12:50:41 Query:
2023-01-03 12:50:41 200 - 5.4KB
2023-01-03 12:50:41 GET /*?expand_wildcards=hidden%2Call&filter_path=*.aliases%2C*.settings.index.number_of_shards%2C*.settings.index.number_of_replicas%2C*.settings.index.frozen%2C*.settings.index.hidden%2C*.data_stream&features=aliases%2Csettings
2023-01-03 12:50:41 [2023-01-03T11:50:41.376+00:00][DEBUG][http.server.response] GET /api/index_management/indices 200 75ms - 13.0KB
2023-01-03 12:50:44 [2023-01-03T11:50:44.847+00:00][DEBUG][plugins.usageCollection.usage-collection.usage-counters-service] Store counters into savedObjects
2023-01-03 12:50:47 [2023-01-03T11:50:47.014+00:00][DEBUG][plugins.securitySolution.endpoint:user-artifact-packager:1.0.0] Last computed manifest not available yet
2023-01-03 12:50:48 [2023-01-03T11:50:48.354+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:48 [2023-01-03T11:50:48.356+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:50:48 [2023-01-03T11:50:48.362+00:00][DEBUG][http.server.response] POST /api/saved_objects/_bulk_get 401 9ms - 66.0B
2023-01-03 12:50:48 [2023-01-03T11:50:48.430+00:00][DEBUG][http.server.response] GET /logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 200 12ms - 84.2KB
2023-01-03 12:50:48 [2023-01-03T11:50:48.459+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:48 [2023-01-03T11:50:48.459+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/es_config.
2023-01-03 12:50:48 [2023-01-03T11:50:48.459+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/console/es_config.
2023-01-03 12:50:48 [2023-01-03T11:50:48.459+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:48 [2023-01-03T11:50:48.460+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:48 [2023-01-03T11:50:48.460+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:50:48 [2023-01-03T11:50:48.463+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:48 [2023-01-03T11:50:48.464+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/api_server.
2023-01-03 12:50:48 [2023-01-03T11:50:48.464+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/console/api_server.
2023-01-03 12:50:48 [2023-01-03T11:50:48.464+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:48 [2023-01-03T11:50:48.464+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:48 [2023-01-03T11:50:48.465+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:50:48 [2023-01-03T11:50:48.478+00:00][DEBUG][http.server.response] GET /api/console/es_config 401 20ms - 66.0B
2023-01-03 12:50:48 [2023-01-03T11:50:48.478+00:00][DEBUG][http.server.response] GET /api/console/api_server 401 16ms - 66.0B
2023-01-03 12:50:48 [2023-01-03T11:50:48.555+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:48 [2023-01-03T11:50:48.555+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:50:48 [2023-01-03T11:50:48.556+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:50:48 [2023-01-03T11:50:48.556+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:48 [2023-01-03T11:50:48.556+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:48 [2023-01-03T11:50:48.561+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 7ms - 4.5KB
2023-01-03 12:50:48 [2023-01-03T11:50:48.567+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 18ms
2023-01-03 12:50:48 [2023-01-03T11:50:48.569+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 17ms
2023-01-03 12:50:49 [2023-01-03T11:50:49.657+00:00][DEBUG][http.server.response] GET /translations/en.json 304 3ms - 29.0B
2023-01-03 12:50:49 [2023-01-03T11:50:49.749+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:49 [2023-01-03T11:50:49.750+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:50:49 [2023-01-03T11:50:49.750+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:50:49 [2023-01-03T11:50:49.750+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:49 [2023-01-03T11:50:49.750+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:49 [2023-01-03T11:50:49.799+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 51ms - 4.6KB
2023-01-03 12:50:49 [2023-01-03T11:50:49.865+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:49 [2023-01-03T11:50:49.865+00:00][DEBUG][plugins.security.basic.basic] Trying to log user out via /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole.
2023-01-03 12:50:49 [2023-01-03T11:50:49.865+00:00][DEBUG][plugins.security.http] Logout is not supported.
2023-01-03 12:50:49 [2023-01-03T11:50:49.867+00:00][DEBUG][http.server.response] GET /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 302 5ms
2023-01-03 12:50:49 [2023-01-03T11:50:49.903+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:49 [2023-01-03T11:50:49.903+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:50:49 [2023-01-03T11:50:49.903+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:50:49 [2023-01-03T11:50:49.903+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:49 [2023-01-03T11:50:49.903+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:49 [2023-01-03T11:50:49.904+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:50:49 [2023-01-03T11:50:49.912+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 401 10ms - 66.0B
2023-01-03 12:50:49 [2023-01-03T11:50:49.923+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:49 [2023-01-03T11:50:49.923+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:50:49 [2023-01-03T11:50:49.923+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:50:49 [2023-01-03T11:50:49.923+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:49 [2023-01-03T11:50:49.923+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:49 [2023-01-03T11:50:49.941+00:00][DEBUG][http.server.response] GET /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR 200 20ms - 84.2KB
2023-01-03 12:50:50 [2023-01-03T11:50:50.012+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:50 [2023-01-03T11:50:50.012+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:50:50 [2023-01-03T11:50:50.012+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:50:50 [2023-01-03T11:50:50.013+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:50 [2023-01-03T11:50:50.013+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:50 [2023-01-03T11:50:50.025+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 15ms - 4.5KB
2023-01-03 12:50:50 [2023-01-03T11:50:50.057+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 5ms
2023-01-03 12:50:50 [2023-01-03T11:50:50.058+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 5ms
2023-01-03 12:50:51 [2023-01-03T11:50:51.155+00:00][DEBUG][http.server.response] GET /translations/en.json 304 3ms - 29.0B
2023-01-03 12:50:51 [2023-01-03T11:50:51.383+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:51 [2023-01-03T11:50:51.383+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:50:51 [2023-01-03T11:50:51.383+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:50:51 [2023-01-03T11:50:51.383+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:51 [2023-01-03T11:50:51.383+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:51 [2023-01-03T11:50:51.444+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 63ms - 4.6KB
2023-01-03 12:50:51 [2023-01-03T11:50:51.578+00:00][DEBUG][http.server.response] GET /internal/security/login_state 200 2ms - 186.0B
2023-01-03 12:50:55 [2023-01-03T11:50:55.419+00:00][DEBUG][elasticsearch.query.monitoring] 200 - 1.3KB
2023-01-03 12:50:55 GET /_xpack
2023-01-03 12:50:57 [2023-01-03T11:50:57.574+00:00][DEBUG][plugins.upgradeAssistant.reindex_worker] Polling for reindex operations
2023-01-03 12:50:57 [2023-01-03T11:50:57.757+00:00][INFO ][plugins.security.routes] Logging in with provider "basic" (basic)
2023-01-03 12:50:57 [2023-01-03T11:50:57.758+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:57 [2023-01-03T11:50:57.758+00:00][DEBUG][plugins.security.basic.basic] Trying to perform a login.
2023-01-03 12:50:57 [2023-01-03T11:50:57.770+00:00][DEBUG][plugins.security.basic.basic] Login has been successfully performed.
2023-01-03 12:50:57 [2023-01-03T11:50:57.771+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Creating a new session.
2023-01-03 12:50:58 [2023-01-03T11:50:58.598+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully created a new session.
2023-01-03 12:50:58 [2023-01-03T11:50:58.598+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:58 [2023-01-03T11:50:58.599+00:00][DEBUG][http.server.response] POST /internal/security/login 200 843ms - 38.0B
2023-01-03 12:50:58 [2023-01-03T11:50:58.628+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /app/dev_tools.
2023-01-03 12:50:58 [2023-01-03T11:50:58.628+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:58 [2023-01-03T11:50:58.632+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:58 [2023-01-03T11:50:58.632+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:50:58 [2023-01-03T11:50:58.633+00:00][DEBUG][plugins.spaces] Verifying access to space "default"
2023-01-03 12:50:58 [2023-01-03T11:50:58.756+00:00][DEBUG][plugins.security.app-authorization] authorizing access to "dev_tools"
2023-01-03 12:50:58 [2023-01-03T11:50:58.756+00:00][DEBUG][plugins.security.app-authorization] authorized for "dev_tools"
2023-01-03 12:50:58 [2023-01-03T11:50:58.792+00:00][DEBUG][http.server.response] GET /app/dev_tools 200 181ms - 150.8KB
2023-01-03 12:50:58 [2023-01-03T11:50:58.863+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 8ms
2023-01-03 12:50:58 [2023-01-03T11:50:58.865+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 8ms
2023-01-03 12:50:58 [2023-01-03T11:50:58.891+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap.js.
2023-01-03 12:50:58 [2023-01-03T11:50:58.892+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:50:58 [2023-01-03T11:50:58.900+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:50:58 [2023-01-03T11:50:58.901+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:50:58 [2023-01-03T11:50:58.923+00:00][DEBUG][http.server.response] GET /bootstrap.js 304 65ms - 19.3KB
2023-01-03 12:51:00 [2023-01-03T11:51:00.263+00:00][DEBUG][http.server.response] GET /translations/en.json 304 5ms - 29.0B
2023-01-03 12:51:00 [2023-01-03T11:51:00.974+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities.
2023-01-03 12:51:00 [2023-01-03T11:51:00.974+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:00 [2023-01-03T11:51:00.980+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:00 [2023-01-03T11:51:00.981+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.015+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:01 [2023-01-03T11:51:01.016+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.030+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.033+00:00][DEBUG][http.server.response] GET /internal/security/me 200 82ms - 321.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.126+00:00][DEBUG][http.server.response] POST /api/core/capabilities 200 207ms - 5.0KB
2023-01-03 12:51:01 [2023-01-03T11:51:01.218+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/licensing/info.
2023-01-03 12:51:01 [2023-01-03T11:51:01.218+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.229+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.234+00:00][DEBUG][http.server.response] GET /api/licensing/info 200 40ms
2023-01-03 12:51:01 [2023-01-03T11:51:01.340+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/licensing/feature_usage/register.
2023-01-03 12:51:01 [2023-01-03T11:51:01.340+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.345+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/banners/info.
2023-01-03 12:51:01 [2023-01-03T11:51:01.345+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.352+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/security_checkup/state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.352+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.354+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.354+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.356+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.357+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.361+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.361+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.373+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.373+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.377+00:00][DEBUG][http.server.response] POST /internal/licensing/feature_usage/register 200 61ms - 16.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.378+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:01 [2023-01-03T11:51:01.378+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.389+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:51:01 [2023-01-03T11:51:01.390+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.395+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.399+00:00][DEBUG][http.server.response] GET /internal/security/security_checkup/state 200 75ms - 22.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.417+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.420+00:00][DEBUG][http.server.response] GET /internal/security/me 200 87ms - 321.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.420+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.421+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.476+00:00][DEBUG][http.server.response] GET /api/banners/info 200 157ms - 118.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.479+00:00][DEBUG][http.server.response] GET /internal/security/session 200 158ms - 88.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.495+00:00][DEBUG][http.server.response] POST /api/saved_objects/_bulk_get 200 160ms - 277.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.521+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:01 [2023-01-03T11:51:01.521+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.522+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects_tagging/tags.
2023-01-03 12:51:01 [2023-01-03T11:51:01.523+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.539+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.541+00:00][DEBUG][http.server.response] GET /internal/security/me 200 82ms - 321.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.542+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/spaces/_active_space.
2023-01-03 12:51:01 [2023-01-03T11:51:01.542+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.546+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.559+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:51:01 [2023-01-03T11:51:01.559+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.561+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.562+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.577+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.578+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.598+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 200 144ms - 106.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.624+00:00][DEBUG][http.server.response] GET /internal/spaces/_active_space 200 142ms - 134.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.628+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Collected [0] saved objects
2023-01-03 12:51:01 [2023-01-03T11:51:01.628+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Closing PIT for types [tag]
2023-01-03 12:51:01 [2023-01-03T11:51:01.654+00:00][DEBUG][http.server.response] GET /api/saved_objects_tagging/tags 200 202ms - 11.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.679+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/api_server.
2023-01-03 12:51:01 [2023-01-03T11:51:01.679+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.688+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.688+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.702+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/es_config.
2023-01-03 12:51:01 [2023-01-03T11:51:01.703+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.712+00:00][DEBUG][http.server.response] GET /api/console/api_server 200 57ms - 226.1KB
2023-01-03 12:51:01 [2023-01-03T11:51:01.716+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.716+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:01 [2023-01-03T11:51:01.723+00:00][DEBUG][http.server.response] GET /api/console/es_config 200 59ms - 45.0B
2023-01-03 12:51:01 [2023-01-03T11:51:01.786+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true.
2023-01-03 12:51:01 [2023-01-03T11:51:01.786+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.792+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:01 [2023-01-03T11:51:01.793+00:00][DEBUG][plugins.security.session.oYOd5q+uI=] Successfully extended existing session.
2023-01-03 12:51:02 [2023-01-03T11:51:02.025+00:00][DEBUG][http.server.response] GET /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true 200 266ms - 456.6KB
2023-01-03 12:51:05 [2023-01-03T11:51:05.305+00:00][DEBUG][plugins.usageCollection.usage-collection.usage-counters-service] Store counters into savedObjects
2023-01-03 12:51:09 [2023-01-03T11:51:09.542+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:09 [2023-01-03T11:51:09.542+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:51:09 [2023-01-03T11:51:09.543+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:51:09 [2023-01-03T11:51:09.543+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:09 [2023-01-03T11:51:09.543+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:09 [2023-01-03T11:51:09.543+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:51:09 [2023-01-03T11:51:09.554+00:00][DEBUG][http.server.response] GET /internal/security/session 401 13ms - 66.0B
2023-01-03 12:51:09 [2023-01-03T11:51:09.619+00:00][DEBUG][http.server.response] GET /logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 200 8ms - 84.2KB
2023-01-03 12:51:09 [2023-01-03T11:51:09.679+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:09 [2023-01-03T11:51:09.680+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:51:09 [2023-01-03T11:51:09.680+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:51:09 [2023-01-03T11:51:09.680+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:09 [2023-01-03T11:51:09.680+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:09 [2023-01-03T11:51:09.684+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 6ms - 4.5KB
2023-01-03 12:51:09 [2023-01-03T11:51:09.686+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 10ms
2023-01-03 12:51:09 [2023-01-03T11:51:09.724+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 3ms
2023-01-03 12:51:10 [2023-01-03T11:51:10.762+00:00][DEBUG][http.server.response] GET /translations/en.json 304 3ms - 29.0B
2023-01-03 12:51:10 [2023-01-03T11:51:10.993+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:10 [2023-01-03T11:51:10.994+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:51:10 [2023-01-03T11:51:10.994+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:51:10 [2023-01-03T11:51:10.994+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:10 [2023-01-03T11:51:10.994+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:11 [2023-01-03T11:51:11.069+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 77ms - 4.6KB
2023-01-03 12:51:11 [2023-01-03T11:51:11.159+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:11 [2023-01-03T11:51:11.159+00:00][DEBUG][plugins.security.basic.basic] Trying to log user out via /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole.
2023-01-03 12:51:11 [2023-01-03T11:51:11.160+00:00][DEBUG][plugins.security.http] Logout is not supported.
2023-01-03 12:51:11 [2023-01-03T11:51:11.163+00:00][DEBUG][http.server.response] GET /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 302 11ms
2023-01-03 12:51:11 [2023-01-03T11:51:11.174+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:11 [2023-01-03T11:51:11.174+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:51:11 [2023-01-03T11:51:11.174+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:51:11 [2023-01-03T11:51:11.174+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:11 [2023-01-03T11:51:11.175+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:11 [2023-01-03T11:51:11.207+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:11 [2023-01-03T11:51:11.207+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:51:11 [2023-01-03T11:51:11.207+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:51:11 [2023-01-03T11:51:11.207+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:11 [2023-01-03T11:51:11.208+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:11 [2023-01-03T11:51:11.209+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:51:11 [2023-01-03T11:51:11.211+00:00][DEBUG][http.server.response] GET /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR 200 39ms - 84.2KB
2023-01-03 12:51:11 [2023-01-03T11:51:11.247+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 401 45ms - 66.0B
2023-01-03 12:51:11 [2023-01-03T11:51:11.301+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 4ms
2023-01-03 12:51:11 [2023-01-03T11:51:11.303+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:11 [2023-01-03T11:51:11.304+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:51:11 [2023-01-03T11:51:11.304+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:51:11 [2023-01-03T11:51:11.304+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:11 [2023-01-03T11:51:11.304+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:11 [2023-01-03T11:51:11.311+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 9ms - 4.5KB
2023-01-03 12:51:11 [2023-01-03T11:51:11.345+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 4ms
2023-01-03 12:51:12 [2023-01-03T11:51:12.516+00:00][DEBUG][http.server.response] GET /translations/en.json 304 4ms - 29.0B
2023-01-03 12:51:12 [2023-01-03T11:51:12.745+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:12 [2023-01-03T11:51:12.745+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:51:12 [2023-01-03T11:51:12.745+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:51:12 [2023-01-03T11:51:12.745+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:51:12 [2023-01-03T11:51:12.745+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:51:12 [2023-01-03T11:51:12.829+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 86ms - 4.6KB
2023-01-03 12:51:12 [2023-01-03T11:51:12.909+00:00][DEBUG][http.server.response] GET /internal/security/login_state 200 4ms - 186.0B
2023-01-03 12:51:18 [2023-01-03T11:51:18.223+00:00][INFO ][plugins.security.routes] Logging in with provider "basic" (basic)
2023-01-03 12:51:18 [2023-01-03T11:51:18.223+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:18 [2023-01-03T11:51:18.223+00:00][DEBUG][plugins.security.basic.basic] Trying to perform a login.
2023-01-03 12:51:18 [2023-01-03T11:51:18.227+00:00][DEBUG][plugins.security.basic.basic] Login has been successfully performed.
2023-01-03 12:51:18 [2023-01-03T11:51:18.227+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Creating a new session.
2023-01-03 12:51:19 [2023-01-03T11:51:19.002+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully created a new session.
2023-01-03 12:51:19 [2023-01-03T11:51:19.002+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:51:19 [2023-01-03T11:51:19.003+00:00][DEBUG][http.server.response] POST /internal/security/login 200 782ms - 38.0B
2023-01-03 12:51:19 [2023-01-03T11:51:19.036+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /app/dev_tools.
2023-01-03 12:51:19 [2023-01-03T11:51:19.036+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:19 [2023-01-03T11:51:19.041+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:19 [2023-01-03T11:51:19.042+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:19 [2023-01-03T11:51:19.042+00:00][DEBUG][plugins.spaces] Verifying access to space "default"
2023-01-03 12:51:19 [2023-01-03T11:51:19.065+00:00][DEBUG][plugins.security.app-authorization] authorizing access to "dev_tools"
2023-01-03 12:51:19 [2023-01-03T11:51:19.065+00:00][DEBUG][plugins.security.app-authorization] authorized for "dev_tools"
2023-01-03 12:51:19 [2023-01-03T11:51:19.107+00:00][DEBUG][http.server.response] GET /app/dev_tools 200 90ms - 150.8KB
2023-01-03 12:51:19 [2023-01-03T11:51:19.178+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 9ms
2023-01-03 12:51:19 [2023-01-03T11:51:19.181+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 9ms
2023-01-03 12:51:19 [2023-01-03T11:51:19.194+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap.js.
2023-01-03 12:51:19 [2023-01-03T11:51:19.195+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:19 [2023-01-03T11:51:19.200+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:19 [2023-01-03T11:51:19.201+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:19 [2023-01-03T11:51:19.221+00:00][DEBUG][http.server.response] GET /bootstrap.js 304 49ms - 19.3KB
2023-01-03 12:51:20 [2023-01-03T11:51:20.655+00:00][DEBUG][http.server.response] GET /translations/en.json 304 4ms - 29.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.230+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities.
2023-01-03 12:51:21 [2023-01-03T11:51:21.231+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.266+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.267+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.303+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:21 [2023-01-03T11:51:21.304+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.318+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.327+00:00][DEBUG][http.server.response] GET /internal/security/me 200 81ms - 321.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.459+00:00][DEBUG][http.server.response] POST /api/core/capabilities 200 256ms - 5.0KB
2023-01-03 12:51:21 [2023-01-03T11:51:21.511+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/licensing/info.
2023-01-03 12:51:21 [2023-01-03T11:51:21.511+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.515+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.519+00:00][DEBUG][http.server.response] GET /api/licensing/info 200 26ms
2023-01-03 12:51:21 [2023-01-03T11:51:21.661+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/licensing/feature_usage/register.
2023-01-03 12:51:21 [2023-01-03T11:51:21.662+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.665+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/banners/info.
2023-01-03 12:51:21 [2023-01-03T11:51:21.666+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.670+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.671+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.672+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/security_checkup/state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.673+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.674+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.675+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.683+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.684+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.690+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:21 [2023-01-03T11:51:21.690+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.692+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects_tagging/tags.
2023-01-03 12:51:21 [2023-01-03T11:51:21.693+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.706+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.717+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.718+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.733+00:00][DEBUG][http.server.response] POST /internal/licensing/feature_usage/register 200 102ms - 16.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.738+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.741+00:00][DEBUG][http.server.response] GET /internal/security/me 200 95ms - 321.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.749+00:00][DEBUG][http.server.response] GET /internal/security/security_checkup/state 200 109ms - 22.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.762+00:00][DEBUG][http.server.response] GET /api/banners/info 200 128ms - 118.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.769+00:00][DEBUG][http.server.response] GET /internal/security/session 200 131ms - 88.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.774+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.799+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:51:21 [2023-01-03T11:51:21.799+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.801+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/me.
2023-01-03 12:51:21 [2023-01-03T11:51:21.801+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.806+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.807+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.814+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.818+00:00][DEBUG][http.server.response] GET /internal/security/me 200 58ms - 321.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.823+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/spaces/_active_space.
2023-01-03 12:51:21 [2023-01-03T11:51:21.823+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.826+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:51:21 [2023-01-03T11:51:21.826+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.829+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 200 71ms - 106.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.833+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Collected [0] saved objects
2023-01-03 12:51:21 [2023-01-03T11:51:21.833+00:00][DEBUG][savedobjects-service.repository.point-in-time-finder] Closing PIT for types [tag]
2023-01-03 12:51:21 [2023-01-03T11:51:21.835+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.836+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.847+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.848+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.853+00:00][DEBUG][http.server.response] GET /api/saved_objects_tagging/tags 200 201ms - 11.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.874+00:00][DEBUG][http.server.response] GET /internal/spaces/_active_space 200 94ms - 134.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.884+00:00][DEBUG][http.server.response] POST /api/saved_objects/_bulk_get 200 100ms - 277.0B
2023-01-03 12:51:21 [2023-01-03T11:51:21.917+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/api_server.
2023-01-03 12:51:21 [2023-01-03T11:51:21.917+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.925+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:21 [2023-01-03T11:51:21.925+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:21 [2023-01-03T11:51:21.955+00:00][DEBUG][http.server.response] GET /api/console/api_server 200 66ms - 226.1KB
2023-01-03 12:51:22 [2023-01-03T11:51:22.005+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/es_config.
2023-01-03 12:51:22 [2023-01-03T11:51:22.005+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:22 [2023-01-03T11:51:22.011+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:22 [2023-01-03T11:51:22.011+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:22 [2023-01-03T11:51:22.030+00:00][DEBUG][http.server.response] GET /api/console/es_config 200 58ms - 45.0B
2023-01-03 12:51:22 [2023-01-03T11:51:22.117+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true.
2023-01-03 12:51:22 [2023-01-03T11:51:22.117+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:22 [2023-01-03T11:51:22.126+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:22 [2023-01-03T11:51:22.127+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:22 [2023-01-03T11:51:22.583+00:00][DEBUG][http.server.response] GET /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true 200 484ms - 456.6KB
2023-01-03 12:51:24 [2023-01-03T11:51:24.806+00:00][DEBUG][plugins.usageCollection.usage-collection.usage-counters-service] Store counters into savedObjects
2023-01-03 12:51:25 [2023-01-03T11:51:25.160+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/session.
2023-01-03 12:51:25 [2023-01-03T11:51:25.160+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:25 [2023-01-03T11:51:25.165+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:25 [2023-01-03T11:51:25.166+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:25 [2023-01-03T11:51:25.182+00:00][DEBUG][http.server.response] GET /internal/security/session 200 48ms - 88.0B
2023-01-03 12:51:25 [2023-01-03T11:51:25.227+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true.
2023-01-03 12:51:25 [2023-01-03T11:51:25.227+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate via state.
2023-01-03 12:51:25 [2023-01-03T11:51:25.234+00:00][DEBUG][plugins.security.basic.basic] Request has been authenticated via state.
2023-01-03 12:51:25 [2023-01-03T11:51:25.234+00:00][DEBUG][plugins.security.session.1XVpMSRAA=] Successfully extended existing session.
2023-01-03 12:51:25 [2023-01-03T11:51:25.379+00:00][DEBUG][http.server.response] GET /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true 200 174ms - 456.6KB
2023-01-03 12:51:25 [2023-01-03T11:51:25.420+00:00][DEBUG][elasticsearch.query.monitoring] 200 - 1.3KB
2023-01-03 12:51:25 GET /_xpack
2023-01-03 12:51:27 [2023-01-03T11:51:27.580+00:00][DEBUG][plugins.upgradeAssistant.reindex_worker] Polling for reindex operations
2023-01-03 12:51:50 [2023-01-03T11:51:50.018+00:00][DEBUG][plugins.securitySolution.endpoint:user-artifact-packager:1.0.0] Last computed manifest not available yet
2023-01-03 12:51:55 [2023-01-03T11:51:55.420+00:00][DEBUG][elasticsearch.query.monitoring] 200 - 1.3KB
2023-01-03 12:51:55 GET /_xpack
2023-01-03 12:51:57 [2023-01-03T11:51:57.586+00:00][DEBUG][plugins.upgradeAssistant.reindex_worker] Polling for reindex operations
2023-01-03 12:52:11 [2023-01-03T11:52:11.144+00:00][DEBUG][plugins.securitySolution.telemetry_events] [task security:endpoint-diagnostics:1.0.0]: attempting to run
2023-01-03 12:52:11 [2023-01-03T11:52:11.145+00:00][DEBUG][plugins.securitySolution.telemetry_events] [task security:endpoint-diagnostics:1.0.0]: telemetry is not opted-in
2023-01-03 12:52:11 [2023-01-03T11:52:11.152+00:00][DEBUG][plugins.alerting] Total invalidated API keys "0"
2023-01-03 12:52:25 [2023-01-03T11:52:25.407+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:25 [2023-01-03T11:52:25.408+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true.
2023-01-03 12:52:25 [2023-01-03T11:52:25.408+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true.
2023-01-03 12:52:25 [2023-01-03T11:52:25.408+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:25 [2023-01-03T11:52:25.409+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:25 [2023-01-03T11:52:25.409+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:52:25 [2023-01-03T11:52:25.415+00:00][DEBUG][http.server.response] GET /api/console/autocomplete_entities?fields=true&indices=true&templates=true&dataStreams=true 401 9ms - 66.0B
2023-01-03 12:52:25 [2023-01-03T11:52:25.432+00:00][DEBUG][elasticsearch.query.monitoring] 200 - 1.3KB
2023-01-03 12:52:25 GET /_xpack
2023-01-03 12:52:25 [2023-01-03T11:52:25.450+00:00][DEBUG][http.server.response] GET /logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 200 17ms - 84.2KB
2023-01-03 12:52:25 [2023-01-03T11:52:25.515+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:25 [2023-01-03T11:52:25.516+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:52:25 [2023-01-03T11:52:25.516+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:52:25 [2023-01-03T11:52:25.516+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:25 [2023-01-03T11:52:25.516+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:25 [2023-01-03T11:52:25.520+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 6ms - 4.5KB
2023-01-03 12:52:25 [2023-01-03T11:52:25.522+00:00][DEBUG][http.server.response] GET /ui/legacy_light_theme.css 304 11ms
2023-01-03 12:52:25 [2023-01-03T11:52:25.552+00:00][DEBUG][http.server.response] GET /node_modules/@kbn/ui-framework/dist/kui_light.css 304 2ms
2023-01-03 12:52:26 [2023-01-03T11:52:26.444+00:00][DEBUG][http.server.response] GET /translations/en.json 304 3ms - 29.0B
2023-01-03 12:52:26 [2023-01-03T11:52:26.583+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:26 [2023-01-03T11:52:26.583+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:52:26 [2023-01-03T11:52:26.584+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:52:26 [2023-01-03T11:52:26.584+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:26 [2023-01-03T11:52:26.584+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:26 [2023-01-03T11:52:26.637+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 56ms - 4.6KB
2023-01-03 12:52:26 [2023-01-03T11:52:26.697+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:26 [2023-01-03T11:52:26.697+00:00][DEBUG][plugins.security.basic.basic] Trying to log user out via /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole.
2023-01-03 12:52:26 [2023-01-03T11:52:26.698+00:00][DEBUG][plugins.security.http] Logout is not supported.
2023-01-03 12:52:26 [2023-01-03T11:52:26.699+00:00][DEBUG][http.server.response] GET /api/security/logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 302 5ms
2023-01-03 12:52:26 [2023-01-03T11:52:26.707+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:26 [2023-01-03T11:52:26.708+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:52:26 [2023-01-03T11:52:26.708+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR.
2023-01-03 12:52:26 [2023-01-03T11:52:26.708+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:26 [2023-01-03T11:52:26.708+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:26 [2023-01-03T11:52:26.720+00:00][DEBUG][http.server.response] GET /login?next=%2Fapp%2Fdev_tools%23%2Fconsole&msg=AUTHENTICATION_ERROR 200 14ms - 84.2KB
2023-01-03 12:52:26 [2023-01-03T11:52:26.726+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:26 [2023-01-03T11:52:26.727+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:52:26 [2023-01-03T11:52:26.727+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /internal/security/analytics/_record_auth_type.
2023-01-03 12:52:26 [2023-01-03T11:52:26.727+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:26 [2023-01-03T11:52:26.727+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:26 [2023-01-03T11:52:26.728+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:52:26 [2023-01-03T11:52:26.739+00:00][DEBUG][http.server.response] POST /internal/security/analytics/_record_auth_type 401 14ms - 66.0B
2023-01-03 12:52:26 [2023-01-03T11:52:26.812+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:26 [2023-01-03T11:52:26.812+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:52:26 [2023-01-03T11:52:26.812+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /bootstrap-anonymous.js.
2023-01-03 12:52:26 [2023-01-03T11:52:26.812+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:26 [2023-01-03T11:52:26.812+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:26 [2023-01-03T11:52:26.815+00:00][DEBUG][http.server.response] GET /bootstrap-anonymous.js 304 5ms - 4.5KB
2023-01-03 12:52:27 [2023-01-03T11:52:27.593+00:00][DEBUG][plugins.upgradeAssistant.reindex_worker] Polling for reindex operations
2023-01-03 12:52:27 [2023-01-03T11:52:27.682+00:00][DEBUG][http.server.response] GET /translations/en.json 304 4ms - 29.0B
2023-01-03 12:52:28 [2023-01-03T11:52:28.055+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:52:28 [2023-01-03T11:52:28.055+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:52:28 [2023-01-03T11:52:28.056+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/core/capabilities?useDefaultCapabilities=true.
2023-01-03 12:52:28 [2023-01-03T11:52:28.056+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:52:28 [2023-01-03T11:52:28.056+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:52:28 [2023-01-03T11:52:28.157+00:00][DEBUG][http.server.response] POST /api/core/capabilities?useDefaultCapabilities=true 200 101ms - 4.6KB
2023-01-03 12:52:28 [2023-01-03T11:52:28.283+00:00][DEBUG][http.server.response] GET /internal/security/login_state 200 5ms - 186.0B
2023-01-03 12:52:53 [2023-01-03T11:52:53.067+00:00][DEBUG][plugins.securitySolution.endpoint:user-artifact-packager:1.0.0] Last computed manifest not available yet

I tried to filter out noisy logs, tell me if this config is filtering out what you need:

logging.root.level: debug
logging.loggers:
  - name: plugins.taskManager
    level: info
  - name: elasticsearch.query.data
    level: info
  - name: execution_context
    level: info
  - name: plugins.monitoring.monitoring.kibana-monitoring
    level: info
  - name: plugins.fleet.telemetry_events
    level: info
  - name: metrics.ops
    level: info
  - name: plugins.data.data
    level: info
  - name: plugins.security.basic.basic
    level: debug

What's the response of GET kbn:/internal/security/session in your dev tools after logging in?
{
"expiresInMs": 28796947,
"canBeExtended": true,
"provider": {
"type": "basic",
"name": "basic"
}
}

thomheymann commented 1 year ago

2023-01-03 12:50:48 [2023-01-03T11:50:48.354+00:00][DEBUG][http.server.Kibana.cookie-session-storage] Error: Unauthorized
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.basic.basic] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.http] Trying to authenticate user request to /api/saved_objects/_bulk_get.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.http] Authorization header is not presented.
2023-01-03 12:50:48 [2023-01-03T11:50:48.355+00:00][DEBUG][plugins.security.authentication] Could not handle authentication attempt
2023-01-03 12:50:48 [2023-01-03T11:50:48.356+00:00][DEBUG][plugins.licensing] Requesting Elasticsearch licensing API
2023-01-03 12:50:48 [2023-01-03T11:50:48.362+00:00][DEBUG][http.server.response] POST /api/saved_objects/_bulk_get 401 9ms - 66.0B
2023-01-03 12:50:48 [2023-01-03T11:50:48.430+00:00][DEBUG][http.server.response] GET /logout?msg=AUTHENTICATION_ERROR&next=%2Fapp%2Fdev_tools%23%2Fconsole 200 12ms - 84.2KB

@MeikelLP In the log above you can see that Kibana in trying to authenticate /api/saved_objects/_bulk_get using basic auth provider but is failing to do so for some reason. Possible causes for this are that Kibana couldn't decrypt the cookie or no cookie was sent with the request.

The HAR file you provided doesn't tell us what cookie header was sent.

Can you capture one during the login process and the subsequent request?

MeikelLP commented 1 year ago

I tried to reproduce this issue in Firefox and it doesn't happen there while I was very frequently kicked out in Edge in the mean time.

I'm sorry but I cannot post the .har file. About 10 seconds of requests result in 42mb of data and I tried to upload it at pastebin (to set an expiry date) but got declined... It may contain sensitive data and I don't wanna strip 42mb (40k+ lines) file manually...

From what I understand it's required for you to see all requests to see where it starts to go wrong. Is there any other way I can provide you with this file (privately?). Maybe an email address or something.

thomheymann commented 1 year ago

@MeikelLP You can upload the HAR file here: [link expired]

Since this recording will include the login endpoint, please open the HAR file in a text editor after recording, and replace your credentials with dummy text.

MeikelLP commented 1 year ago

Done

thomheymann commented 1 year ago

@MeikelLP Looking at your HAR file you seem to have another application (ASP based) running on localhost which exceed the maximum cookie size of 4096 bytes:

This causes the browser to truncate the Cookie header meaning Kibana authentication headers are never sent to Kibana, hence returning 401. Cookies for a given host are shared across all the ports on that host.

To quickly resolve this issue you can bind either Kibana or your ASP application to different hostnames.

Ideally you should fix the ASP application though since the cookie size should never exceed 4096 bytes.

I am closing the issue since this is not a bug in Kibana.

MeikelLP commented 1 year ago

@thomheymann Thank you for explaining. Yes I'm a ASP dev and they run on localhost as well. Sorry for the trouble. I hope this will still help some people in the future :)

elastic / kibana

An unexpected authentication error occurred. Please log in again. #147122