title: Web app authentication and securing a separate web API (elasticsearch and kibana)
body: <p>I have developed a web app that does its own user authentication and session management. I keep some data in <a href="http://www.elasticsearch.org/" rel="nofollow">Elasticsearch</a> and now want to access it with <a href="http://www.elasticsearch.org/overview/kibana/" rel="nofollow">Kibana</a>.</p>
  
  <p>Elasticsearch offers a RESTful web API without any authentication and Kibana is a purely browser side Javascript application that accesses Elasticsearch by direct AJAX calls. That is, there is no "Kibana server", just static HTML and Javascript.</p>
  
  <p>My question is: How do I best implement common user sign on between the existing web app and Elasticsearch?</p>
  
  <p>I am interested in specific Elasticsearch/Kibana solutions, but also in generic designs for single sign on to web apps and the external web APIs they use.</p>
  
  <p>It seems the recommended way to secure Elasticsearch/Kibana is to have an Apache or Nginx reverse proxy in front that does SSL termination and user authentication (Basic auth). However, this doesn't play too well with the HTML form user authentication in my existing web app. Ideally I would like the user to sign on using the web app, and then be allowed direct access to the Elasticsearch API as well.</p>
  
  <p>Solutions I've thought of so far:</p>
  
  <ol>
  <li>Proxy everything in the web app: Have all calls go to the web app (server) which does the authentication, and have the web app issue the same request to the Elasticsearch web API and forward the response back to the browser.</li>
  <li>Have the web app (server) store session info that Apache or Nginx somehow can look up and use to authorize access to the reverse proxy.</li>
  <li>Ditch web app sign on and use basic auth for everything.</li>
  </ol>
  
  <p>Note that this is a single installation, so I don't really need any federated SSO solutions.</p>
  
  <p>My feeling is that the proxy within web app (#1) is a common generic solution, but it seems a bit heavyweight to have everything pass through the possibly slow web app, considering that Kibana uses the Elasticsearch API directly.</p>
  
  <p>I haven't found an out of the box solution designed for the proxy authentication setup (#2). My idea is to have the web app store session info in memcache or the like and use some facility in the web server (Apache or Nginx) to look up the session based on a cookie and allow proxy access if authenticated.</p>
  
  <p>The issue seems similar to serving static files directly using the web server (Apache or Nginx) while authenticating using a slow web app. Recommendations I've found for that are however very specific to that issue, like X-Sendfile.</p>