Login to Kibana fails over Nginx with affinity disabled

ihjaz Mohamed

unread,

Jul 31, 2018, 10:20:54 AM7/31/18

to Search Guard Community Forum

When asking questions, please provide the following information:

* Search Guard and Elasticsearch version

SearchGuard 6 - 6.2.2-21

Search-guard-kibana-plugin-6.2.2-10

Elasticsearch & Kibana - 6.2.2

* Installed and used enterprise modules, if any

none

* JVM version and operating system version

OpenJDK Runtime Environment (build 1.8.0_161-b14)

OpenJDK 64-Bit Server VM (build 25.161-b14, mixed mode)

Red Hat Enterprise Linux Server release 7.4 (Maipo)

* Search Guard configuration files

* Elasticsearch log messages on debug level

* Other installed Elasticsearch or Kibana plugins, if any

Hi,

I have multiple Kibana instances with Kibana Searchguard plugin load balanced over Nginx.
I get the following error when I try to login to Kibana from the Searchguard login page.

Error: Uncaught TypeError: Super expression must either be null or a function, not undefined (https://elite10dot80c.elite35.lab/app/kibana/bundles/vendors.bundle.js?v=16588:89)
    at window.onerror (https://elite10dot80c.elite35.lab/app/kibana/bundles/commons.bundle.js?v=16588:1:506240)

If I enable session affinity on the Nginx then I don't see this issue but I need to keep the session affinity disabled on the Nginx for my solution.

Also I see this only on one of the cluster in my lab while other clusters with the same solution do not have this issue.

So does Kibana Searchguard plugin require affinity or stickiness to be enabled on the load balancer? Or is there anything else I'm missing here as this issue is not seen on other clusters with affinity disabled?

ihjaz Mohamed

unread,

Aug 1, 2018, 4:31:11 AM8/1/18

to Search Guard Community Forum

Hi,

I've found some difference between the working setup and the setup that is throwing this error.

│        192.168.10.39 ──https─► 192.168.10.80                 
├──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
│POST /app/kibana/api/v1/auth/login HTTP/1.1                                                                       
│Host: host10dot80c.server35.lab                                                                                   
│User-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 
│Accept: application/json, text/plain, */*                                                                        
│Accept-Language: en-US,en;q=0.9                                                                                              
│Accept-Encoding: gzip, deflate, br                                                                                           
│Connection: keep-alive                                                                                                       
│Origin: https://host10dot80c.server35.lab                                                                                    
│Content-Type: application/json;charset=UTF-8                                                                                 
│Content-Length: 50                                                                                                           
│                                                                                                                             
│{                                                                                                                            
│  "password" : "Password1",                                                                                                  
│  "username" : "kibanaadmin"                                                                                                 
│}

Shown above is the login request from the setup where I'm facing this issue and as you can see that there is no cookie field.

Login request shown below is from the working setup and it has a cookie field.

│        192.168.10.39 ──https─► 192.168.10.51

├─────────────────────────────────────────────────────────────────────────────────────────────────────

│POST /app/kibana/api/v1/auth/login HTTP/1.1

│Host: host10dot51c.server36.lab

│User-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

│

│Accept: application/json, text/plain, */*

│Accept-Language: en-US,en;q=0.9

│Accept-Encoding: gzip, deflate, br

│Cookie: JSESSIONID=0000ApvHwDtXcCbc2O0KUhKo_8H:-1

│Connection: keep-alive

│Origin: https://host10dot51c.server36.lab

│Content-Type: application/json;charset=UTF-8

│Content-Length: 50

│

│{

│ "password" : "Password1",

│ "username" : "kibanaadmin"

│}

Is the missing cookie resulting in this Error? Also why is the Cookie field missing on that particular setup?

Jochen Kressin

unread,

Aug 1, 2018, 8:58:44 AM8/1/18

to Search Guard Community Forum

Super expression must either be null or a function, not undefined

This is the first time I see this error. It comes from:

commons.bundle.js

which is the webpack optimized Kibana bundle. That makes it very hard to track where the issue is really coming from. Is this the complete output in the Kibana logs?

Error: Uncaught TypeError: Super expression must either be null or a function, not undefined (https://elite10dot80c.elite35.lab/app/kibana/bundles/vendors.bundle.js?v=16588:89)
    at window.onerror (https://elite10dot80c.elite35.lab/app/kibana/bundles/commons.bundle.js?v=16588:1:506240)

Regarding session stickiness: No, that should not matter. The credentials are stored in an encrypted cookie. Kibana itself or our plugin do not hold any state.

But - the cookie you are seeing:

Cookie: JSESSIONID=0000ApvHwDtXcCbc2O0KUhKo_8H:-1

has nothing to do with Search Guard or Kibana. The Search Guard cookies all start with "searchguard_". So at the moment I am bit of a loss where this error actually comes from.

If the cookie would be missing the effect would be that you are constanly redirected to the login page, which is not the case here.

On Wednesday, August 1, 2018 at 10:31:11 AM UTC+2, ihjaz Mohamed wrote:

Hi,

I've found some difference between the working setup and the setup that is throwing this error.

│ 192.168.10.39 ──https─► 192.168.10.80 ├────────────────────────────────────────────────────────────────────────────────────────────────────────────────── │POST /app/kibana/api/v1/auth/login HTTP/1.1 │Host: host10dot80c.server35.lab │User-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 │Accept: application/json, text/plain, */* │Accept-Language: en-US,en;q=0.9 │Accept-Encoding: gzip, deflate, br │Connection: keep-alive │Origin: https://host10dot80c.server35.lab │Content-Type: application/json;charset=UTF-8 │Content-Length: 50 │ │{ │ "password" : "Password1", │ "username" : "kibanaadmin" │}

Shown above is the login request from the setup where I'm facing this issue and as you can see that there is no cookie field. For 6.2.2-10 (which is quite old BTW, current version would be 13) we write cookies for multi tenancy and for Basic Auth. So maybe the root cause is that nginx does not handle cookies correctly?

ihjaz Mohamed

unread,

Aug 1, 2018, 9:29:32 AM8/1/18

to Search Guard Community Forum

Hi,

I either get the "Super expression must either be null or a function, not undefined." error or the below error:

Uncaught TypeError: Cannot read property 'call' of undefined (https://host10dot80c.server35.lab/app/kibana/bundles/vendors.bundle.js?v=16588:1)
Version: 6.2.2
Build: 16588

Error: Uncaught TypeError: Cannot read property 'call' of undefined (https://host10dot80c.server35.lab/app/kibana/bundles/vendors.bundle.js?v=16588:1)
 at window.onerror (https://host10dot80c.server35.lab/app/kibana/bundles/commons.bundle.js?v=16588:1:506238)

Below is the complete log from Chrome's console for the error:


 Uncaught TypeError: Cannot read property 'call' of undefined

at __webpack_require__ (vendors.bundle.js?v=16588:1)

at Object.1496 (searchguard-login.bundle.js?v=16588:1)

at __webpack_require__ (vendors.bundle.js?v=16588:1)

at Object.1468 (searchguard-login.bundle.js?v=16588:1)

at __webpack_require__ (vendors.bundle.js?v=16588:1)

at Object.1164 (searchguard-login.bundle.js?v=16588:1)

at __webpack_require__ (vendors.bundle.js?v=16588:1)

at window.webpackJsonp (vendors.bundle.js?v=16588:1)

at searchguard-login.bundle.js?v=16588:1

__webpack_require__ @ vendors.bundle.js?v=16588:1

1496 @ searchguard-login.bundle.js?v=16588:1

__webpack_require__ @ vendors.bundle.js?v=16588:1

1468 @ searchguard-login.bundle.js?v=16588:1

__webpack_require__ @ vendors.bundle.js?v=16588:1

1164 @ searchguard-login.bundle.js?v=16588:1

__webpack_require__ @ vendors.bundle.js?v=16588:1

window.webpackJsonp @ vendors.bundle.js?v=16588:1

(anonymous) @ searchguard-login.bundle.js?v=16588:1

Any idea when you would see the above error?

Again I don't see this error if enable affinity or remove other kibana instances and keep only one instance behind the nginx load balancer.

Jochen Kressin

unread,

Aug 1, 2018, 10:35:17 AM8/1/18

to Search Guard Community Forum

Weird. I guess we need to investigate this. At the moment I don't have a solution for this. Let me take that to the dev team.

ihjaz Mohamed

unread,

Aug 3, 2018, 6:52:10 AM8/3/18

to Search Guard Community Forum

Hi,

Were you able to get any information on this error from the dev team?

Jochen Kressin

unread,

Aug 3, 2018, 8:26:25 AM8/3/18

to Search Guard Community Forum

No, unfortunately not yet, still investigating

ihjaz Mohamed

unread,

Sep 5, 2018, 2:59:07 AM9/5/18

to Search Guard Community Forum

Hi,

Any update on this issue? Were you able to reproduce this?

ihjaz Mohamed

unread,

Sep 27, 2018, 3:10:18 AM9/27/18

to Search Guard Community Forum

Hi,

Any progress on this issue?

ihjaz Mohamed

unread,

Feb 21, 2019, 12:42:47 AM2/21/19

to Search Guard Community Forum

Hi,

Has there been any investigation on this?

Mike

unread,

Mar 6, 2019, 3:30:44 PM3/6/19

to Search Guard Community Forum

Hi there,

Is there any way you can click on the error message in the browser console and have the corresponding code line opened up?

It would be useful to see exactly what is undefined and the stack trace up until then.

Do you see the same error if you don't have SearchGuard installed?

I'm really just guessing here, but it almost sounds like if something went wrong in Kibana's optimize step where those bundles are built...

Regards

Mike

ihjaz Mohamed

unread,

Apr 4, 2019, 9:45:39 AM4/4/19

to Search Guard Community Forum

Hi,

This is the screenshot from before. I've not been able to reproduce this issue after that.

SG

unread,

Apr 4, 2019, 9:49:07 AM4/4/19

to search...@googlegroups.com

Search Guard Community Forum - We are moving!
We are moving the Search Guard Community Forum to a new home:
https://forum.search-guard.com/
All content hosted has been migrated to the new forum.
Starting from 2019/03/30 please ask your questions on https://forum.search-guard.com/ only.
The Google Group forum will not be maintained anymore.

Thanks!

> Am 04.04.2019 um 15:45 schrieb ihjaz Mohamed <ihjazm...@gmail.com>:
>
> Hi,
>
> This is the screenshot from before. I've not been able to reproduce this issue after that.
>

> --
> Search Guard Community Forum - We are moving!
> We are moving the Search Guard Community Forum to a new home:
> https://forum.search-guard.com/
>
> All content hosted has been migrated to the new forum.
> Starting from 2019/03/30 please ask your questions on https://forum.search-guard.com/ only.
>
> The Google Group forum will not be maintained anymore.
> ---
> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/b09aca72-e9dc-4a6c-b120-6185adfa3cf4%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
> <kibana-error.jpg>

Reply all

Reply to author

Forward