Kibana 4.5.1 not working with current version of SG

I have set up a test environment with Elasticsearch 2.3.3 and Kibana 4.5.1 and SG <IP_ADDRESS>-rc1. ES + SG work fine but when I want to connect to kibana over the browser I get the following error:
Courier Fetch Error: unhandled courier request error: Authentication Exception
Version: 4.5.1
Build: 9892
Error: unhandled courier request error: Authentication Exception
    at handleError (http://<IP_ADDRESS>:5603/bundles/kibana.bundle.js?v=9892:78902:23)
    at DocRequest.AbstractReqProvider.AbstractReq.handleFailure (http://<IP_ADDRESS>:5603/bundles/kibana.bundle.js?v=9892:78822:15)
    at http://<IP_ADDRESS>:5603/bundles/kibana.bundle.js?v=9892:78716:18
    at Array.forEach (native)
    at http://<IP_ADDRESS>:5603/bundles/kibana.bundle.js?v=9892:78714:19
    at processQueue (http://<IP_ADDRESS>:5603/bundles/commons.bundle.js?v=9892:42360:29)
    at http://<IP_ADDRESS>:5603/bundles/commons.bundle.js?v=9892:42376:28
    at Scope.$eval (http://<IP_ADDRESS>:5603/bundles/commons.bundle.js?v=9892:43604:29)
    at Scope.$digest (http://<IP_ADDRESS>:5603/bundles/commons.bundle.js?v=9892:43415:32)
    at Scope.$apply (http://<IP_ADDRESS>:5603/bundles/commons.bundle.js?v=9892:43712:25)

I am using the standard configuration with sgadmin and the user "kibanaserver" for kibana. I do not have this problem with the same configuration and earlier versions of the ELK Stack + SG.
The solution to the following issue: https://github.com/elastic/kibana/issues/6719 is not working.

can you pls. post also you elasticsearch serverlogs on DEBUG level?

Good idea, I have not looked at that, yet. After startup and starting of Kibana it looks like this:
[2016-06-14 16:45:13,969][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-0] connected to node [{#zen_unicast_6#}{::1}{[::1]:9300}]
[2016-06-14 16:45:14,165][DEBUG][netty.handler.ssl.SslHandler] [id: 0xa89a9807, /0:0:0:0:0:0:0:1:33414 => /0:0:0:0:0:0:0:1:9300] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[2016-06-14 16:45:14,166][DEBUG][netty.handler.ssl.SslHandler] [id: 0x77fa967b, /0:0:0:0:0:0:0:1:33414 => /0:0:0:0:0:0:0:1:9300] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
[2016-06-14 16:45:16,905][DEBUG][discovery.zen            ] [node-0] filtered ping responses: (filter_client[true], filter_data[false]) {none}
[2016-06-14 16:45:16,906][DEBUG][discovery.zen            ] [node-0] elected as master, waiting for incoming joins ([0] needed)
[2016-06-14 16:45:16,907][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-0] disconnecting from [{#zen_unicast_6#}{::1}{[::1]:9300}] due to explicit disconnect call
[2016-06-14 16:45:16,907][DEBUG][cluster.service          ] [node-0] processing [zen-disco-join(elected_as_master, [0] joins received)]: execute
[2016-06-14 16:45:16,919][DEBUG][cluster.service          ] [node-0] cluster state updated, version [1], source [zen-disco-join(elected_as_master, [0] joins received)]
[2016-06-14 16:45:16,921][INFO ][cluster.service          ] [node-0] new_master {node-0}{SV_qD6vARtSlAIGkeT_5yA}{<IP_ADDRESS>}{<IP_ADDRESS>:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2016-06-14 16:45:16,921][DEBUG][cluster.service          ] [node-0] publishing cluster state version [1]
[2016-06-14 16:45:16,922][DEBUG][cluster.service          ] [node-0] set local cluster state to version 1
[2016-06-14 16:45:16,945][DEBUG][cluster.service          ] [node-0] processing [zen-disco-join(elected_as_master, [0] joins received)]: took 37ms done applying updated cluster_state (version: 1, uuid: MPHtFS3qQ96ym784vXQcQw)
[2016-06-14 16:45:16,955][DEBUG][cluster.service          ] [node-0] processing [local-gateway-elected-state]: execute
[2016-06-14 16:45:16,983][DEBUG][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [node-0] Bound http to address {[::1]:9200}
[2016-06-14 16:45:16,986][DEBUG][com.floragunn.searchguard.http.SearchGuardHttpServerTransport] [node-0] Bound http to address {<IP_ADDRESS>:9200}
[2016-06-14 16:45:16,987][INFO ][http                     ] [node-0] publish_address {<IP_ADDRESS>:9200}, bound_addresses {[::1]:9200}, {<IP_ADDRESS>:9200}
[2016-06-14 16:45:16,987][INFO ][node                     ] [node-0] started
[2016-06-14 16:45:16,993][DEBUG][cluster.routing.allocation.allocator] [node-0] skipping rebalance due to in-flight shard/store fetches
[2016-06-14 16:45:16,998][DEBUG][cluster.service          ] [node-0] cluster state updated, version [2], source [local-gateway-elected-state]
[2016-06-14 16:45:16,998][DEBUG][cluster.service          ] [node-0] publishing cluster state version [2]
[2016-06-14 16:45:16,998][DEBUG][cluster.service          ] [node-0] set local cluster state to version 2
[2016-06-14 16:45:17,016][DEBUG][gateway                  ] [node-0] [.kibana][0] loaded data path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/.kibana/0], state path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/.kibana/0]
[2016-06-14 16:45:17,028][DEBUG][gateway                  ] [node-0] [searchguard][0] loaded data path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/searchguard/0], state path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/searchguard/0]
[2016-06-14 16:45:17,080][DEBUG][gateway                  ] [node-0] [searchguard][0] shard state info found: [version [2], primary [true]]
[2016-06-14 16:45:17,085][DEBUG][gateway                  ] [node-0] [.kibana][0] shard state info found: [version [4], primary [true]]
[2016-06-14 16:45:17,111][INFO ][gateway                  ] [node-0] recovered [2] indices into cluster_state
[2016-06-14 16:45:17,113][DEBUG][cluster.service          ] [node-0] processing [local-gateway-elected-state]: took 157ms done applying updated cluster_state (version: 2, uuid: g0P9y94xR3W5egMhYMHpbQ)
[2016-06-14 16:45:17,114][DEBUG][cluster.service          ] [node-0] processing [cluster_reroute(async_shard_fetch)]: execute
[2016-06-14 16:45:17,117][DEBUG][gateway                  ] [node-0] [searchguard][0] found 1 allocations of [searchguard][0], node[null], [P], v[0], s[UNASSIGNED], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]], highest version: [2]
[2016-06-14 16:45:17,119][DEBUG][gateway                  ] [node-0] [searchguard][0]: allocating [[searchguard][0], node[null], [P], v[0], s[UNASSIGNED], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]] to [{node-0}{SV_qD6vARtSlAIGkeT_5yA}{<IP_ADDRESS>}{<IP_ADDRESS>:9300}] on primary allocation
[2016-06-14 16:45:17,123][DEBUG][gateway                  ] [node-0] [.kibana][0] found 1 allocations of [.kibana][0], node[null], [P], v[0], s[UNASSIGNED], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]], highest version: [4]
[2016-06-14 16:45:17,124][DEBUG][gateway                  ] [node-0] [.kibana][0]: allocating [[.kibana][0], node[null], [P], v[0], s[UNASSIGNED], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]] to [{node-0}{SV_qD6vARtSlAIGkeT_5yA}{<IP_ADDRESS>}{<IP_ADDRESS>:9300}] on primary allocation
[2016-06-14 16:45:17,126][DEBUG][cluster.service          ] [node-0] cluster state updated, version [3], source [cluster_reroute(async_shard_fetch)]
[2016-06-14 16:45:17,127][DEBUG][cluster.service          ] [node-0] publishing cluster state version [3]
[2016-06-14 16:45:17,127][DEBUG][cluster.service          ] [node-0] set local cluster state to version 3
[2016-06-14 16:45:17,127][DEBUG][indices.cluster          ] [node-0] [searchguard] creating index
[2016-06-14 16:45:17,128][DEBUG][indices                  ] [node-0] creating Index [searchguard], shards [1]/[0]
[2016-06-14 16:45:17,266][DEBUG][index.store              ] [node-0] [searchguard] using index.store.throttle.type [none], with index.store.throttle.max_bytes_per_sec [0b]
[2016-06-14 16:45:17,290][DEBUG][index.mapper             ] [node-0] [searchguard] using dynamic[true]
[2016-06-14 16:45:17,306][DEBUG][indices.cluster          ] [node-0] [.kibana] creating index
[2016-06-14 16:45:17,306][DEBUG][indices                  ] [node-0] creating Index [.kibana], shards [1]/[1]
[2016-06-14 16:45:17,330][DEBUG][index.store              ] [node-0] [.kibana] using index.store.throttle.type [none], with index.store.throttle.max_bytes_per_sec [0b]
[2016-06-14 16:45:17,349][DEBUG][index.mapper             ] [node-0] [.kibana] using dynamic[true]
[2016-06-14 16:45:17,354][DEBUG][indices.cluster          ] [node-0] [searchguard] adding mapping [internalusers], source [{"internalusers":{"properties":{"admin":{"properties":{"hash":{"type":"string"}}},"dlsflsuser":{"properties":{"hash":{"type":"string"}}},"kibanaro":{"properties":{"hash":{"type":"string"}}},"kibanaserver":{"properties":{"hash":{"type":"string"}}},"kirk":{"properties":{"hash":{"type":"string"},"roles":{"type":"string"}}},"logstash":{"properties":{"hash":{"type":"string"}}},"mister_picard":{"properties":{"hash":{"type":"string"},"username":{"type":"string"}}},"readall":{"properties":{"hash":{"type":"string"}}},"spock":{"properties":{"hash":{"type":"string"},"roles":{"type":"string"}}},"worf":{"properties":{"hash":{"type":"string"}}}}}}]
[2016-06-14 16:45:17,444][DEBUG][indices.cluster          ] [node-0] [searchguard] adding mapping [config], source [{"config":{"properties":{"searchguard":{"properties":{"dynamic":{"properties":{"authc":{"properties":{"basic_internal_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"clientcert_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"kerberos_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"config":{"properties":{"acceptor_principal":{"type":"string"},"krb_debug":{"type":"boolean"},"strip_realm_from_principal":{"type":"boolean"}}},"type":{"type":"string"}}},"order":{"type":"long"}}},"ldap":{"properties":{"authentication_backend":{"properties":{"config":{"properties":{"enable_ssl":{"type":"boolean"},"enable_ssl_client_auth":{"type":"boolean"},"enable_start_tls":{"type":"boolean"},"hosts":{"type":"string"},"userbase":{"type":"string"},"usersearch":{"type":"string"},"verify_hostnames":{"type":"boolean"}}},"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"type":{"type":"string"}}},"order":{"type":"long"}}},"proxy_auth_domain":{"properties":{"authentication_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"},"http_authenticator":{"properties":{"challenge":{"type":"boolean"},"config":{"properties":{"roles_header":{"type":"string"},"user_header":{"type":"string"}}},"type":{"type":"string"}}},"order":{"type":"long"}}}}},"authz":{"properties":{"roles_from_another_ldap":{"properties":{"authorization_backend":{"properties":{"type":{"type":"string"}}},"enabled":{"type":"boolean"}}},"roles_from_myldap":{"properties":{"authorization_backend":{"properties":{"config":{"properties":{"enable_ssl":{"type":"boolean"},"enable_ssl_client_auth":{"type":"boolean"},"enable_start_tls":{"type":"boolean"},"hosts":{"type":"string"},"resolve_nested_roles":{"type":"boolean"},"rolebase":{"type":"string"},"rolename":{"type":"string"},"rolesearch":{"type":"string"},"userrolename":{"type":"string"},"verify_hostnames":{"type":"boolean"}}},"type":{"type":"string"}}},"enabled":{"type":"boolean"}}}}},"http":{"properties":{"anonymous_auth_enabled":{"type":"boolean"},"xff":{"properties":{"enabled":{"type":"boolean"},"internalProxies":{"type":"string"},"proxiesHeader":{"type":"string"},"remoteIpHeader":{"type":"string"}}}}}}}}}}}}]
[2016-06-14 16:45:17,473][DEBUG][indices.cluster          ] [node-0] [searchguard] adding mapping [rolesmapping], source [{"rolesmapping":{"properties":{"sg_all_access":{"properties":{"users":{"type":"string"}}},"sg_kibana4":{"properties":{"users":{"type":"string"}}},"sg_kibana4_server":{"properties":{"users":{"type":"string"}}},"sg_logstash":{"properties":{"users":{"type":"string"}}},"sg_public":{"properties":{"users":{"type":"string"}}},"sg_readall":{"properties":{"users":{"type":"string"}}},"sg_readonly_dlsfls":{"properties":{"users":{"type":"string"}}},"sg_role_klingons1":{"properties":{"backendroles":{"type":"string"},"hosts":{"type":"string"},"users":{"type":"string"}}},"sg_role_starfleet":{"properties":{"backendroles":{"type":"string"},"hosts":{"type":"string"},"users":{"type":"string"}}},"sg_role_starfleet_captains":{"properties":{"backendroles":{"type":"string"}}}}}}]
[2016-06-14 16:45:17,505][DEBUG][indices.cluster          ] [node-0] [searchguard] adding mapping [actiongroups], source [{"actiongroups":{"properties":{"ALL":{"type":"string"},"CLUSTER_ALL":{"type":"string"},"CLUSTER_MONITOR":{"type":"string"},"CREATE_INDEX":{"type":"string"},"CRUD":{"type":"string"},"DATA_ACCESS":{"type":"string"},"DELETE":{"type":"string"},"GET":{"type":"string"},"INDEX":{"type":"string"},"MANAGE":{"type":"string"},"MANAGE_ALIASES":{"type":"string"},"MONITOR":{"type":"string"},"READ":{"type":"string"},"SEARCH":{"type":"string"},"SUGGEST":{"type":"string"},"WRITE":{"type":"string"}}}}]
[2016-06-14 16:45:17,511][DEBUG][indices.cluster          ] [node-0] [searchguard] adding mapping [roles], source [{"roles":{"properties":{"sg_all_access":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_kibana4":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}},"?kibana":{"properties":{"*":{"type":"string"}}}}}}},"sg_kibana4_server":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"?kibana":{"properties":{"*":{"type":"string"}}}}}}},"sg_logstash":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*beat*":{"properties":{"*":{"type":"string"}}},"logstash-*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readonly":{"properties":{"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readonly_and_monitor":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_readonly_dlsfls":{"properties":{"dls":{"type":"string"},"fls":{"type":"string"},"indices":{"properties":{"*":{"properties":{"*":{"type":"string"}}}}}}},"sg_role_starfleet":{"properties":{"indices":{"properties":{"pub*":{"properties":{"*":{"type":"string"}}},"sf":{"properties":{"alumni":{"type":"string"},"public":{"type":"string"},"ships":{"type":"string"},"students":{"type":"string"}}}}}}},"sg_role_starfleet_captains":{"properties":{"cluster":{"type":"string"},"indices":{"properties":{"pub*":{"properties":{"*":{"type":"string"}}},"sf":{"properties":{"*":{"type":"string"}}}}}}},"sg_transport_client":{"properties":{"cluster":{"type":"string"}}}}}}]
[2016-06-14 16:45:17,541][DEBUG][indices.cluster          ] [node-0] [.kibana] adding mapping [config], source [{"config":{"properties":{"buildNum":{"type":"string","index":"not_analyzed"}}}}]
[2016-06-14 16:45:17,557][DEBUG][indices.cluster          ] [node-0] [.kibana] adding mapping [index-pattern], source [{"index-pattern":{"properties":{"fieldFormatMap":{"type":"string"},"fields":{"type":"string"},"intervalName":{"type":"string"},"notExpandable":{"type":"boolean"},"timeFieldName":{"type":"string"},"title":{"type":"string"}}}}]
[2016-06-14 16:45:17,559][DEBUG][indices.cluster          ] [node-0] [searchguard][0] creating shard
[2016-06-14 16:45:17,562][DEBUG][index                    ] [node-0] [searchguard] [searchguard][0] loaded data path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/searchguard/0], state path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/searchguard/0]
[2016-06-14 16:45:17,562][DEBUG][index                    ] [node-0] [searchguard] [searchguard][0] creating using an existing path [ShardPath{path=/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/searchguard/0, indexUUID='fSH9n2e8RBil5IASlz7oMw', shard=[searchguard][0]}]
[2016-06-14 16:45:17,563][DEBUG][index                    ] [node-0] [searchguard] creating shard_id [searchguard][0]
[2016-06-14 16:45:17,567][DEBUG][com.floragunn.searchguard.configuration.SearchGuardIndexSearcherWrapperModule] FLS/DLS not enabled
[2016-06-14 16:45:17,648][DEBUG][index.store              ] [node-0] [searchguard][0] store stats are refreshed with refresh_interval [10s]
[2016-06-14 16:45:17,651][DEBUG][index.deletionpolicy     ] [node-0] [searchguard][0] Using [keep_only_last] deletion policy
[2016-06-14 16:45:17,670][DEBUG][index.shard              ] [node-0] [searchguard][0] using [tiered] merge mergePolicy with expunge_deletes_allowed[10.0], floor_segment[2mb], max_merge_at_once[10], max_merge_at_once_explicit[30], max_merged_segment[5gb], segments_per_tier[10.0], reclaim_deletes_weight[2.0]
[2016-06-14 16:45:17,672][DEBUG][index.shard              ] [node-0] [searchguard][0] state: [CREATED]
[2016-06-14 16:45:17,686][DEBUG][index.translog           ] [node-0] [searchguard][0] interval [5s], flush_threshold_ops [2147483647], flush_threshold_size [512mb], flush_threshold_period [30m]
[2016-06-14 16:45:17,691][DEBUG][index.shard              ] [node-0] [searchguard][0] state: [CREATED]->[RECOVERING], reason [from store]
[2016-06-14 16:45:17,705][DEBUG][index.shard              ] [node-0] [searchguard][0] starting recovery from shard_store ...
[2016-06-14 16:45:17,713][DEBUG][indices.cluster          ] [node-0] [.kibana][0] creating shard
[2016-06-14 16:45:17,717][DEBUG][index                    ] [node-0] [.kibana] [.kibana][0] loaded data path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/.kibana/0], state path [/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/.kibana/0]
[2016-06-14 16:45:17,711][DEBUG][indices.memory           ] [node-0] recalculating shard indexing buffer, total is [101.5mb] with [1] active shards, each shard set to indexing=[101.5mb], translog=[64kb]
[2016-06-14 16:45:17,718][DEBUG][index.shard              ] [node-0] [searchguard][0] updateBufferSize: engine is closed; skipping
[2016-06-14 16:45:17,725][DEBUG][index                    ] [node-0] [.kibana] [.kibana][0] creating using an existing path [ShardPath{path=/home/tim/NewELK/elasticsearch-2.3.3/data/elasticsearch/nodes/0/indices/.kibana/0, indexUUID='3F-CnQxiQyGDn4RNPrqw5g', shard=[.kibana][0]}]
[2016-06-14 16:45:17,725][DEBUG][index                    ] [node-0] [.kibana] creating shard_id [.kibana][0]
[2016-06-14 16:45:17,726][DEBUG][com.floragunn.searchguard.configuration.SearchGuardIndexSearcherWrapperModule] FLS/DLS not enabled
[2016-06-14 16:45:17,735][DEBUG][index.store              ] [node-0] [.kibana][0] store stats are refreshed with refresh_interval [10s]
[2016-06-14 16:45:17,765][DEBUG][index.deletionpolicy     ] [node-0] [.kibana][0] Using [keep_only_last] deletion policy
[2016-06-14 16:45:17,767][DEBUG][index.shard              ] [node-0] [.kibana][0] using [tiered] merge mergePolicy with expunge_deletes_allowed[10.0], floor_segment[2mb], max_merge_at_once[10], max_merge_at_once_explicit[30], max_merged_segment[5gb], segments_per_tier[10.0], reclaim_deletes_weight[2.0]
[2016-06-14 16:45:17,767][DEBUG][index.shard              ] [node-0] [.kibana][0] state: [CREATED]
[2016-06-14 16:45:17,767][DEBUG][index.translog           ] [node-0] [.kibana][0] interval [5s], flush_threshold_ops [2147483647], flush_threshold_size [512mb], flush_threshold_period [30m]
[2016-06-14 16:45:17,768][DEBUG][index.shard              ] [node-0] [.kibana][0] state: [CREATED]->[RECOVERING], reason [from store]
[2016-06-14 16:45:17,769][DEBUG][index.shard              ] [node-0] [.kibana][0] starting recovery from shard_store ...
[2016-06-14 16:45:17,772][DEBUG][cluster.service          ] [node-0] processing [cluster_reroute(async_shard_fetch)]: took 658ms done applying updated cluster_state (version: 3, uuid: ygLncHOtTW2eGHAZXbmwLg)
[2016-06-14 16:45:17,773][DEBUG][indices.memory           ] [node-0] recalculating shard indexing buffer, total is [101.5mb] with [2] active shards, each shard set to indexing=[50.7mb], translog=[64kb]
[2016-06-14 16:45:17,774][DEBUG][index.shard              ] [node-0] [searchguard][0] updateBufferSize: engine is closed; skipping
[2016-06-14 16:45:17,774][DEBUG][index.shard              ] [node-0] [.kibana][0] updateBufferSize: engine is closed; skipping
[2016-06-14 16:45:17,837][DEBUG][index.translog           ] [node-0] [searchguard][0] open uncommitted translog checkpoint Checkpoint{offset=43, numOps=0, translogFileGeneration= 2}
[2016-06-14 16:45:17,843][DEBUG][index.translog           ] [node-0] [.kibana][0] open uncommitted translog checkpoint Checkpoint{offset=43, numOps=0, translogFileGeneration= 3}
[2016-06-14 16:45:17,978][DEBUG][index.shard              ] [node-0] [.kibana][0] scheduling refresher every 1s
[2016-06-14 16:45:17,981][DEBUG][index.shard              ] [node-0] [.kibana][0] state: [RECOVERING]->[POST_RECOVERY], reason [post recovery from shard_store]
[2016-06-14 16:45:17,982][DEBUG][index.shard              ] [node-0] [.kibana][0] recovery completed from [shard_store], took [212ms]
[2016-06-14 16:45:17,983][DEBUG][cluster.action.shard     ] [node-0] [.kibana][0] sending shard started for target shard [[.kibana][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[5], s[INITIALIZING], a[id=ZwytTZSHSCSGh1OfTv1r1w], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]], indexUUID [3F-CnQxiQyGDn4RNPrqw5g], message [after recovery from store]
[2016-06-14 16:45:17,984][DEBUG][cluster.action.shard     ] [node-0] received shard started for target shard [[.kibana][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[5], s[INITIALIZING], a[id=ZwytTZSHSCSGh1OfTv1r1w], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]], indexUUID [3F-CnQxiQyGDn4RNPrqw5g], message [after recovery from store]
[2016-06-14 16:45:17,993][DEBUG][cluster.service          ] [node-0] processing [shard-started ([.kibana][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[5], s[INITIALIZING], a[id=ZwytTZSHSCSGh1OfTv1r1w], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]), reason [after recovery from store]]: execute
[2016-06-14 16:45:17,997][DEBUG][cluster.service          ] [node-0] cluster state updated, version [4], source [shard-started ([.kibana][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[5], s[INITIALIZING], a[id=ZwytTZSHSCSGh1OfTv1r1w], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]), reason [after recovery from store]]
[2016-06-14 16:45:17,998][DEBUG][cluster.service          ] [node-0] publishing cluster state version [4]
[2016-06-14 16:45:17,998][DEBUG][cluster.service          ] [node-0] set local cluster state to version 4
[2016-06-14 16:45:17,999][DEBUG][index.shard              ] [node-0] [.kibana][0] state: [POST_RECOVERY]->[STARTED], reason [global state is [STARTED]]
[2016-06-14 16:45:18,017][DEBUG][index.shard              ] [node-0] [searchguard][0] scheduling refresher every 1s
[2016-06-14 16:45:18,027][DEBUG][index.shard              ] [node-0] [searchguard][0] state: [RECOVERING]->[POST_RECOVERY], reason [post recovery from shard_store]
[2016-06-14 16:45:18,027][DEBUG][index.shard              ] [node-0] [searchguard][0] recovery completed from [shard_store], took [335ms]
[2016-06-14 16:45:18,027][DEBUG][cluster.action.shard     ] [node-0] [searchguard][0] sending shard started for target shard [[searchguard][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[3], s[INITIALIZING], a[id=ZE3pSiovQn6bQdKDb0KiEw], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]], indexUUID [fSH9n2e8RBil5IASlz7oMw], message [after recovery from store]
[2016-06-14 16:45:18,029][DEBUG][cluster.action.shard     ] [node-0] received shard started for target shard [[searchguard][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[3], s[INITIALIZING], a[id=ZE3pSiovQn6bQdKDb0KiEw], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]], indexUUID [fSH9n2e8RBil5IASlz7oMw], message [after recovery from store]
[2016-06-14 16:45:18,066][DEBUG][cluster.service          ] [node-0] processing [shard-started ([.kibana][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[5], s[INITIALIZING], a[id=ZwytTZSHSCSGh1OfTv1r1w], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.969Z]]), reason [after recovery from store]]: took 73ms done applying updated cluster_state (version: 4, uuid: IvW1HtnjRNaDbRoA_9X5Uw)
[2016-06-14 16:45:18,067][DEBUG][cluster.service          ] [node-0] processing [shard-started ([searchguard][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[3], s[INITIALIZING], a[id=ZE3pSiovQn6bQdKDb0KiEw], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]), reason [after recovery from store]]: execute
[2016-06-14 16:45:18,068][INFO ][cluster.routing.allocation] [node-0] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[searchguard][0]] ...]).
[2016-06-14 16:45:18,069][DEBUG][cluster.service          ] [node-0] cluster state updated, version [5], source [shard-started ([searchguard][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[3], s[INITIALIZING], a[id=ZE3pSiovQn6bQdKDb0KiEw], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]), reason [after recovery from store]]
[2016-06-14 16:45:18,069][DEBUG][cluster.service          ] [node-0] publishing cluster state version [5]
[2016-06-14 16:45:18,070][DEBUG][cluster.service          ] [node-0] set local cluster state to version 5
[2016-06-14 16:45:18,073][DEBUG][index.shard              ] [node-0] [searchguard][0] state: [POST_RECOVERY]->[STARTED], reason [global state is [STARTED]]
[2016-06-14 16:45:18,074][DEBUG][com.floragunn.searchguard.configuration.ConfigurationService] [node-0] Listener for primary shard [searchguard][0] added
[2016-06-14 16:45:18,105][DEBUG][cluster.service          ] [node-0] processing [shard-started ([searchguard][0], node[SV_qD6vARtSlAIGkeT_5yA], [P], v[3], s[INITIALIZING], a[id=ZE3pSiovQn6bQdKDb0KiEw], unassigned_info[[reason=CLUSTER_RECOVERED], at[2016-06-14T14:45:16.961Z]]), reason [after recovery from store]]: took 37ms done applying updated cluster_state (version: 5, uuid: T3spYH0qSXemOvf8NSZ31w)
[2016-06-14 16:45:18,154][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated rolesmapping for PrivilegesEvaluator
[2016-06-14 16:45:18,156][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated config for XFFResolver
[2016-06-14 16:45:18,166][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated config for BackendRegistry
[2016-06-14 16:45:18,167][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated internalusers for InternalAuthenticationBackend
[2016-06-14 16:45:18,167][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated actiongroups for ActionGroupHolder
[2016-06-14 16:45:18,167][DEBUG][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [node-0] Updated roles for PrivilegesEvaluator
[2016-06-14 16:45:40,970][DEBUG][netty.handler.ssl.SslHandler] [id: 0x0186feca, /<IP_ADDRESS>:53944 => /<IP_ADDRESS>:9200] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[2016-06-14 16:45:40,988][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /<IP_ADDRESS>:53944
[2016-06-14 16:45:40,989][DEBUG][com.floragunn.searchguard.http.XFFResolver] no xff done true,false,class org.elasticsearch.http.netty.NettyHttpRequest,{}
[2016-06-14 16:45:40,989][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
[2016-06-14 16:45:41,000][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'kibanaserver' is in cache? false (cache size: 0)
[2016-06-14 16:45:41,004][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] kibanaserver<PHONE_NUMBER>) not cached, return from internal backend directly
[2016-06-14 16:45:41,414][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2016-06-14 16:45:41,427][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine.
javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
	at sun.security.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1561)
	at org.jboss.netty.handler.ssl.SslHandler.closeEngine(SslHandler.java:591)
	at org.jboss.netty.handler.ssl.SslHandler.channelDisconnected(SslHandler.java:583)
	at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102)
	at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
	at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
	at org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:396)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.close(AbstractNioWorker.java:360)
	at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:93)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
	at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)
[2016-06-14 16:45:41,476][DEBUG][netty.handler.ssl.SslHandler] [id: 0x99c76e57, /<IP_ADDRESS>:53946 => /<IP_ADDRESS>:9200] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[2016-06-14 16:45:41,478][DEBUG][com.floragunn.searchguard.http.XFFResolver] xff resolve /<IP_ADDRESS>:53946
[2016-06-14 16:45:41,479][DEBUG][com.floragunn.searchguard.http.XFFResolver] no xff done true,false,class org.elasticsearch.http.netty.NettyHttpRequest,{}
[2016-06-14 16:45:41,479][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
[2016-06-14 16:45:41,480][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'kibanaserver' is in cache? true (cache size: 1)
[2016-06-14 16:45:41,480][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2016-06-14 16:45:41,483][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=[]]
[2016-06-14 16:45:41,484][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/nodes/info from <IP_ADDRESS>:53946
[2016-06-14 16:45:41,484][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] class org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest is not an IndicesRequest
[2016-06-14 16:45:41,485][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [_all]
[2016-06-14 16:45:41,485][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [_all]
[2016-06-14 16:45:41,487][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg_kibana4_server, sg_public]
[2016-06-14 16:45:41,488][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg_role: sg_kibana4_server
[2016-06-14 16:45:41,495][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]   resolved cluster actions:[cluster:monitor/nodes/info, cluster:monitor/health]
[2016-06-14 16:45:41,495][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]   found a match for 'sg_kibana4_server' and cluster:monitor/nodes/info, skip other roles
[2016-06-14 16:45:41,534][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine.
javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
	at sun.security.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1561)
	at org.jboss.netty.handler.ssl.SslHandler.closeEngine(SslHandler.java:591)
	at org.jboss.netty.handler.ssl.SslHandler.channelDisconnected(SslHandler.java:583)
	at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102)
	at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
	at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
	at org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:396)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.close(AbstractNioWorker.java:360)
	at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:93)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
	at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
	at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)
[2016-06-14 16:45:41,576][DEBUG][netty.handler.ssl.SslHandler] [id: 0xbf9d438e, /<IP_ADDRESS>:53948 => /<IP_ADDRESS>:9200] HANDSHAKEN: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

That error repeats indefinetly.

pls. try this as sg_config.yml:
Make sure only basic_internal_auth_domain is enabled and challenge is set to true
# This is the main configuration file where the authentication and authorization
# backends as well as the http authenticators and other settings will be defined.
#
# The authentication works like that:
#
# If there are no authenticators (authc) defined a implicit one will be created.
# This will authenticate against the internal user database and use HTTP Basic.
#
# If more than one is configured the first one which succeeds wins. If all fail then the request will be unauthenticated
# and a respective exception is thrown and/or the HTTP status is set to 401.
#
# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
# the roles from a given backend for the authenticated user.
#
# For HTTP is possible to allow anonymous authentication. If that is allowed then the http authenticators try to
# find user credentials in the HTTP request and if such where found then the user gets regularly authenticated.
# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous"
# and one role named "sg_anonymous_backendrole". If you enable anonymous authentication for all http authenticators will not challenge.
#
#
# Notice: If you define more than one authenticator make sure to put non-challenging authenticators like "proxy" or "clientcert"
# at the beginning and the challenging one at the end. If you configure more than one challenging authenticator you have to deal with
# the "challenge" flag. Because its not possible to challenge a client with two different authentication methods (for example
# Kerberos and Basic) only one can have challenge: true. All others need to have challenge: false and that means
# they look into the request and if they found no credentials they will not challenge. You can cope with this situation
# with pre-authentication. That is submitting credentials for non-challenging authenticators within the first request
# (Thats especially easy for Basic authentication).
# Default value of the challenge flag is true.
#
#
#
# HTTP
#   basic (challenging)
#   proxy (not challenging, needs xff)
#   kerberos (challenging) NOT FREE FOR COMMERCIAL
#   clientcert (not challenging, needs https)

# Authc
#   internal
#   noop
#   ldap  NOT FREE FOR COMMERCIAL USE

# Authz
#   ldap  NOT FREE FOR COMMERCIAL USE
#   noop

searchguard:
  dynamic:
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
        #internalProxies: '.*' # trust all internal proxies, regex pattern
        remoteIpHeader:  'x-forwarded-for'
        proxiesHeader:   'x-forwarded-by'
        #trustedProxies: '.*' # trust all external proxies, regex pattern
        ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
        ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
        ###### and here https://tools.ietf.org/html/rfc7239
        ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
    authc:
      kerberos_auth_domain:
        enabled: false
        order: 4
        http_authenticator:
          type: kerberos # NOT FREE FOR COMMERCIAL USE
          challenge: true
          config:
            # If true a lot of kerberos/security related debugging output will be logged to standard out
            krb_debug: false
            # Acceptor (Server) Principal name, must be present in acceptor_keytab_path file
            acceptor_principal: 'HTTP/localhost'
            # If true then the realm will be stripped from the user name
            strip_realm_from_principal: true
        authentication_backend:
          type: noop
      basic_internal_auth_domain:
        enabled: true
        order: 2
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: intern
      proxy_auth_domain:
        enabled: false
        order: 1
        http_authenticator:
          type: proxy
          challenge: false
          config:
            user_header: "x-proxy-user"
            roles_header: "x-proxy-roles"
        authentication_backend:
          type: noop
      clientcert_auth_domain:
        enabled: false
        order: 0
        http_authenticator:
          type: clientcert
          challenge: false
        authentication_backend:
          type: noop
      ldap:
        enabled: false
        order: 3
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
          type: ldap # NOT FREE FOR COMMERCIAL USE
          config:
            # enable ldaps
            enable_ssl: false
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
              - localhost:8389
            bind_dn: null
            password: null
            userbase: 'ou=people,dc=example,dc=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(uid={0})'
            # Use this attribute from the user as username (if not set then DN is used)
            username_attribute: null
    authz:
      roles_from_myldap:
        enabled: false
        authorization_backend:
          # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
          type: ldap # NOT FREE FOR COMMERCIAL USE
          config:
            # enable ldaps
            enable_ssl: false
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
              - localhost:8389
            bind_dn: null
            password: null
            rolebase: 'ou=groups,dc=example,dc=com'
            # Filter to search for roles (currently in the whole subtree beneath rolebase)
            # {0} is substituted with the DN of the user
            # {1} is substituted with the username
            # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
            rolesearch: '(uniqueMember={0})'
            # Specify the name of the attribute which value should be substituted with {2} above
            userroleattribute: null
            # Roles as an attribute of the user entry
            userrolename: memberOf
            # The attribute in a role entry containing the name of that role
            rolename: cn
            # Resolve nested roles transitive (roles which are members of other roles and so on ...)
            resolve_nested_roles: true

            userbase: 'ou=people,dc=example,dc=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(uid={0})'

      roles_from_another_ldap:
        enabled: false
        authorization_backend:
          type: ldap # NOT FREE FOR COMMERCIAL USE
          #config goes here ...

I am see the same issue with SG-2

@larsf Can you provide more details? Best would be elasticsearch log on DEBUG level and you configuration (sg_config.yml and elasticsearch.yml)

Just a reminder - this is Search-Guard-2 (rc1 -specifically):
I see this in the elasticsearch.log file (I tried to connect to the kibana server using chrome): This seem to point to a missing cert for kibana4server. The odd thing is when I connect using firefox, I do get data from kibana, which means it is able to communicate with ES..
To the best of my knowledge I have followed your instuctions on how to configure SG-2 :-)
[2016-06-29 12:33:42,154][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
[2016-06-29 12:33:42,154][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'kibanaserver' is in cache? true (cache size: 2)
[2016-06-29 12:33:42,154][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=[]]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/search from <IP_ADDRESS>:55333
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [.kibana]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {}
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: [sg_kibana4_server, sg_public]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg_role: sg_kibana4_server
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]   Try wildcard match for ?kibana
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]   Wildcard match for ?kibana: [.kibana]
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]   matches for ?kibana, will check now types []
[2016-06-29 12:33:42,155][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]     resolvedActions for ?kibana/: [indices:]
[2016-06-29 12:33:42,156][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator]     match requested action indices:data/read/search against ?kibana/: [indices:*]
[2016-06-29 12:33:42,156][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] remaining requested aliases and indices: []
[2016-06-29 12:33:42,156][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] remaining requested resolved types: []
[2016-06-29 12:33:42,156][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for 'sg_kibana4_server', evaluate other roles for fls/dls purposes
[2016-06-29 12:33:42,156][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] sg_role sg_public is empty
[2016-06-29 12:33:42,166][DEBUG][netty.handler.ssl.SslHandler] Failed to clean up SSLEngine.
javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
at sun.security.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1561)
at org.jboss.netty.handler.ssl.SslHandler.closeEngine(SslHandler.java:591)
at org.jboss.netty.handler.ssl.SslHandler.channelDisconnected(SslHandler.java:583)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:396)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.close(AbstractNioWorker.java:360)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:93)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

@larsf issue still valid? Can you try with the latest Search Guard <IP_ADDRESS> release?

Hi Floragunncom, having the same issue.
Did a fresh install of elasticsearch, added search-guard-ssl on top. Everything was working fine. Added Searchguard-2 on top. ran the sgadmin.sh , everything was succesful, cluster status is reported as green in the logs, but when trying to access https://elasticsearch.localdomain:9200 i'm getting the searchguard not initialized error message.
I'm adding my sg_config.yml my elasticsearch.yml and my log on debug level. I'm installing this on a vagrant box with
com.floragunn/search-guard-ssl/<IP_ADDRESS>
com.floragunn/search-guard-2/<IP_ADDRESS>
on top of Elasticsearch 2.3.4
elasticsearch.yml.txt
sg_config.yml.txt
elasticsearch.log.txt

@john-bakker how many nodes you`re running?

It was installed on a 2 node cluster but only started 1. I suspect that
something else is going on.
If I start elasticsearch, run sgadmin.sh everything runs fine but when I
restart elastic and watch the logs I see the the behavior described in
https://github.com/floragunncom/search-guard/issues/182
Op 28 jul. 2016 9:51 p.m. schreef "floragunn UG"<EMAIL_ADDRESS>
@john-bakker https://github.com/john-bakker how many nodes you`re
running?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/floragunncom/search-guard/issues/142#issuecomment-236005509,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARwD0gzWkRqig92smPl9gasJvLgzx00Nks5qaQg2gaJpZM4I1ZdZ
.

I can not reproduce this locally yet. Can you provide a step by step description how to reproduce it?

I'm currently out of office right now, will be back on Tuesday.
I'm installing elasticsearch , installing search-guard ssl, using the
certificates from the example scripts, starting up elastic, everything
works.  Generate a admin certificate from the same signing CA. Install
search guard 2,enable the admin user in the elasticsearch.Yml. Run
sgadmin.sh with the admin certificate as keystore. Everything runs fine.
But then get the search-guard sg11 not initialized error. And when I look
in the latest log I see the error I mentioned in the last update.
Op 28 jul. 2016 10:17 p.m. schreef "floragunn UG"<EMAIL_ADDRESS>
:

I can not reproduce this locally yet. Can you provide a step by step
description how to reproduce it?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/floragunncom/search-guard/issues/142#issuecomment-236012314,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARwD0ktAaABUXvEUH2MPC5m6eL9O7ohGks5qaQ5MgaJpZM4I1ZdZ
.

Floragunn,
I got back to the office , hereby the exact steps that i did: (reproduced
my issue on a fresh elasticsearch installation)

yum install elasticsearch,

sudo chkconfig --add elasticsearch

changed the /etc/elasticsearch/elasticsearch.yml with my clustername
and nodename,

installed searchguard ssl plugin from file (as my vagrant doesn't have
connection to the internet)
bin/plugin install -b file:///vagrant/elk/search-guard-ssl-<IP_ADDRESS>.zip

ran the example.sh for generating the server and client certificates.
( added the following line ./gen_client_node_cert.sh admin changeit capass)

copied all the files to /etc/elasticsearch/keystores

chmod 750 + chown elasticsearch:elasticsearch on
/etc/elasticsearch/keystores

added ssl info on the /etc/elasticsearch/elasticsearch.yml

restarted elasticsearch service , it startsup and shows elasticsearch
information serving on https

So far so good. Elasticsearch is running, it is running on HTTPS, and the
nodes are on SSL as well.
https://elasticsearch.localdomain:9200/_searchguard/sslinfo?pretty
{
"principal" : null,
"peer_certificates" : "0",
"ssl_protocol" : "TLSv1.2",
"ssl_cipher" : "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"ssl_openssl_available" : false,
"ssl_openssl_version" : -1,
"ssl_openssl_version_string" : null,
"ssl_openssl_non_available_cause" :
"java.lang.ClassNotFoundException: org.apache.tomcat.jni.SSL",
"ssl_provider_http" : "JDK",
"ssl_provider_transport_server" : "JDK",
"ssl_provider_transport_client" : "JDK"
}
https://elasticsearch.localdomain:9200/_cluster/health?pretty=true
{
"cluster_name" : "elasticsearch",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 1,
"active_shards" : 1,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
Now we go ahead and install the search-guard-2 plugin

bin/plugin install -b file:///vagrant/elk/search-guard-2-<IP_ADDRESS>.zip

edit /etc/elasticsearch/elasticsearch.yml to enable search-guard

The elasticsearch.yml now looks like :
cluster.name: elasticsearch
node.name: node-0
network:
host: <IP_ADDRESS>
http:
port: 9200
searchguard.ssl.transport.enabled: true
searchguard.ssl.transport.keystore_type: JKS
searchguard.ssl.transport.keystore_filepath: keystores/node-0-keystore.jks
searchguard.ssl.transport.keystore_password: changeit
searchguard.ssl.transport.truststore_type: JKS
searchguard.ssl.transport.truststore_filepath: keystores/truststore.jks
searchguard.ssl.transport.truststore_password: changeit
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.transport.resolve_hostname: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.keystore_type: JKS
searchguard.ssl.http.keystore_filepath: keystores/node-0-keystore.jks
searchguard.ssl.http.keystore_password: changeit
searchguard.ssl.http.clientauth_mode: NONE
searchguard.enabled: true
searchguard.authcz.admin_dn:

CN=node-0.example.com, OU=SSL, O=Test, L=Test, C=DE

cn=smith,ou=IT,ou=IT,dc=company,dc=com

cn=admin,ou=client,o=client,l=Test,c=DE

restarted elasticsearch service, elasticsearch is startingup properly

plugins/search-guard-2/tools/sgadmin.sh -cn elasticsearch -cd
plugins/search-guard-2/sgconfig/ -ks
/etc/elasticsearch/keystores/admin-keystore.jks -kspass changeit -ts
/etc/elasticsearch/keystores/truststore.jks  -tspass changeit -h
elasticsearch.localdomain -nhnv

result was :
Populate config from
/usr/share/elasticsearch/plugins/search-guard-2/sgconfig
Will update 'config' with plugins/search-guard-2/sgconfig/sg_config.yml
SUCC Configuration for 'config' created or updated
Will update 'roles' with plugins/search-guard-2/sgconfig/sg_roles.yml
SUCC Configuration for 'roles' created or updated
Will update 'rolesmapping' with
plugins/search-guard-2/sgconfig/sg_roles_mapping.yml
SUCC Configuration for 'rolesmapping' created or updated
Will update 'internalusers' with
plugins/search-guard-2/sgconfig/sg_internal_users.yml
SUCC Configuration for 'internalusers' created or updated
Will update 'actiongroups' with
plugins/search-guard-2/sgconfig/sg_action_groups.yml
SUCC Configuration for 'actiongroups' created or updated
Done with success
now when accessing the https://elasticsearch.localdomain:9200 the response
is :
Search Guard not initialized (SG11)
2016-07-28 22:26 GMT+02:00 John Bakker<EMAIL_ADDRESS>
I'm currently out of office right now, will be back on Tuesday.
I'm installing elasticsearch , installing search-guard ssl, using the
certificates from the example scripts, starting up elastic, everything
works.  Generate a admin certificate from the same signing CA. Install
search guard 2,enable the admin user in the elasticsearch.Yml. Run
sgadmin.sh with the admin certificate as keystore. Everything runs fine.
But then get the search-guard sg11 not initialized error. And when I look
in the latest log I see the error I mentioned in the last update.
Op 28 jul. 2016 10:17 p.m. schreef "floragunn UG" <
<EMAIL_ADDRESS>
I can not reproduce this locally yet. Can you provide a step by step
description how to reproduce it?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/floragunncom/search-guard/issues/142#issuecomment-236012314,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARwD0ktAaABUXvEUH2MPC5m6eL9O7ohGks5qaQ5MgaJpZM4I1ZdZ
.

Will investigate

@floragunncom did you manage to reproduce with the steps mentioned above?

@john-bakker pls allow a few more days - we are just preparing a new release which might fix your issue

with the new <IP_ADDRESS> version of search-guard, i'm getting a little further :

[root@elasticsearch elasticsearch]# plugins/search-guard-2/tools/sgadmin.sh -cn elasticsearch -cd plugins/search-guard-2/sgconfig/ -ks /etc/elasticsearch/keystores/admin-keystore.jks -kspass changeit -ts /etc/elasticsearch/keystores/truststore.jks  -tspass changeit -h elasticsearch.localdomain -nhnv
Will connect to elasticsearch.localdomain:9300 ... done
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: elasticsearch
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
searchguard index does not exists, attempt to create it ... done
Populate config from /usr/share/elasticsearch/plugins/search-guard-2/sgconfig
Will update 'config' with plugins/search-guard-2/sgconfig/sg_config.yml
   SUCC: Configuration for 'config' created or updated
Will update 'roles' with plugins/search-guard-2/sgconfig/sg_roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update 'rolesmapping' with plugins/search-guard-2/sgconfig/sg_roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update 'internalusers' with plugins/search-guard-2/sgconfig/sg_internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update 'actiongroups' with plugins/search-guard-2/sgconfig/sg_action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated

with this output on the screen it hangs. The log shows :
[2016-08-11 12:27:41,406][INFO ][cluster.metadata         ] [node-0] [searchguard] creating index, cause [api], templates [], shards [1]/[0], mappings []
[2016-08-11 12:27:41,919][INFO ][cluster.routing.allocation] [node-0] Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[searchguard][0]] ...]).
[2016-08-11 12:27:42,171][INFO ][cluster.metadata         ] [node-0] [searchguard] create_mapping [config]
[2016-08-11 12:27:42,503][INFO ][cluster.metadata         ] [node-0] [searchguard] create_mapping [roles]
[2016-08-11 12:27:42,622][INFO ][cluster.metadata         ] [node-0] [searchguard] create_mapping [rolesmapping]
[2016-08-11 12:27:42,693][INFO ][cluster.metadata         ] [node-0] [searchguard] create_mapping [internalusers]
[2016-08-11 12:27:42,764][INFO ][cluster.metadata         ] [node-0] [searchguard] create_mapping [actiongroups]
[2016-08-11 12:29:41,986][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-11 12:29:42,842][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-11 12:31:41,987][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout
[2016-08-11 12:31:42,843][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout

Can you provide

Full elasticsearch logfile on DEBUG level (from elasticsearch start point until sgadmin finished + one or two minutes)
Operating system and JVM version/vendor

Meanwhile i'll try to reproduce it
See also here https://groups.google.com/forum/#!topic/search-guard/1SVq0DCUk50 and #182

And maybe you post your Vagrantfile, that would help a lot. If you cannot make it public feel free to send it in a private mail.

Hi Florafunn,
My OS is Oracle enterprise linux version 6.5
My java version is Oracle java 8
Please finde my vagrant file and log file on debug level attached .
#182 was the reason I tried the <IP_ADDRESS> searchguard version now.
the other link that you post , the issue from Benjamin Shoemaker is exactly what I am facing.
Vagrantfile.txt
elasticsearch.log (2).txt

can you try to install the following Search Guard Version: https://oss.sonatype.org/content/repositories/snapshots/com/floragunn/search-guard-2/<IP_ADDRESS>tm-SNAPSHOT/search-guard-2-<IP_ADDRESS>tm-20160811.140959-1.zip

forget the last comment, maybe i found something, seems like the node ssl certificate does not have the right san. How to you generated the certificates?
pls. install: https://oss.sonatype.org/content/repositories/snapshots/com/floragunn/search-guard-2/<IP_ADDRESS>cf-SNAPSHOT/search-guard-2-<IP_ADDRESS>cf-20160811.153248-1.zip
and look for debug output like:
[2016-08-11 17:25:01,805][DEBUG][SearchGuardTransportService] Certs count: 4
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService] 0. CN=node-0.example.com, OU=SSL, O=Test, L=Test, C=DE X.509
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService]  serial 1
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService]  crit oids [<IP_ADDRESS>]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService]  ext [<IP_ADDRESS>.<IP_ADDRESS>.1, <IP_ADDRESS>.<IP_ADDRESS>.2]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService]  ian null
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService]  non crit oids [<IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService]  san [[2, node-0.example.com], [2, localhost], [7, <IP_ADDRESS>], [8, <IP_ADDRESS>.5.5]]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService]  issuer CN=Example Com Inc. Signing CA, OU=Example Com Inc. Signing CA, O=Example Com Inc., DC=example, DC=com
[2016-08-11 17:25:01,808][DEBUG][SearchGuardTransportService]  sig alg SHA256withRSA
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] 1. CN=Example Com Inc. Signing CA, OU=Example Com Inc. Signing CA, O=Example Com Inc., DC=example, DC=com X.509
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  serial 2
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  ext null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  ian null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  non crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  san null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  issuer CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com Inc., DC=example, DC=com
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService]  sig alg SHA256withRSA
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService] 2. CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com Inc., DC=example, DC=com X.509
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService]  serial 1
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService]  crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  ext null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  ian null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  non crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  san null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  issuer CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com Inc., DC=example, DC=com
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService]  sig alg SHA256withRSA
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService] 3. CN=node-0.example.com, OU=SSL, O=Test, L=Test, C=DE X.509
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  serial 1
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  crit oids [<IP_ADDRESS>]
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  ext [<IP_ADDRESS>.<IP_ADDRESS>.1, <IP_ADDRESS>.<IP_ADDRESS>.2]
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  ian null
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  non crit oids [<IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  san [[2, node-0.example.com], [2, localhost], [7, <IP_ADDRESS>], [8, <IP_ADDRESS>.5.5]]
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  issuer CN=Example Com Inc. Signing CA, OU=Example Com Inc. Signing CA, O=Example Com Inc., DC=example, DC=com
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService]  sig alg SHA256withRSA

I generated the certificate using the example scripts. I used the
./example.sh got the scripts from the github.
Op 11 aug. 2016 5:44 p.m. schreef "floragunn UG"<EMAIL_ADDRESS>forget the last comment, maybe i found something, seems like the node ssl
certificate does not have the right san. How to you generated the
certificates?
pls. install: https://oss.sonatype.org/content/repositories/
snapshots/com/floragunn/search-guard-2/<IP_ADDRESS>cf-
SNAPSHOT/search-guard-2-<IP_ADDRESS>cf-20160811.153248-1.zip
and look for debug output like:
[2016-08-11 17:25:01,805][DEBUG][SearchGuardTransportService] Certs count: 4
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService] 0. CN=
node-0.example.com, OU=SSL, O=Test, L=Test, C=DE X.509
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService] serial 1
[2016-08-11 17:25:01,806][DEBUG][SearchGuardTransportService] crit oids
[<IP_ADDRESS>]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService] ext
[<IP_ADDRESS>.<IP_ADDRESS>.1, <IP_ADDRESS>.<IP_ADDRESS>.2]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService] ian null
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService] non crit oids
[<IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService] san [[2,
node-0.example.com], [2, localhost], [7, <IP_ADDRESS>], [8, <IP_ADDRESS>.5.5]]
[2016-08-11 17:25:01,807][DEBUG][SearchGuardTransportService] issuer
CN=Example Com Inc. Signing CA, OU=Example Com Inc. Signing CA, O=Example
Com Inc., DC=example, DC=com
[2016-08-11 17:25:01,808][DEBUG][SearchGuardTransportService] sig alg
SHA256withRSA
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] 1. CN=Example
Com Inc. Signing CA, OU=Example Com Inc. Signing CA, O=Example Com Inc.,
DC=example, DC=com X.509
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] serial 2
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] crit oids
[<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] ext null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] ian null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] non crit oids
[<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] san null
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] issuer
CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com
Inc., DC=example, DC=com
[2016-08-11 17:25:01,809][DEBUG][SearchGuardTransportService] sig alg
SHA256withRSA
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService] 2. CN=Example
Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com Inc.,
DC=example, DC=com X.509
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService] serial 1
[2016-08-11 17:25:01,810][DEBUG][SearchGuardTransportService] crit oids
[<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] ext null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] ian null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] non crit oids
[<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] san null
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] issuer
CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com
Inc., DC=example, DC=com
[2016-08-11 17:25:01,811][DEBUG][SearchGuardTransportService] sig alg
SHA256withRSA
[2016-08-11 17:25:01,812][DEBUG][SearchGuardTransportService] 3.
Reply to this email directly, view it on GitHub
https://github.com/floragunncom/search-guard/issues/142#issuecomment-239199040,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARwD0gi7KcLyv517VRMDXmYudlhPYPEAks5qe0FngaJpZM4I1ZdZ
.

You were right about the SAN not being picked up .
this is what  I see in the logs :
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  serial 1
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  ext null
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  ian null
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  non crit oids [<IP_ADDRESS>, <IP_ADDRESS>]
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  san null
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  issuer CN=Example Com Inc. Root CA, OU=Example Com Inc. Root CA, O=Example Com Inc., DC=example, DC=com
[2016-08-12 13:06:43,476][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService]  sig alg SHA1withRSA
[2016-08-12 13:06:43,480][DEBUG][com.floragunn.searchguard.transport.SearchGuardTransportService] 3. CN=admin, OU=client, O=client, L=Test, C=DE X.509

If I use the server certificate instead of a client certificate I do see the SAN, but in the previous versions i've seen error messages being caused by that saying that I needed a client certificate.
I attached a zip with my complete example-pki-scripts folder including the files that generate them.
Also I've attached my latest logfile
example-pki-scripts.zip
elasticsearch.log.txt

Does https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle work for you?

Hi Floragunn,
No the bundle doesn't work as well. With the bundle I see exact same behaviour (see the attached log)
elasticsearch_bundle_debug.log.txt

I experienced the exact same issue John had articulated. I was actually trying out search guard as an alternative to shield. I tried only search guard bundle from http://downloads.floragunn.com/elasticsearch-866a7b29-59d7-444c-833c-f10c42d533e9.tar.gz
Download link is from https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle
[2016-08-31 13:19:22,281][INFO ][com.floragunn.searchguard.configuration.SearchGuardIndexSearcherWrapperModule] FLS/DLS enabled
[2016-08-31 13:19:22,536][INFO ][cluster.routing.allocation] [localhost] Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[searchguard][0]] ...]).
[2016-08-31 13:19:22,785][INFO ][cluster.metadata         ] [localhost] [searchguard] create_mapping [config]
[2016-08-31 13:19:23,047][INFO ][cluster.metadata         ] [localhost] [searchguard] create_mapping [roles]
[2016-08-31 13:19:23,227][INFO ][cluster.metadata         ] [localhost] [searchguard] create_mapping [rolesmapping]
[2016-08-31 13:19:23,298][INFO ][cluster.metadata         ] [localhost] [searchguard] create_mapping [internalusers]
[2016-08-31 13:19:23,389][INFO ][cluster.metadata         ] [localhost] [searchguard] create_mapping [actiongroups]
[2016-08-31 13:20:12,724][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Not yet initialized
[2016-08-31 13:21:22,572][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-31 13:21:23,425][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-31 13:24:23,931][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout
[2016-08-31 13:24:24,785][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout
[2016-08-31 13:26:23,931][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (3 object) due to timeout
[2016-08-31 13:26:24,785][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (3 object) due to timeout
[2016-08-31 13:28:23,932][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (4 object) due to timeout
[2016-08-31 13:28:24,786][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (4 object) due to timeout
[2016-08-31 13:30:23,932][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (5 object) due to timeout
[2016-08-31 13:30:24,786][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (5 object) due to timeout
[2016-08-31 13:30:24,786][ERROR][com.floragunn.searchguard.action.configupdate.TransportConfigUpdateAction] [localhost] Unable to load all configurations types. Loaded '[]' but should '[config, roles, rolesmapping, internalusers, actiongroups]'
[2016-08-31 13:32:24,934][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-31 13:34:16,530][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Not yet initialized
[2016-08-31 13:34:24,935][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout
[2016-08-31 13:36:24,935][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (3 object) due to timeout
[2016-08-31 13:38:24,936][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (4 object) due to timeout
[2016-08-31 13:40:24,936][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (5 object) due to timeout
[2016-08-31 13:42:25,938][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (first object) due to timeout
[2016-08-31 13:44:25,938][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (2 object) due to timeout
[2016-08-31 13:46:25,939][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (3 object) due to timeout
[2016-08-31 13:48:25,940][WARN ][com.floragunn.searchguard.configuration.ConfigurationLoader] Cannot retrieve configuration (4 object) due to timeout

curl -k -u admin:admin https://localhost:9200/_searchguard/authinfo
Search Guard not initialized (SG11)

I am on Debian 8 (Jessie) with Oracle JDK 7


Get rid of most warnings due to deprecated bindings

This is the one I was after, and wow was it annoying to find. Note to self: use flush religiously when trying to figure out which line is issuing a warning.
High time to tag a new release, too.

Let's tag as 0.1.0.


make 'main' the default branch of the repo

Planning to phase out master as the default branch and replace it with main.
#1038 covers most of the changes necessary to do this, but there are still a few places outside of this repo like in our performance tests that need to be updated to work with this change

main is now the default branch


Roll Plugins from af2896b199ec to a22f5912f6ba (1 revision)

https://github.com/flutter/plugins/compare/af2896b199ec...a22f5912f6ba
2021-08-19<EMAIL_ADDRESS>[in_app_purchase] Add toString() to IAPError (flutter/plugins#4162)
If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://autoroll.skia.org/r/flutter-plugins-flutter-autoroll
Please CC<EMAIL_ADDRESS>on the revert to ensure that a human
is aware of the problem.
To file a bug in Flutter: https://github.com/flutter/flutter/issues/new/choose
To report a problem with the AutoRoller itself, please file a bug:
https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug
Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

I removed the "waiting for tree to go green" label for https://github.com/flutter/flutter/issues/88531. I will reapply it when the tree is really closed.


Add bspEnabled setting

Fixes #5675
We have Global / bspEnabled := true by default.
One can set <project> / <config> / bspEnabled := false to disable BSP on a specific project and configuration. It makes the corresponding target out of the BSP workspace and thus unknown by the BSP client.
This can be handy if the project is very resource consuming or very involved in some way.

I've rebased this branch to fix the conflicts