Kibana kicking me out - "An unexpected authentication error occurred. Please log in again."

[brazorfajeje]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

16

RAM

128

Storage for /

250GB

Storage for /nsm

2TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I have the same problem on 4 different environments.
I have random logouts in kibana with message "An unexpected authentication error occurred. Please log in again."

I think that this UNEXPECTED_SESSION_ERROR in the /opt/so/log/kibana.log are related to the issue:

....
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:18:24.430+00:00","message":"Login attempt with \"basic\" provider succeeded (requires redirect: true).","log":{"level":"INFO","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768798.32648175},"trace":{"id":"687b5acd62f5d9810591b76dc77819f8"},"transaction":{"id":"1978ac5db11da929"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:03.321+00:00","message":"Performing login attempt with \"basic\" provider.","log":{"level":"INFO","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768837.216873535},"trace":{"id":"b752c0342736458ed0785dd2defdd138"},"transaction":{"id":"79c17343bf97a3bb"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:03.777+00:00","message":"Login attempt with \"basic\" provider succeeded (requires redirect: true).","log":{"level":"INFO","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768837.674471756},"trace":{"id":"b752c0342736458ed0785dd2defdd138"},"transaction":{"id":"79c17343bf97a3bb"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:05.247+00:00","message":"Authentication attempt failed: UNEXPECTED_SESSION_ERROR","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768839.143345309},"trace":{"id":"4b97232bb8f5f6a226f2033021f2081a"},"transaction":{"id":"6c68e65d9948087f"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:05.249+00:00","message":"Authentication attempt failed: UNEXPECTED_SESSION_ERROR","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768839.145239351},"trace":{"id":"205dcb114ead7c737269a2743fd1d3e2"},"transaction":{"id":"d027d52954c6f041"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:05.254+00:00","message":"Authentication attempt failed: UNEXPECTED_SESSION_ERROR","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768839.150329739},"trace":{"id":"19dd68e968d8ea4720cb2bd48a003abd"},"transaction":{"id":"d1b107c91d518d19"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:05.256+00:00","message":"Authentication attempt failed: UNEXPECTED_SESSION_ERROR","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768839.151993662},"trace":{"id":"300ada9a11cfda47af766018e922656a"},"transaction":{"id":"1c7ab4a0519bec83"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:05.636+00:00","message":"Authentication attempt failed: UNEXPECTED_SESSION_ERROR","log":{"level":"ERROR","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768839.532023072},"trace":{"id":"cf3232d4c97466659af12bb63544fa0a"},"transaction":{"id":"19241917ca6ca18c"}}
{"http":{"response":{"status_code":401},"request":{"method":"post","path":"/api/core/capabilities"}},"error":{"message":"security_exception\n\tRoot causes:\n\t\tsecurity_exception: missing authentication credentials for REST request [/_security/user/_has_privileges]"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:08.562+00:00","message":"401 Unauthorized","log":{"level":"ERROR","logger":"http"},"process":{"pid":8,"uptime":768842.458674204},"trace":{"id":"1fa67af72343434222b2f2e012c5dfa6"},"transaction":{"id":"e84ef1f59de67634"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:13.342+00:00","message":"Performing login attempt with \"basic\" provider.","log":{"level":"INFO","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768847.238374201},"trace":{"id":"6b41c2aef7619af1940655661b8513c7"},"transaction":{"id":"504686fdc3ab24b2"}}
{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:19:13.376+00:00","message":"Login attempt with \"basic\" provider succeeded (requires redirect: true).","log":{"level":"INFO","logger":"plugins.security.authentication"},"process":{"pid":8,"uptime":768847.27267178},"trace":{"id":"6b41c2aef7619af1940655661b8513c7"},"transaction":{"id":"504686fdc3ab24b2"}}
{"cluster_uuid":"TnF6I6HqR82YoEmixo6hZQ","cluster_name":"securityonion","taskId":"security:telemetry-filterlist-artifact:1.0.0","service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-06T10:21:43.177+00:00","message":"Telemetry is not opted-in","log":{"level":"INFO","logger":"plugins.securitySolution.telemetry_events.sender.task"},"process":{"pid":8,"uptime":768997.073502603},"trace":{"id":"420f00e78f29f71125e5ce1b6c89cd4b"},"transaction":{"id":"3cbef22d780bf2e7"}}
....

Any idea? is that a known bug?

Thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Which browser are you using?

[brazorfajeje]

I am using firefox too

[cm-ops]

elastic/kibana#220637 Try the below and see if that fixes the issue.

1. Navigate to Advance settings (Stack Management -> Advance settings) ,
2. Look for "Field cache max age" and set the value to 0.

[Zer0-cyber-web]

I thought this is not a bug, but feature :)) I have it too, but not so often, so I don't mention it at all. In my case it happens with Mozilla Firefox (always latest), and every time I open SOC - it puts page it "Facebook" container. I think this maybe the cause.