---
title: "Authentication quickstart"
description: "Sign in to the Calico Enterprise web console and Kibana with default service-account token authentication for a quick first-time setup."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart"
---

# Authentication quickstart

## Big picture

Get started quickly with our default token authentication to log in to the Calico Enterprise web console and Kibana.

## Concepts

### Authentication defaults

Token authentication is the default authentication option for the Calico Enterprise web console. When a service account is created, an associated secret is created that contains a signed bearer token for that service account. Just copy the token for the service account in to the web console and log in.

Use basic login for the default Kibana root user.

The default login methods are always available at:

- **the Calico Enterprise web console:** `https://<host>:<port>/login/token`.
- **Kibana:** `https://<host>:<port>/tigera-kibana/login`.

## Before you begin

Make sure you have installed Calico Enterprise using one of the [installation guides](https://docs.tigera.io/calico-enterprise/latest/getting-started.md) and have set up [access to the web console](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager.md).

## How to

> **SECONDARY:** For OpenShift, replace `kubectl` with `oc` in the following commands.

**Log in to the Calico Enterprise web console**

First, create a service account in the desired namespace:

```bash
kubectl create sa <user> -n <namespace>
```

Give the service account permissions to access the Calico Enterprise web console, and a Calico Enterprise cluster role:

```bash
kubectl create clusterrolebinding <binding_name> --clusterrole <role_name> --serviceaccount <namespace>:<service_account>
```

where:

- **binding\_name** is a descriptive name for the rolebinding.
- **role\_name** is one of the default cluster roles (or a custom cluster role) specifying Calico Enterprise UI permissions.
- **namespace** is the service account's namespace.
- **service\_account** is the service account that the permissions are being associated with.

For example, the following command gives the service account, `jane` in the default namespace network admin permissions:

```bash
kubectl create clusterrolebinding jane-access --clusterrole tigera-network-admin --serviceaccount default:jane
```

Next, create a login token for the service account.

Using the running example of a service account named, `jane` in the default namespace:

```bash
kubectl create token jane --duration=24h
```

> **SECONDARY:** The token created above will expire after 24 hours.

Now that you have the token, log in to the Calico Enterprise UI and submit the token.

`https://<host>:<port>/login/token`

**Log in to Kibana**

Connect to Kibana with the `elastic` username. Use the following command to decode the password:

```text
kubectl -n tigera-elasticsearch get secret tigera-secure-es-elastic-user -o go-template='{{.data.elastic | base64decode}}' && echo
```

Once logged in, you can configure users and their privileges from the settings page.

## Additional resources

- [Configure user roles and permissions](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/roles-and-permissions.md)
- [Configure an external identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md)
- [Configure RBAC for tiered policies](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/rbac-tiered-policies.md)
- [Configure RBAC for Elasticsearch](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/rbac-elasticsearch.md)