Hi,
I’m having an on-prem OpenSearch + Dashboards cluster and I’m unable to make it work with our (also on-prem) AD FS.
I have it working on OpenDistro, but for some reason it’s not working with opensearch. Over the Dashboards interface I get
{
statusCode: 500,
error: "Internal Server Error",
message: "Internal Error",
}
_meta:
type: "config"
config_version: 2
config:
dynamic:
# Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
# Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
# Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
#filtered_alias_mode: warn
#do_not_fail_on_forbidden: false
#kibana:
# Kibana multitenancy
#multitenancy_enabled: true
#server_username: kibanaserver
#index: '.kibana'
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
#internalProxies: '.*' # trust all internal proxies, regex pattern
#remoteIpHeader: 'x-forwarded-for'
###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
###### and here https://tools.ietf.org/html/rfc7239
###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
authc:
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: intern
saml_auth:
http_enabled: true
transport_enabled: false
order: 1
http_authenticator:
type: saml
challenge: true
config:
idp:
#enable_ssl: true
verify_hostnames: false
metadata_file: FederationMetadata.xml
entity_id: http://sso.DOMAIN.com/adfs/services/trust
sp:
entity_id: https://xxxxxx.DOMAIN.com/
force_authn: true
kibana_url: https://xxxxxx.DOMAIN.com
subject_key: NameID
roles_key: Roles
exchange_key: 515346422bdb16e089cf98671ebdb6ee6dcf0a9508a0c1fb31f8992a3c8ab943
authentication_backend:
type: noop
This is the only thing that shows in logs:
May 6 11:23:05 demovm opensearch-dashboards[4110246]: { Error: Authentication Exception
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at respond (/usr/share/opensearch-dashboards/node_modules/elasticsearch/src/lib/transport.js:349:15)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at checkRespForFailure (/usr/share/opensearch-dashboards/node_modules/elasticsearch/src/lib/transport.js:306:7)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at HttpConnector.<anonymous> (/usr/share/opensearch-dashboards/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at IncomingMessage.wrapper (/usr/share/opensearch-dashboards/node_modules/lodash/lodash.js:4991:19)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at IncomingMessage.emit (events.js:203:15)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at endReadableNT (_stream_readable.js:1145:12)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: at process._tickCallback (internal/process/next_tick.js:63:19)
May 6 11:23:05 demovm opensearch-dashboards[4110246]: status: 401,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: displayName: 'AuthenticationException',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: message: 'Authentication Exception',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: path: '/_plugins/_security/api/authtoken',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: query: {},
May 6 11:23:05 demovm opensearch-dashboards[4110246]: body: 'Authentication finally failed',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: statusCode: 401,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: response: 'Authentication finally failed',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: toString: [Function],
May 6 11:23:05 demovm opensearch-dashboards[4110246]: toJSON: [Function],
May 6 11:23:05 demovm opensearch-dashboards[4110246]: isBoom: true,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: isServer: false,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: data: null,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: output:
May 6 11:23:05 demovm opensearch-dashboards[4110246]: { statusCode: 401,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: payload:
May 6 11:23:05 demovm opensearch-dashboards[4110246]: { statusCode: 401,
May 6 11:23:05 demovm opensearch-dashboards[4110246]: error: 'Unauthorized',
May 6 11:23:05 demovm opensearch-dashboards[4110246]: message: 'Authentication Exception' },
May 6 11:23:05 demovm opensearch-dashboards[4110246]: headers:
May 6 11:23:05 demovm opensearch-dashboards[4110246]: { 'WWW-Authenticate': 'Basic realm="Authorization Required"' } },
May 6 11:23:05 demovm opensearch-dashboards[4110246]: reformat: [Function],
May 6 11:23:05 demovm opensearch-dashboards[4110246]: [Symbol(OpenSearchError)]: 'OpenSearch/notAuthorized' }
May 6 11:23:05 demovm opensearch-dashboards[4110246]: {"type":"log","@timestamp":"2022-05-06T11:23:05Z","tags":["error","plugins","securityDashboards"],"pid":4110246,"message":"SAML IDP initiated authentication workflow failed: Error: failed to get token"}
May 6 11:23:05 demovm opensearch-dashboards[4110246]: {"type":"error","@timestamp":"2022-05-06T11:23:05Z","tags":[],"pid":4110246,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Error: Internal Server Error\n at HapiResponseAdapter.toError (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:145:19)\n at HapiResponseAdapter.toHapiResponse (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:99:19)\n at HapiResponseAdapter.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/response_adapter.js:94:17)\n at Router.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:164:34)\n at process._tickCallback (internal/process/next_tick.js:68:7)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":null,"query":{},"pathname":"/_opendistro/_security/saml/acs/idpinitiated","path":"/_opendistro/_security/saml/acs/idpinitiated","href":"/_opendistro/_security/saml/acs/idpinitiated"},"message":"Internal Server Error"}
AD FS has the following settings:
Endpoit URL: https://xxxxxx.DOMAIN.com/_opendistro/_security/saml/acs/idpinitiated
I’ve also compared the SAML response for the OpenDisto endpoint with the working one of Opensearch and they are the same in terms of elements / structure.
Any ideas what would be the reason?
Best regards,
Vlad
