Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.14
Describe the issue:
I have trying to allow anonymous auth according to this guide
the issue is that i am getting to the log in screen and i can see the login as anonymous button but when i press it, i get a circle and getting buck to login screen
Configuration:
i have configure according to the guide in the link
Relevant Logs or Screenshots:
Hi @Mantas
Here are the files
> Blockquote
_meta:
type: "config"
config_version: 2
config:
dynamic:
# Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
# Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
# Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
#filtered_alias_mode: warn
#do_not_fail_on_forbidden: false
#kibana:
# Kibana multitenancy
#multitenancy_enabled: true
#private_tenant_enabled: true
#default_tenant: ""
#server_username: kibanaserver
#index: '.kibana'
http:
anonymous_auth_enabled:true
xff:
enabled: false
internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
#internalProxies: '.*' # trust all internal proxies, regex pattern
#remoteIpHeader: 'x-forwarded-for'
###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
###### and here https://tools.ietf.org/html/rfc7239
###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
authc:
kerberos_auth_domain:
http_enabled: false
transport_enabled: false
order: 6
http_authenticator:
type: kerberos
challenge: true
config:
# If true a lot of kerberos/security related debugging output will be logged to standard out
krb_debug: false
# If true then the realm will be stripped from the user name
strip_realm_from_principal: true
authentication_backend:
type: noop
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 4
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: intern
proxy_auth_domain:
description: "Authenticate via proxy"
http_enabled: false
transport_enabled: false
order: 3
http_authenticator:
type: proxy
challenge: false
config:
user_header: "x-proxy-user"
roles_header: "x-proxy-roles"
authentication_backend:
type: noop
jwt_auth_domain:
description: "Authenticate via Json Web Token"
http_enabled: false
transport_enabled: false
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
jwt_header: "Authorization"
jwt_url_parameter: null
jwt_clock_skew_tolerance_seconds: 30
roles_key: null
subject_key: null
authentication_backend:
type: noop
clientcert_auth_domain:
description: "Authenticate via SSL client certificates"
http_enabled: false
transport_enabled: false
order: 2
http_authenticator:
type: clientcert
config:
username_attribute: cn #optional, if omitted DN becomes username
challenge: false
authentication_backend:
type: noop
ldap:
description: "Authenticate via LDAP or Active Directory"
http_enabled: false
transport_enabled: false
order: 5
http_authenticator:
type: basic
challenge: false
authentication_backend:
# LDAP authentication backend (authenticate users against a LDAP or Active Directory)
type: ldap
config:
# enable ldaps
enable_ssl: false
# enable start tls, enable_ssl should be false
enable_start_tls: false
# send client certificate
enable_ssl_client_auth: false
# verify ldap hostname
verify_hostnames: true
hosts:
- localhost:8389
bind_dn: null
password: null
userbase: 'ou=people,dc=example,dc=com'
# Filter to search for users (currently in the whole subtree beneath userbase)
# {0} is substituted with the username
usersearch: '(sAMAccountName={0})'
# Use this attribute from the user as username (if not set then DN is used)
username_attribute: null
authz:
roles_from_myldap:
description: "Authorize via LDAP or Active Directory"
http_enabled: false
transport_enabled: false
authorization_backend:
# LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
type: ldap
config:
# enable ldaps
enable_ssl: false
# enable start tls, enable_ssl should be false
enable_start_tls: false
# send client certificate
enable_ssl_client_auth: false
# verify ldap hostname
verify_hostnames: true
hosts:
- localhost:8389
bind_dn: null
password: null
rolebase: 'ou=groups,dc=example,dc=com'
# Filter to search for roles (currently in the whole subtree beneath rolebase)
# {0} is substituted with the DN of the user
# {1} is substituted with the username
# {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
rolesearch: '(member={0})'
# Specify the name of the attribute which value should be substituted with {2} above
userroleattribute: null
# Roles as an attribute of the user entry
userrolename: disabled
#userrolename: memberOf
# The attribute in a role entry containing the name of that role, Default is "name".
# Can also be "dn" to use the full DN as rolename.
rolename: cn
# Resolve nested roles transitive (roles which are members of other roles and so on ...)
resolve_nested_roles: true
userbase: 'ou=people,dc=example,dc=com'
# Filter to search for users (currently in the whole subtree beneath userbase)
# {0} is substituted with the username
usersearch: '(uid={0})'
# Skip users matching a user name, a wildcard or a regex pattern
#skip_users:
# - 'cn=Michael Jackson,ou*people,o=TEST'
# - '/\S*/'
roles_from_another_ldap:
description: "Authorize via another Active Directory"
http_enabled: false
transport_enabled: false
authorization_backend:
type: ldap
#config goes here ...
DASHBOARD
opensearch.hosts: [https://localhost:9200]
opensearch.ssl.verificationMode: none
opensearch.username: kibanaserver
opensearch.password: kibanaserver
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
# anonymous 1 lines added
opensearch_security.auth.anonymous_auth_enabled: true
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.openid.root_ca: /etc/ssl/certs/ca-certificates.crt
# Use this setting if you are running opensearch-dashboards without https
opensearch_security.cookie.secure: false
Can any one help with this ?
Hi @koby058,
Could you please run the below and share the output:
curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/securityconfig?pretty
Thanks,
mj
One more thing, have you defined anonymous authentication privileges?
more info here: https://opensearch.org/docs/latest/security/access-control/anonymous-authentication/#defining-anonymous-authentication-privileges
Best,
mj
Hi @Mantas
here is the command output"
about your 2nd question i did add both configuration to both of the files as is no change made
Blockquote
{
“config” : {
“dynamic” : {
“filtered_alias_mode” : “warn”,
“disable_rest_auth” : false,
“disable_intertransport_auth” : false,
“respect_request_indices_options” : false,
“kibana” : {
“multitenancy_enabled” : true,
“private_tenant_enabled” : true,
“default_tenant” : “”,
“server_username” : “kibanaserver”,
“index” : “.kibana”,
“sign_in_options” : [
“BASIC”
]
},
“http” : {
“anonymous_auth_enabled” : false,
“xff” : {
“enabled” : false,
“internalProxies” : “192\.168\.0\.10|192\.168\.0\.11”,
“remoteIpHeader” : “X-Forwarded-For”
}
},
“authc” : {
“jwt_auth_domain” : {
“http_enabled” : false,
“order” : 0,
“http_authenticator” : {
“challenge” : false,
“type” : “jwt”,
“config” : {
“signing_key” : “base64 encoded HMAC key or public RSA/ECDSA pem key”,
“jwt_header” : “Authorization”,
“jwt_clock_skew_tolerance_seconds” : 30
}
},
“authentication_backend” : {
“type” : “noop”,
“config” : { }
},
“description” : “Authenticate via Json Web Token”
},
“ldap” : {
“http_enabled” : false,
“order” : 5,
“http_authenticator” : {
“challenge” : false,
“type” : “basic”,
“config” : { }
},
“authentication_backend” : {
“type” : “ldap”,
“config” : {
“enable_ssl” : false,
“enable_start_tls” : false,
“enable_ssl_client_auth” : false,
“verify_hostnames” : true,
“hosts” : [
“localhost:8389”
],
“userbase” : “ou=people,dc=example,dc=com”,
“usersearch” : “(sAMAccountName={0})”
}
},
“description” : “Authenticate via LDAP or Active Directory”
},
“basic_internal_auth_domain” : {
“http_enabled” : true,
“order” : 4,
“http_authenticator” : {
“challenge” : true,
“type” : “basic”,
“config” : { }
},
“authentication_backend” : {
“type” : “intern”,
“config” : { }
},
“description” : “Authenticate via HTTP Basic against internal users database”
},
“proxy_auth_domain” : {
“http_enabled” : false,
“order” : 3,
“http_authenticator” : {
“challenge” : false,
“type” : “proxy”,
“config” : {
“user_header” : “x-proxy-user”,
“roles_header” : “x-proxy-roles”
}
},
“authentication_backend” : {
“type” : “noop”,
“config” : { }
},
“description” : “Authenticate via proxy”
},
“clientcert_auth_domain” : {
“http_enabled” : false,
“order” : 2,
“http_authenticator” : {
“challenge” : false,
“type” : “clientcert”,
“config” : {
“username_attribute” : “cn”
}
},
“authentication_backend” : {
“type” : “noop”,
“config” : { }
},
“description” : “Authenticate via SSL client certificates”
},
“kerberos_auth_domain” : {
“http_enabled” : false,
“order” : 6,
“http_authenticator” : {
“challenge” : true,
“type” : “kerberos”,
“config” : {
“krb_debug” : false,
“strip_realm_from_principal” : true
}
},
“authentication_backend” : {
“type” : “noop”,
“config” : { }
}
}
},
“authz” : {
“roles_from_another_ldap” : {
“http_enabled” : false,
“authorization_backend” : {
“type” : “ldap”,
“config” : { }
},
“description” : “Authorize via another Active Directory”
},
“roles_from_myldap” : {
“http_enabled” : false,
“authorization_backend” : {
“type” : “ldap”,
“config” : {
“enable_ssl” : false,
“enable_start_tls” : false,
“enable_ssl_client_auth” : false,
“verify_hostnames” : true,
“hosts” : [
“localhost:8389”
],
“rolebase” : “ou=groups,dc=example,dc=com”,
“rolesearch” : “(member={0})”,
“userrolename” : “disabled”,
“rolename” : “cn”,
“resolve_nested_roles” : true,
“userbase” : “ou=people,dc=example,dc=com”,
“usersearch” : “(uid={0})”
}
},
“description” : “Authorize via LDAP or Active Directory”
}
},
“auth_failure_listeners” : { },
“do_not_fail_on_forbidden” : false,
“multi_rolespan_enabled” : true,
“hosts_resolver_mode” : “ip-only”,
“do_not_fail_on_forbidden_empty” : false,
“on_behalf_of” : {
“enabled” : false
}
}
}
Hi @koby058,
You will need to run securityadmin.sh to load the updated config files into the index.
Here is how to do so and more: Applying changes to configuration files - OpenSearch Documentation
let me know if you get stuck and need help with it.
Best,
mj
Hi @Mantas
Thanks a lot it is now works