Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Describe the issue:
I would like to have opensearch configured such as user can either login (via ldap) and do what ever they need to based on their roles or have an anonymous user with RO access.
i know that the 2 things can be done separetly (we use ldap today) and i’ve seen (but never understood how to configure) the anonymous user with
The reason for the anonymous use is iframe embedding of some dashboards…
with Elastic the configuration was straight forward but with opensearch i am struggling to understand how that would be done…
i hope that’s actually possible with the help if the multiple-authentication options feature just added
if anyone could help me, i would be extremelly grateful, below is a screenshot from elasticsearch
Relevant Logs or Screenshots:
November 23, 2022, 5:11pm
Multiple Authentication Option feature for OpenSearch Dashboards can also enable anonymous login along with Basic authentication and OIDC. Configuration Steps:
instructions to enable multiple authentication for basic and OIDC Enable Anonymous login:
Thanks for the feedback… OIDC ? if you mean openid, then with what am i supposed to connect it to? we have no connection to openid providers
we are using LDAP
November 28, 2022, 4:32am
Authentication type: openid defined by OpenSearch Dashboards is based on OpenID Connect (OIDC) protocol. If I did not misunderstood, you configure LDAP as your authentication backend for basic authentication. If that is true, you do not need to enable multiple authentication. You can follow the steps in below:
instructions to enable basic auth with LDAP as authentication backend Enable Anonymous login:
Thank you for your reply. i think that in config.yml you meant to say:
This is my configuration
The problem i see is that if i land on the dashboard page i get automatically logged in as “opendistro_security_anonymous” and there is no button “log in as anonymous”.
to login with username and password i must first log out from anonymous, then enter my credentials
November 29, 2022, 3:56pm
That is the expected behavior for anonymous login for now. If you have any feedbacks on the existing authentication experience, please feel free to leave your feedbacks on:
OpenSearch Dashboards Repo
Looking forward to your feedback!
In your screenshot you have “login as anonymous”. How did you achieve that?
This is exactly what I am after
@anubisg1, I was wondering if you were able to reach this phase of logging in as anonymous. I am not able to do that even though I followed the documentation and applied exactly the changes in config.yml and opensearch_dashboards.yml. Your help is much appreciated
Yes, it’s basically a mess. Assuming your configuration is ok, you have to click on the blue login button by leaving username and password blank.
For me it’s a terrible design choice as “login as anonymous” should be there as a button always, regardless of how many authentication are enables
May 23, 2023, 11:15pm
@anubisg1 @MelissaL Just a small clarification in terms of the “Log in as anonymous”
I did some testing and this button appeared and worked for me in two scenarios.
First, when config.yml has anonymous auth enabled and opensearch_dashboards has multiple_auth_enabled with basicauth and openid.
Second, when config.yml has anonymous auth enabled and opensearch_dashboards has multiple_auth_enabled with basicauth and saml.
If you have the auth type set to only basicauth, then “Log in as anonymous” won’t appear and you will be automatically logged in as an anonymous user.
Thank you so much
@pablo I am able to see Log in as anonymous.
But whenever I try to log in as anonymous, it gives me unauthorized. Did do you add any additional configuration? How were you able to log in as anonymous?
May 31, 2023, 9:13am
@MelissaL Take a look at this post.
@Paladox I had to dig in my notes. In OpenSearch, anonymous authentication is not configured in opensearch.yml
Please follow the steps below.
Set “anonymous_auth_enabled” to true in config.yml
Add the below line to opensearch_dashboards.yml
In roles.yml set the following role. (The permissions are just an example.)