Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Describe the issue:
I would like to have opensearch configured such as user can either login (via ldap) and do what ever they need to based on their roles or have an anonymous user with RO access.
i know that the 2 things can be done separetly (we use ldap today) and i’ve seen (but never understood how to configure) the anonymous user with
The reason for the anonymous use is iframe embedding of some dashboards…
with Elastic the configuration was straight forward but with opensearch i am struggling to understand how that would be done…
i hope that’s actually possible with the help if the multiple-authentication options feature just added
if anyone could help me, i would be extremelly grateful, below is a screenshot from elasticsearch
Relevant Logs or Screenshots:
Multiple Authentication Option feature for OpenSearch Dashboards can also enable anonymous login along with Basic authentication and OIDC. Configuration Steps:
instructions to enable multiple authentication for basic and OIDC Enable Anonymous login:
Thanks for the feedback… OIDC ? if you mean openid, then with what am i supposed to connect it to? we have no connection to openid providers
we are using LDAP
Authentication type: openid defined by OpenSearch Dashboards is based on OpenID Connect (OIDC) protocol. If I did not misunderstood, you configure LDAP as your authentication backend for basic authentication. If that is true, you do not need to enable multiple authentication. You can follow the steps in below:
instructions to enable basic auth with LDAP as authentication backend Enable Anonymous login:
Thank you for your reply. i think that in config.yml you meant to say:
This is my configuration
The problem i see is that if i land on the dashboard page i get automatically logged in as “opendistro_security_anonymous” and there is no button “log in as anonymous”.
to login with username and password i must first log out from anonymous, then enter my credentials
That is the expected behavior for anonymous login for now. If you have any feedbacks on the existing authentication experience, please feel free to leave your feedbacks on:
OpenSearch Dashboards Repo
Looking forward to your feedback!
In your screenshot you have “login as anonymous”. How did you achieve that?
This is exactly what I am after
@anubisg1, I was wondering if you were able to reach this phase of logging in as anonymous. I am not able to do that even though I followed the documentation and applied exactly the changes in config.yml and opensearch_dashboards.yml. Your help is much appreciated
Yes, it’s basically a mess. Assuming your configuration is ok, you have to click on the blue login button by leaving username and password blank.
For me it’s a terrible design choice as “login as anonymous” should be there as a button always, regardless of how many authentication are enables
@anubisg1 @MelissaL Just a small clarification in terms of the “Log in as anonymous”
I did some testing and this button appeared and worked for me in two scenarios.
First, when config.yml has anonymous auth enabled and opensearch_dashboards has multiple_auth_enabled with basicauth and openid.
Second, when config.yml has anonymous auth enabled and opensearch_dashboards has multiple_auth_enabled with basicauth and saml.
If you have the auth type set to only basicauth, then “Log in as anonymous” won’t appear and you will be automatically logged in as an anonymous user.
Thank you so much
@pablo I am able to see Log in as anonymous.
But whenever I try to log in as anonymous, it gives me unauthorized. Did do you add any additional configuration? How were you able to log in as anonymous?
@MelissaL Take a look at this post.
@Paladox I had to dig in my notes. In OpenSearch, anonymous authentication is not configured in opensearch.yml
Please follow the steps below.
Set “anonymous_auth_enabled” to true in config.yml
Add the below line to opensearch_dashboards.yml
In roles.yml set the following role. (The permissions are just an example.)
I’ve followed exactly the same configurations:
Set “anonymous_auth_enabled” to true in
Add this line in opensearch_dashboards.yml:
opensearch_security.auth.anonymous_auth_enabled: true Add this in roles.yml:
Add this in roles_mapping.yml:
Am I missing something here? Because I am still not able to login via anonymous.
I tried to login with an empty username and an empty password but it gives me 401 unauthorized
@MelissaL Could you share your config.yml and opensearch_dashboards.yml files?
This is the opensearch-dashboard configuration:
This is config.yml:
@MelissaL Could you share the output of the following command?
curl --insecure https://<OpenSearch_FQDN_or_IP>:9200/_plugins/_security/authinfo?pretty
@MelissaL What about this one?
curl --insecure -u admin:<password> https://<OpenSearch_FQDN_or_IP>:9200/_plugins/_security/api/securityconfig?pretty
@MelissaL What is your OpenSearch version?
Also, how do you apply the configuration to the cluster? Are you running OpenSearch as a service, docker or pod?
@MelissaL I was able reproduce the “Unauthorized” error only when config.dynamic.http.anonymous_auth_domain was set to false.
The last API should tell you if it is enabled inside the cluster. If you have the OpenSearch as a service then restarting the service won’t update the configuration. Also, it won’t update the config if you use the docker and you just restart it.
Once the security index is created the only way to update it is securityadmin.sh script.