Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch version: 2.31.0
Describe the issue:
when I am using custom security config, getting the error
Authentication finally failed for null
Configuration:
here’s my values.yaml:
image:
repository: "opensearchproject/opensearch"
imagePullSecrets:
- name: redacted
replicas: 2
persistence:
enabled: false
config:
opensearch.yml: |
plugins:
security:
allow_default_init_securityindex: true
allow_unsafe_democertificates: true
authcz:
admin_dn:
- 'CN=root.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
- 'CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
nodes_dn:
- 'CN=node1.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
ssl:
transport:
pemcert_filepath: node1-secret
pemkey_filepath: node1-key
pemtrustedcas_filepath: root-secret
enforce_hostname_verification: false
http:
enabled: true
pemcert_filepath: node1-secret
pemkey_filepath: node1-key
pemtrustedcas_filepath: root-secret
audit.type: internal_opensearch
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
extraEnvs:
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: "password"
- name: DISABLE_INSTALL_DEMO_CONFIG
value: 'true'
- name: DISABLE_PERFORMANCE_ANALYZER_AGENT_CLI
value: 'true'
secretMounts:
- name: root-secret
secretName: node-secret
path: /usr/share/opensearch/config/root-secret
subPath: ca.crt
- name: node1-secret
secretName: node-secret
path: /usr/share/opensearch/config/node1-secret
subPath: tls.crt
- name: node-key
secretName: node-secret
path: /usr/share/opensearch/config/node1-key
subPath: tls.key
plugins:
enabled: true
installList:
- repository-s3
securityConfig:
enabled: true
path: "/usr/share/opensearch/config/opensearch-security"
actionGroupsSecret:
configSecret:
internalUsersSecret:
rolesSecret:
rolesMappingSecret:
tenantsSecret:
config:
securityConfigSecret: ""
dataComplete: true
data:
config.yml: |-
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
remoteIpHeader: 'x-forwarded-for'
authc:
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic"
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: "basic"
challenge: false
authentication_backend:
type: "internal"
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
openid_connect_idp:
enable_ssl: true
verify_hostnames: true
pemtrustedcas_filepath: "/usr/share/opensearch/config/root-secret"
subject_key: preferred_username
roles_key: roles
openid_connect_url: "https://keycloak-url/auth/realms/dedicated/.well-known/openid-configuration"
authentication_backend:
type: noop
internal_users.yml: |-
---
# This is the internal user database
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
_meta:
type: "internalusers"
config_version: 2
# Define your internal users here
roles.yml: |-
---
_meta:
type: "roles"
config_version: 2
roles_mapping.yml: |-
---
# In this file users, backendroles and hosts can be mapped to Security roles.
# Permissions for OpenSearch roles are configured in roles.yml
_meta:
type: "rolesmapping"
config_version: 2
# Define your roles mapping here
## Demo roles mapping
all_access:
reserved: false
backend_roles:
- "admin"
description: "Maps admin to all_access"
own_index:
reserved: false
users:
- "*"
description: "Allow full access to an index named like the username"
logstash:
reserved: false
backend_roles:
- "logstash"
kibana_user:
reserved: false
backend_roles:
- "kibanauser"
description: "Maps kibanauser to kibana_user"
readall:
reserved: false
backend_roles:
- "readall"
manage_snapshots:
reserved: false
backend_roles:
- "snapshotrestore"
kibana_server:
reserved: true
users:
- "kibanaserver"
action_groups.yml: |-
_meta:
type: "actiongroups"
config_version: 2
tenants.yml: |-
---
_meta:
type: "tenants"
config_version: 2
# Define your tenants here
## Demo tenants
admin_tenant:
reserved: false
description: "Demo tenant for admin user"
ingress:
enabled: true
ingressClassName: nginx
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-ssl-verify: "on"
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
hosts:
- engine.url
path: /
tls:
- secretName: tls
hosts:
- engine.url
Note: the cert used is self-signed certs generated following documentation:
If I disable the securityConfig, then it is working with admin username and password but enabling it fails.
also output of command
curl -XGET https://localhost:9200 -u 'admin:admin' --insecure
Authentication finally failed
Relevant Logs or Screenshots: