# Can JWT and OIDC authentication be used simultaneously with OpenSearch Dashboards?

**URL:** <https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268>\
**Category:** OpenSearch Dashboards\
**Tags:** discuss\
**Created:** [September 2, 2026, 7:16am UTC](https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268 "2026-09-02T07:16:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shubtiwa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/shubtiwa/32/3221_2.png) [@shubtiwa](https://forum.opensearch.org/u/shubtiwa)\
**Post date:** [September 2, 2026, 7:16am UTC](https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268/1 "2026-09-02T07:16:22Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.19

**Describe the issue:**

Hi,

I currently have **JWT authentication working with OpenSearch Dashboards** , and **OIDC authentication is also working independently**.

I want to enable both authentication methods simultaneously in OpenSearch Dashboards.

According to the [OpenSearch 2.19 documentation](https://docs.opensearch.org/2.19/security/configuration/multi-auth/#enabling-multiple-authentication-options), Dashboards currently supports a combination of **Basic Authentication, OpenID Connect, and SAML** for multiple authentication options:

> “As a reminder, Dashboards currently supports a combination of basic authentication, OpenID Connect, and SAML as a valid set of values.”

Does this mean the following configuration is **not supported/invalid**?

```auto
opensearch_security.auth.type: ["jwt", "openid"]
opensearch_security.auth.multiple_auth_enabled: true

```

If JWT + OIDC is not supported natively in Dashboards, what is the recommended approach for this use case?

Thanks!

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 3, 2026, 12:43am UTC](https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268/2 "2026-09-03T00:43:48Z")

</div>

@shubtiwa Have you tried using

```auto
opensearch_security.auth.type: ["basicauth","jwt", "openid"]
opensearch_security.auth.multiple_auth_enabled: true

```

According to the OpenSearch documentation, both of the configurations below are supported.

```auto
opensearch_security.auth.type: ["basicauth","jwt"]

```

```auto
opensearch_security.auth.type: ["basicauth","openid"]

```

> **[OpenSearch Dashboards configuration - JSON Web Token authentication](https://docs.opensearch.org/latest/security/authentication-backends/jwt/#opensearch-dashboards-configuration-1)**
>
> JSON Web Tokens (JWTs) are JSON-based access tokens that assert one or more claims. They are commonly used to implement single sign-on (SSO) solutions and fall in the category of token-based authentication systems. The basic information-transmission...

---

<div class="post-metadata">

**Author:** ![shubtiwa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/shubtiwa/32/3221_2.png) [@shubtiwa](https://forum.opensearch.org/u/shubtiwa)\
**Post date:** [September 8, 2026, 10:56am UTC](https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268/3 "2026-09-08T10:56:44Z")

</div>

Hi @pablo , sorry for late reply!

I’ve already tested the following combinations, and both worked as expected:

> opensearch\_security.auth.type: [“basicauth”, “jwt”]

> opensearch\_security.auth.type: [“basicauth”, “openid”]

However, the following combination did not work when I tried it:

> opensearch\_security.auth.type: [“jwt”, “openid”] opensearch\_security.auth.multiple\_auth\_enabled: true

I also went through the documentation, but I couldn’t find `["jwt", "openid"]` listed as a valid combination.

So, I just wanted to confirm whether this combination is actually supported and expected to work.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 14, 2026, 11:56pm UTC](https://forum.opensearch.org/t/can-jwt-and-oidc-authentication-be-used-simultaneously-with-opensearch-dashboards/28268/4 "2026-09-14T23:56:29Z")

</div>

> [@shubtiwa](#):
>
> However, the following combination did not work when I tried it:
> 
> > opensearch\_security.auth.type: [“jwt”, “openid”] opensearch\_security.auth.multiple\_auth\_enabled: true
> 
> I also went through the documentation, but I couldn’t find `["jwt", "openid"]` listed as a valid combination.

This configuration won’t work. As per my previous comment, try the following instead.

```auto
opensearch_security.auth.type: ["basicauth","jwt","openid"]
opensearch_security.auth.multiple_auth_enabled: true

```

`basicauth` is mandatory.  
I’ve also done some testing with 2.19 and I had no issues.