OK, per my last message, I think I’ve found an error in the OS docs. Per Multi-tenancy configuration, the description for config.dynamic.kibana.server_username is:
Must match the name of the OpenSearch Dashboards server user from opensearch_dashboards.yml. Default is kibanaserver.
First of all, this is a bit ambiguous since there are several potential “user names” from that file, e.g. server.name, server.host, and opensearch.username … none of which, it should be noted, default to kibanaserver in that file.
Second, the advice is wrong; I tried providing the identical name (assuming the intent was server.name) between these two files/attributes (e.g. “ACME test dashboard”), and the errors from above persisted.
However… I guessed that, because we were dealing with SSL-based authentication/authorization, the “server name” was tied to the certificate subject being presented to the data node(s). And it seems my hunch was correct. (When I did so, the errors were finally extinguished.)
So, putting it all together…
config.yaml
...
config:
dynamic:
kibana:
multitenancy_enabled: true
private_tenant_enabled: true
default_tenant: global_tenant
server_username: "test-dashboard-1.acme.com" # the dashboard cert's CN
authc:
...
clientcert_auth_domain:
description: "SSL auth with client certificates"
http_enabled: true
transport_enabled: true
http_authenticator:
type: "clientcert"
config:
username_attribute: cn # (Not the full DN)
authentication_backend:
type: "noop"
opensearch-dashboards.yml
...
server.name: "test-dashboard-1.acme.com" # although this likely does not matter and can be any arbitrary value (used for display purposes, per the docs)
...
opensearch_security:
multitenancy:
enabled: true
tenants:
enable_global: true
enable_private: true
preferred: ["Private", "Global"]
enable_filter: true
readonly_mode.roles: ["kibana_read_only"]
cookie.secure: true
allow_client_certificates: true
...
# Secure traffic between dashboard and data nodes
opensearch.ssl:
alwaysPresentCertificate: true
certificate: "/usr/share/opensearch-dashboards/config/certificates/os-node.pem" #where the dashboard "user name" will be read from
key: "/usr/share/opensearch-dashboards/config/certificates/os-node.key"
certificateAuthorities: ["/usr/share/opensearch-dashboards/config/certificates/ca.pem"]
verificationMode: "certificate"
roles_mapping.yml
Note that we list both the CN and the full DN as users below; I believe only the CN is required, however when I assemble the certificate, it includes both in the subject-alternative names (SANs), and the full DN is spit out when asking for the cert subject (e.g. openssl x509 -noout -subject -in os-node.pem).
...
kibana_server:
reserved: true
backend_roles:
- "all_access"
- "readall_and_monitor"
- "kibana_user"
- "kibanauser"
users:
- "kibanaserver"
- "test-dashboard-1.acme.com" # the same CN
- "CN=test-dashboard-1.acme.com,OU=FOO,O=ACME,ST=MD,C=US" # the full DN, per above (unsure if necessary?)
...
Thanks again, @Mantas. I hope this ends up helping someone else in the future…