Hello Everyone,
We want to iframe Opensearch Dashboards in website. However, it is redirecting to the login page. I have enabled anonumous_auth to bypass the Login Page for Opensearch Dashboards and display the dashboards directly. However, it didn’t work after making changes in the config.
Hence, I have enabled JWT authentication for Opensearch to pass the authorization in the URL . I am able to access the Opensearch Dashboard successfully, which bypasses the login page and redirects to the home page.
However, I am seeing error related to roles and not able to access some of the features in Opensearch Dashboard.
I’m trying to autenticate to OpenSearch using a JWT token and I keep getting the following error:
[security_exception] no permissions for [cluster:admin/opendistro/ism/policy/search] and User [name=opendistro_security_anonymous, backend_roles=[opendistro_security_anonymous_backendrole], requestedTenant=null]
Here are the config files:
1. Opensearch.yml
network.host: 0.0.0.0
discovery.type: single-node
#action.destructive_requires_name: true
plugins.security.disabled: false
######## Start OpenSearch Security Demo Configuration ########
# WARNING: revise all the lines below before you go into production
plugins.security.ssl.transport.pemcert_filepath: /home/aiml/opensearch-2.3.0/config/node1-2.pem
plugins.security.ssl.transport.pemkey_filepath: /home/aiml/opensearch-2.3.0/config/node1-key-2.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /home/aiml/opensearch-2.3.0/config/root-ca-2.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /home/aiml/opensearch-2.3.0/config/node1-2.pem
plugins.security.ssl.http.pemkey_filepath: /home/aiml/opensearch-2.3.0/config/node1-key-2.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /home/aiml/opensearch-2.3.0/config/root-ca-2.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
- 'EMAILADDRESS=AA,CN=BB,OU=ZZ,O=XX,L=YY,ST=CC,C=LL'
plugins.security.nodes_dn:
- 'EMAILADDRESS=AA,CN=BB,OU=ZZ,O=XX,L=YY,ST=CC,C=LL'
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
node.max_local_storage_nodes: 3
######## End OpenSearch Security Demo Configuration ########
- Config.yml
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: true
xff:
enabled: false
internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
#internalProxies: '.*' # trust all internal proxies, regex pattern
#remoteIpHeader: 'x-forwarded-for'
###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
###### and here https://tools.ietf.org/html/rfc7239
###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
authc:
kerberos_auth_domain:
http_enabled: false
transport_enabled: false
order: 6
http_authenticator:
type: kerberos
challenge: true
config:
# If true a lot of kerberos/security related debugging output will be logged to standard out
krb_debug: false
# If true then the realm will be stripped from the user name
strip_realm_from_principal: true
authentication_backend:
type: noop
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 4
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: intern
proxy_auth_domain:
description: "Authenticate via proxy"
http_enabled: false
transport_enabled: false
order: 3
http_authenticator:
type: proxy
challenge: false
config:
user_header: "x-proxy-user"
roles_header: "x-proxy-roles"
authentication_backend:
type: noop
jwt_auth_domain:
description: "Authenticate via Json Web Token"
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: "kUPSF3ZLfr5wk/52hfubABCPENsGUAmPQRZEERFNDL2="
jwt_header: "Authorization"
jwt_url_parameter: "jwtToken"
roles_key: "roles"
subject_key: "sub"
authentication_backend:
type: noop
- Opensearch_Dashboard.yml
server.ssl.enabled: true
server.ssl.certificate: /home/aiml/opensearch-2.3.0/config/node1-2.pem
server.ssl.key: /home/aiml/opensearch-2.3.0/config/node1-key-2.pem
opensearch.ssl.certificateAuthorities: [ "/home/aiml/opensearch-2.3.0/config/root-ca-2.pem" ]
opensearch.ssl.verificationMode: certificate
opensearchDashboards.defaultAppId: "home"
opensearch.hosts: [https://0.0.0.0:9200]
opensearch.username: "admin"
opensearch.password: "admin"
opensearch_security.auth.anonymous_auth_enabled: true
opensearch.requestHeadersAllowlist: [authorization, securitytenant, Authorization]
opensearch_security.auth.type: "jwt"
opensearch_security.jwt.url_param: "jwtToken"
opensearch_security.jwt.enabled: true
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: true
How to map the existing opendistro_security_anonymous_backendrole to admin? Attached are the roles.yml and roles_mapping.yml files
Kindly suggest how to take this forward and change the role to admin.
@Pablo Please help
