Error while configuring JWT Authentication

Security
,
1

Moved from GitHub issue #2872

I am trying to configure JWT Authentication for my Opensearch docker container which is on V2.7.0

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Config file updated as follows:
jwt_auth_domain:
  http_enabled: true
  transport_enabled: true
  order: 0
  http_authenticator:
    type: jwt
    challenge: false
    config:
      signing_key: "VGhpc0lzQVRlc3ROYXRUb0JlVXNlZEFudGh3YXJl"
      jwt_header: "Authorization"
      jwt_url_parameter: null
      subject_key: "sub"
      roles_key: "roles"
      jwt_clock_skew_tolerance_seconds: 20
  authentication_backend:
    type: noop

What is the expected behavior?

[opensearch@59901e2344d3 tools]$ ./securityadmin.sh -cd …/securityconfig/ -icl -nhnv -cacert …/…/…/config/root-ca.pem -cert …/…/…/config/kirk.pem -key …/…/…/config/kirk-key.pem

Security Admin v7
Will connect to localhost:9200 … done
Connected as “CN=kirk,OU=client,O=client,L=test,C=de”
OpenSearch Version: 2.7.0
Contacting opensearch cluster ‘opensearch’ and wait for YELLOW clusterstate …
Clustername: opensearch-cluster
Clusterstate: YELLOW
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Populate config from /usr/share/opensearch/plugins/opensearch-security/securityconfig
ERR: Seems …/securityconfig/config.yml is not in OpenSearch Security 7 format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field “http_enabled” (class org.opensearch.security.securityconf.impl.v7.ConfigV7), not marked as ignorable (one known property: “dynamic”])
at [Source: (String)“{”_meta":{“type”:“config”,“config_version”:2},“config”:{“dynamic”:{“http”:{“anonymous_auth_enabled”:false,“xff”:{“enabled”:false,“internalProxies”:“192.168.0.10|192.168.0.11”}},“authc”:null}},“jwt_auth_domain”:{“http_enabled”:true,“transport_enabled”:true,“order”:0,“http_authenticator”:{“type”:“jwt”,“challenge”:false,“config”:{“signing_key”:“VGhpc0lzQVRlc3ROYXRUb0JlVXNlZEFudGh3YXJl”,“jwt_header”:“Authorization”,“jwt_url_parameter”:null,“subject_key”:“sub”,“roles_key”:“roles”,“jwt_clo”[truncated 816 chars]; line: 1, column: 243] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration[“jwt_auth_domain”]->org.opensearch.security.securityconf.impl.v7.ConfigV7[“http_enabled”])
ERR: Seems …/securityconfig/roles.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/roles.yml (No such file or directory)
ERR: Seems …/securityconfig/roles_mapping.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/roles_mapping.yml (No such file or directory)
ERR: Seems …/securityconfig/internal_users.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/internal_users.yml (No such file or directory)
ERR: Seems …/securityconfig/action_groups.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/action_groups.yml (No such file or directory)
ERR: Seems …/securityconfig/tenants.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/tenants.yml (No such file or directory)
ERR: Seems …/securityconfig/nodes_dn.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/nodes_dn.yml (No such file or directory)
ERR: Seems …/securityconfig/whitelist.yml is not in OpenSearch Security 7 format: java.io.FileNotFoundException: …/securityconfig/whitelist.yml (No such file or directory)

What is your host/environment?

  • OS: Ubuntu 20.04.5 LTS
  • Version 20.04.5
  • Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

2

To the original issue’s author, gvsrini:

Could you please attach your complete config.yml here (redacted for privacy if needed of course)? It seems like there might be some sort of miss in where fields are and where they are expected.

3

At the link below, you can find an example of config.yml file: