Getting 400 error

OpenSearch
1

Hi, we are version 2.7 and from time to time we are getting 400 error after login to okta

image (19)
image (19)1357×154 9.17 KB

2

Hi @taltsafrir,

Would you mind elaborating more, could you share your config.yml?
Are there any error messages in your OpenSearch nodes?

Thanks,
mj

3

image
image752×1268 98.4 KB

no errors in opensearch nodes @Mantas

4

Extracting JWT token from eyJhbGciOiJIUzUxMiJ9.eyJuYmYiOjE3MTQ5ODA2NDAsImV4cCI6MTcxNTA2NzA0MCwic3ViIjoiZGFuaWVsLnZpbm9rdXJvdkBodW1hbnNlY3VyaXR5LmNvbSIsInNhbWxfbmlmIjoidSIsInNhbWxfc2kiOiJPTkVMT0dJTl8yZTE2MTc0Ny1kYmQxLTRjYzUtODU5MC05ZWZmMGZmMjY0ZjUiLCJyb2xlcyI6bnVsbH0.12LsK9DeP-AM2MFAIWEjWpqfjjaovkarF86PvBHjGEUQzBSlWHdJVvMc_eoPGkFKwsmUXScT-7K-z9NlXTAKPw failed

com.amazon.dlic.auth.http.jwt.keybyoidc.BadCredentialsException: The token has expired

5

Hi @taltsafrir,

How are you mapping your SAML user (JWT token) to internal OpenSearch roles?

Usually, you would use a roles_key (see sample below, it’s missing in your config) as a backend role mapped to an internal OpenSearch role, however, your role is null (see below).

config.dynamic.authc.saml_auth_domain.http_authenticator.config.roles_key: roles

image

Best,
mj