# Getting Unauthorized access error 401 using openid with idp as azure

**URL:** <https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564>\
**Category:** Security\
**Tags:** troubleshoot, configure, security-issue\
**Created:** [June 6, 2023, 5:28am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564 "2023-06-06T05:28:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mouryasatyam](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mouryasatyam](https://forum.opensearch.org/u/mouryasatyam)\
**Post date:** [June 6, 2023, 5:28am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/1 "2023-06-06T05:28:20Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch: 2.7.0

**Describe the issue** :  
I have configure and applied all the below config files but still getting unauthorized access even though I have mapped user with the backend role available in opensearch

**Configuration** :  
opensearch\_dashboard.yml

```auto
server:
  name: dashboards
  host: 0.0.0.0

  # Dashboards TLS Config (Ensure the cert files are present before enabling SSL
  ssl:
    enabled: false
    # key: /usr/share/opensearch-dashboards/certs/dashboards-key.pem
    # certificate: /usr/share/opensearch-dashboards/certs/dashboards-crt.pem

  # determines how dashboards will verify certificates (needs to be none for default opensearch certificates to work)
opensearch:
  ssl:
    verificationMode: certificate
    certificateAuthorities: /usr/share/opensearch-dashboards/config/root-ca.pem
  requestHeadersAllowlist:
    - Authorization
    - securitytenant
opensearch_security:
  multitenancy:
    enabled: true
    tenants:
      preferred:
        - Private
        - Global
  cookie:
    secure: false
  auth:
    multiple_auth_enabled: true
    type:
      - openid
      - basicauth
  openid:
    connect_url: "https://login.microsoftonline.com/<tenant ID>/v2.0/.well-known/openid-configuration"
    client_id: "<Client Id>"
    client_secret: "<client Secret>"
    base_redirect_url: "http://localhost:5601"
logging: 
    verbose: true

```

opensearch.yml

```auto
_meta:
  type: "config"
  config_version: 2
config:
  dynamic:
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: "192\\.168\\.0\\.10|192\\.168\\.0\\.11"
        remoteIpHeader: "x-forwarded-for"
    authc:
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "internal"
      openid_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "openid"
          challenge: false
          config:
            openid_connect_idp:
              enable_ssl: true
              verify_hostnames: false
              subject_key: "email"
              roles_key: "roles"
            openid_connect_url: "https://login.microsoftonline.com/<tenantID>/v2.0/.well-known/openid-configuration"
        authentication_backend:
          type: "noop"

```

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/6/6846386615f80ca9c1b9d499589c207b3baf87d2.png)

APP Roles to map backend role admin

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/dca33d8b7ce40bf05ba83b05cc63cbb2b250b5a1.png)

No relevant logs

---

<div class="post-metadata">

**Author:** ![mouryasatyam](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mouryasatyam](https://forum.opensearch.org/u/mouryasatyam)\
**Post date:** [June 6, 2023, 5:37am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/2 "2023-06-06T05:37:48Z")

</div>

Can someone help with this!!  
Tagging you as found most active one @pablo @wbeckler @Gsmitt

---

<div class="post-metadata">

**Author:** ![mouryasatyam](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mouryasatyam](https://forum.opensearch.org/u/mouryasatyam)\
**Post date:** [June 6, 2023, 10:54am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/3 "2023-06-06T10:54:30Z")

</div>

I have used [https://opensearch.org/docs/latest/troubleshoot/openid-connect/](https://opensearch.org/docs/latest/troubleshoot/openid-connect/) and found that subject\_key email was not present in token so replaced it with preferred\_username!!

Logs that I got for above issue

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/e/e1aaada2f7fb337de221f1be2028cc5c3199cee1.png)

---

<div class="post-metadata">

**Author:** ![Gsmitt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gsmitt/32/1718_2.png) [@Gsmitt](https://forum.opensearch.org/u/Gsmitt)\
**Post date:** [June 6, 2023, 9:02pm UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/4 "2023-06-06T21:02:15Z")

</div>

Hey @mouryasatyam

What type of installation is this?

---

<div class="post-metadata">

**Author:** ![mouryasatyam](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mouryasatyam](https://forum.opensearch.org/u/mouryasatyam)\
**Post date:** [June 7, 2023, 2:53am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/5 "2023-06-07T02:53:33Z")

</div>

@Gsmitt I used Helm to install opensearch and opensearch dashboard into k8s cluster and then changed the config for opensearch and applied using securityadmin script…  
But the issue is resolved for me thankyou!!

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [June 20, 2023, 11:01am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/6 "2023-06-20T11:01:27Z")

</div>

@mouryasatyam Did you assign the App role to the Azure user in the Enterprise Applications in Azure?

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/2854798539b87d0c01d42176530d44077787f3ce.png)

---

<div class="post-metadata">

**Author:** ![mouryasatyam](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mouryasatyam](https://forum.opensearch.org/u/mouryasatyam)\
**Post date:** [June 21, 2023, 5:50am UTC](https://forum.opensearch.org/t/getting-unauthorized-access-error-401-using-openid-with-idp-as-azure/14564/7 "2023-06-21T05:50:17Z")

</div>

yeah I had assigned the role problem, the problem was related to the field exposed by token I was expecting something but it was not there in it. Increased the log level helped in find out this