Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch -2.4.0
opensearch-dashboards - 2.4.0
Describe the issue:
401 unauthorised login to opensearch dashboards with both hashicorp vault and keycloak
Configuration:
Opensearch-master
cat /etc/opensearch/opensearch-security/config.yml
basic_internal_auth_domain:
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: internal
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
subject_key: preferred_username
roles_key: roles
openid_connect_url: https://vault.com:8200/v1/sysdev/oidcdemo/identity/oidc/provider/opensearch-oidc-provider/.well-known/openid-configuration
authentication_backend:
type: noop
Opensearch-dashboards:
opensearch.hosts: [“10.x.x.x:8200”]
opensearch.ssl.verificationMode: none
opensearch.username: admin
opensearch.password: admin
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: false
opensearch_security.auth.type: openid
opensearch_security.openid.base_redirect_url: “https://os-dev-dashboard”
opensearch_security.openid.client_id: “6WuoRNBBXm683tWpJBEbMizjI2hZPgop”
opensearch_security.openid.scope: “openid profile email”
opensearch_security.openid.client_secret: “hvo_secret_uRKFMoG1ZzaBVNMKPB6cPkFRpICtZcaz72BmR252PqTcgVYFGrpQr9Ev8LSm8Mdz”
opensearch_security.openid.connect_url: “http://vault.com:8200/v1/sysdev/oidcdemo/identity/oidc/provider/opensearch-oidc-provider/.well-known/openid-configuration”
opensearch_security.openid.verify_hostnames: false
Relevant Logs or Screenshots:
method":“get”,“statusCode”:401,“req”:{“url”:“/auth/openid/login?code=Kbzb5pqhd9e9cuX7MtouwkdoHd9KHh8C&state=1ELFHDJ4UsOSG_cnNvl0oj”,“method”:“get”,“headers”:{“host”:“10.x.x.x:5601”,“connection”:“keep-alive”,“upgrade-insecure-requests”:“1”,“dnt”:“1”,“user-agent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.52”,“accept”:“text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9”,“accept-encoding”:“gzip, deflate”,“accept-language”:“en-IN,en-GB;q=0.9,en;q=0.8,en-US;q=0.7”},“remoteAddress”:“10.194.59.67”,“userAgent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.52”},“res”:{“statusCode”:401,“responseTime”:26,“contentLength”:9},“message”:“GET /auth/openid/login?code=Kbzb5pqhd9e9cuX7MtouwkdoHd9KHh8C&state=1ELFHDJ4UsOSG_cnNvl0oj 401 26ms - 9.0B”}