# Infinite loop with Authentik OpenID Connect

**URL:** <https://forum.opensearch.org/t/infinite-loop-with-authentik-openid-connect/18601>\
**Category:** OpenSearch Dashboards\
**Created:** [March 27, 2024, 10:36pm UTC](https://forum.opensearch.org/t/infinite-loop-with-authentik-openid-connect/18601 "2024-03-27T22:36:37Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![mmorg](https://avatars.discourse-cdn.com/v4/letter/m/b19c9b/32.png) [@mmorg](https://forum.opensearch.org/u/mmorg)\
**Post date:** [March 28, 2024, 4:34am UTC](https://forum.opensearch.org/t/infinite-loop-with-authentik-openid-connect/18601/3 "2024-03-28T04:34:56Z")

</div>

> [@Gsmitt](#):
>
> Out of curiosity where did you find these settings for OpenSearch-dashboard file?
> 
> > [@mmorg](#):
> >
> > ```auto
> > openid:
> > connect_url: "https://auth.my-domain.com/application/o/opensearch/.well-known/openid-configuration"
> > client_id: "SNIP"
> > client_secret: "SNIP"
> > scope: "openid profile email"
> > logout_url: "https://auth.my-domain.com/application/o/opensearch/end-session/"
> > base_redirect_url: "https://opensearch.my-domain.com"
> > verify_hostnames: false
> > 
> > ```

That would be in the config section for the Dashboard: [OpenID Connect - OpenSearch Documentation](https://opensearch.org/docs/latest/security/authentication-backends/openid-connect/#configuration-settings)

> [@Gsmitt](#):
>
> Normally these setting are only made in the security configuration file.
> 
> > [@mmorg](#):
> >
> > /usr/share/opensearch/config/security/config.yml

Those options don’t seem to be available in that config file: [OpenID Connect - OpenSearch Documentation](https://opensearch.org/docs/latest/security/authentication-backends/openid-connect/#configure-openid-connect-integration)

> [@Gsmitt](#):
>
> Then you run…
> 
> ```auto
> ./securityadmin.sh
> 
> ```

So I found a few mistakes I had made. I fixed those and ran that command a bunch of times, now I’m getting a 401, which is a step at least.

```json
{"statusCode":401,"error":"Unauthorized","message":"Unauthorized"}

```

Updates:

**API**

Wrong directory

`/usr/share/opensearch/config/security/internal_users.yml` =\> `/usr/share/opensearch/config/opensearch-security/internal_users.yml`

Wrong directory and missing keys, the YML [here](https://opensearch.org/docs/latest/security/authentication-backends/openid-connect/#configure-openid-connect-integration) threw my off because it doesn’t contain the `config.dynamic.authc` keys.

`/usr/share/opensearch/config/security/config.yml` =\> `/usr/share/opensearch/config/opensearch-security/config.yml`

```yml
_meta:
  type: "config"
  config_version: 2

# these keys are needed
config:
  dynamic:
    authc:
      basic_internal_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: internal
      openid_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: openid
          challenge: false
          config:
            subject_key: preferred_username
            openid_connect_idp:
              enable_ssl: true
              verify_hostnames: false
              # this is the last thing I tried, but it didn't work
              pemtrustedcas_filepath: /usr/share/opensearch/config/certificates/authentik.pem
            roles_key: roles
            openid_connect_url: https://auth.my-domain.com/application/o/opensearch/.well-known/openid-configuration
        authentication_backend:
          type: noop

```

**Docker Compose**

Fixed wrong paths and added every single certificate I could think of

```yml
services:
  opensearch-api:
    image: opensearchproject/opensearch:2.12.0
    environment:
      - "bootstrap.memory_lock=true"
      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
      - "DISABLE_INSTALL_DEMO_CONFIG=true"
      - "TZ=Europe/Amsterdam"
    volumes:
      - data:/usr/share/opensearch/data
      - ./opensearch.yml:/usr/share/opensearch/config/opensearch.yml
      ## certs
      - ./certs/authentik.pem:/usr/share/opensearch/config/authentik.pem
      - ./certs/root-ca.pem:/usr/share/opensearch/config/root-ca.pem
      - ./certs/admin.pem:/usr/share/opensearch/config/admin.pem
      - ./certs/admin-key.pem:/usr/share/opensearch/config/admin-key.pem
      - ./certs/node.pem:/usr/share/opensearch/config/node.pem
      - ./certs/node-key.pem:/usr/share/opensearch/config/node-key.pem
      ## security
      - ./opensearch_security_config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
      - ./opensearch_security_internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml

  opensearch-dashboard:
    image: opensearchproject/opensearch-dashboards:2.12.0
    environment:
      - "TZ=Europe/Amsterdam"
    volumes:
      - ./opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
      - ./certs/root-ca.pem:/usr/share/opensearch-dashboards/config/root-ca.pem

```

`/usr/share/opensearch/config/opensearch.yml`

```yml
network:
  host: 0.0.0.0

discovery:
  type: single-node

plugins:
  security:
    authcz:
      # needed to be a list
      admin_dn:
        - "CN=admin,OU=SSL,O=Test,L=Test,C=NL"
    nodes_dn:
      - "CN=node,OU=SSL,O=Test,L=Test,C=NL"
    enable_snapshot_restore_privilege: true
    check_snapshot_restore_write_privileges: true
    audit:
      type: internal_opensearch
    restapi:
      # added probably not needed
      roles_enabled:
        ["all_access", "admin", "kibanauser", "security_rest_api_access"]
    ssl:
      transport:
        enabled: true
        pemcert_filepath: admin.pem
        pemkey_filepath: admin-key.pem
        pemtrustedcas_filepath: root-ca.pem
        enforce_hostname_verification: false
        resolve_hostname: false
      # enabled this and generated certs for it with the guide on the website
      http:
        enabled: true
        pemcert_filepath: node.pem
        pemkey_filepath: node-key.pem
        pemtrustedcas_filepath: root-ca.pem

opendistro_security:
  audit:
    config:
      disabled_rest_categories: NONE
      disabled_transport_categories: NONE

```

`/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml`

```yml
server:
  host: "0.0.0.0"
  name: "opensearch.my-domain.com"

opensearch_security:
  auth:
    type: "openid"
  openid:
    connect_url: "https://auth.my-domain.com/application/o/opensearch/.well-known/openid-configuration"
    client_id: "SNIP"
    client_secret: "SNAP"
    # added roles here and added a property mapping in authentik, added admin role to my user
    scope: "openid profile email roles"
    logout_url: "https://auth.my-domain.com/application/o/opensearch/end-session/"
    base_redirect_url: "https://opensearch.my-domain.com"
    # verify_hostnames: false

opensearch:
  hosts:
    - "https://opensearch-api:9200"
  ssl:
    # added ssl root ca for opensearch https connection
    verificationMode: certificate
    certificateAuthorities:
      - "/usr/share/opensearch-dashboards/config/root-ca.pem"
  username: "kibanaserver"
  password: "SNOOP"

```

With all this I’m stuck with a 401 error message when trying to login with Authentik OIDC. Basic auth works to get to the OpenSearch api with the kibanaserver username and password.

Last thing I did: I thought it had to do with the certificate of my IDP. It was using a letsencrypt signed certificate. I changed that to a self signed certificate, and added the cert to the opensearch container and in `/usr/share/opensearch/config/opensearch-security/config.yml`. Then ran:

```sh
bash plugins/opensearch-security/tools/securityadmin.sh -cd config/opensearch-security -icl -nhnv -cacert config/root-ca.pem -cert config/admin.pem -key config/admin-key.pem -h localhost

```

But still getting 401 unfortunately. Feel like I’m close but missing something

---

_[View the full topic](https://forum.opensearch.org/t/infinite-loop-with-authentik-openid-connect/18601)._