Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch: 2.0.0
Opensearch-dashboard: 2.0.0
Keycloak: 21.1.2
Server: Ubuntu 22.04 x64
Browser: Edge 116.0.1938.54 and Chrome 115.0.5790.66
Describe the issue:
I’m working on a POC to secure dashboards in my Microk8s cluster, including Opensearch Dashboard, using a Keycloak located in the same cluster. I’m using OpenID Connect.
My Opensearch Dashboard is accessible using https://cluster_host/opensearch-dashboards/ and my keycloak server is accessible using https://cluster_host/keycloak/.
I had a first issue because it looks that depending on the phase of the authentication, there is some communication inside the cluster (directly between osd and keycloak) and outside the cluster (with my browser).
To solve this, I modified the CoreDNS configuration to add the line
rewrite name cluster_host keycloak.default.svc.cluster.local
Thanks to this, I’m able to access to the keycloak authentication page but when I log in, I have then a ERR_TOO_MANY_REDIRECT
Can anyone tell me where is my mistake? I was wondering if it could be due to the fix I did for the first issue.
Thanks in advance for your help
Configuration:
opensearch_dashboards.yml:
server.host: '0.0.0.0'
server.basePath: "/opensearch-dashboard"
server.rewriteBasePath: true
opensearch.hosts: ["https://localhost:9200"]
opensearch.username: "kibanaserver"
opensearch.password: "kibanaserver"
opensearch.requestHeadersAllowlist: ["security_tenant","Authorization","x-forwarded-for"]
opensearch.ssl.verificationMode: none
opensearch_security.auth.type: "openid"
opensearch_security.openid.connect_url: http://cluster_host/keycloak/realms/myrealm/.well-known/openid-configuration
opensearch_security.openid.base_redirect_url: https://cluster_host/opensearch-dashboard/
opensearch_security.openid.client_id: opensearch-oauth
opensearch_security.openid.client_secret: "***************"
opensearch_security.openid.verify_hostnames: false
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.enable_global: true
opensearch_security.multitenancy.tenants.enable_private: true
opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
opensearch_security.multitenancy.enable_filter: false
opensearch_security.readonly_mode.roles: [kibana_read_only]
logging.verbose: true
opensearch_security.cookie.secure: false
I added 2 mappers as I read it was necessary:
-
preferred_username with a mapper type “User’s full name” (all Add options enabled)
-
roles with a mapper type “User Realm Role” (all Add options enabled)
Relevant Logs or Screenshots:
When I try to log in, here is the log I see in Opensearch Dashboard logs:
{“type”:“response”,“@timestamp”:“2023-09-05T07:29:03Z”,“tags”:,“pid”:1,“method”:“get”,“statusCode”:302,“req”:{“url”:“/”,“method”:“get”,“headers”:{“host”:“cluster_host”,“x-request-id”:“11601df8a6f6681bb853cf1b16c80636”,“x-real-ip”:“10.169.9.34”,“x-forwarded-for”:“10.169.9.34”,“x-forwarded-host”:“cluster_host”,“x-forwarded-port”:“443”,“x-forwarded-proto”:“https”,“x-forwarded-scheme”:“https”,“x-scheme”:“https”,“sec-ch-ua”:“"Chromium";v="116", "Not)A;Brand";v="24", "Microsoft Edge";v="116"”,“sec-ch-ua-mobile”:“?0”,“sec-ch-ua-platform”:“"Windows"”,“upgrade-insecure-requests”:“1”,“user-agent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.54”,“accept”:“text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7”,“sec-fetch-site”:“none”,“sec-fetch-mode”:“navigate”,“sec-fetch-user”:“?1”,“sec-fetch-dest”:“document”,“accept-encoding”:“gzip, deflate, br”,“accept-language”:“fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6”},“remoteAddress”:“10.1.104.226”,“userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.54”},“res”:{“statusCode”:302,“responseTime”:3,“contentLength”:9},“message”:“GET / 302 3ms - 9.0B”}
{“type”:“response”,“@timestamp”:“2023-09-05T07:29:03Z”,“tags”:,“pid”:1,“method”:“get”,“statusCode”:302,“req”:{“url”:“/auth/openid/login”,“method”:“get”,“headers”:{“host”:“cluster_host”,“x-request-id”:“3de79954d032043bc5a2b23c37f34dcb”,“x-real-ip”:“10.169.9.34”,“x-forwarded-for”:“10.169.9.34”,“x-forwarded-host”:“cluster_host”,“x-forwarded-port”:“443”,“x-forwarded-proto”:“https”,“x-forwarded-scheme”:“https”,“x-scheme”:“https”,“upgrade-insecure-requests”:“1”,“user-agent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.54”,“accept”:“text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7”,“sec-fetch-site”:“none”,“sec-fetch-mode”:“navigate”,“sec-fetch-user”:“?1”,“sec-fetch-dest”:“document”,“sec-ch-ua”:“"Chromium";v="116", "Not)A;Brand";v="24", "Microsoft Edge";v="116"”,“sec-ch-ua-mobile”:“?0”,“sec-ch-ua-platform”:“"Windows"”,“accept-encoding”:“gzip, deflate, br”,“accept-language”:“fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6”},“remoteAddress”:“10.1.104.226”,“userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.54”},“res”:{“statusCode”:302,“responseTime”:1,“contentLength”:9},“message”:“GET /auth/openid/login 302 1ms - 9.0B”}
{“type”:“log”,“@timestamp”:“2023-09-05T07:29:03Z”,“tags”:[“error”,“plugins”,“securityDashboards”],“pid”:1,“message”:“OpenId authentication failed: Error: Authentication Exception”}
