# Integrate Opensearch with Azure AD using OIDC

**URL:** https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800
**Category:** Security
**Tags:** configure
**Created:** [June 1, 2022, 8:04pm UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800 "2022-06-01T20:04:18Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Malone](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/malone/32/3588_2.png) [@Malone](https://forum.opensearch.org/u/Malone)
#### Post date: [June 1, 2022, 8:04pm UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/1 "2022-06-01T20:04:18Z")

</div>

Hello,

I am new to Open Search and I have been trying to set up SSO using OIDC.  
I have 3 node open search cluster (using demo configurations) , 3 node open search dashboard using Open search Helm charts.

Everything works except when i turn on SSO. I have ERR\_TOO\_MANY\_REDIRECTS, The page isn’t redirecting properly errors in Edge and FF respectively.  
My app registration in azure show successful login in sign-on logs.

I know many people have posted this issue here in the forum but I could not find a proper solution.

As steps to debug the issue:

1. The .opendistro\_security index is created when i have spinned up the opensearch cluster , now when i am trying to execute ./securityadmin.sh i have some issues and i do not know how to reslove them pasting the logs here:

```auto
**************************************************************************
 **This tool will be deprecated in the next major release of OpenSearch**
 **https://github.com/opensearch-project/security/issues/1755**
 **************************************************************************
Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=kirk,OU=client,O=client,L=test,C=de"
OpenSearch Version: 2.0.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: opensearch-cluster
Clusterstate: GREEN
Number of nodes: 3
Number of data nodes: 3
.opendistro_security index already exists, so we do not need to create one.
Legacy index '.opendistro_security' (ES 6) detected (or forced). You should migrate the configuration!
Will retrieve '/config' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/config.yml (legacy mode)
ERR: Seems config from cluster is not in legacy format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "description" (class org.opensearch.security.securityconf.impl.v6.ConfigV6$AuthcDomain), not marked as ignorable (6 known properties: "enabled", "http_enabled", "transport_enabled", "http_authenticator", "authentication_backend", "order"])
 at [Source: (String)"{"_meta":{"type":"config","config_version":2},"config":{"dynamic":{"http":{"anonymous_auth_enabled":false,"xff":{"enabled":false,"internalProxies":"192\\.168\\.0\\.10|192\\.168\\.0\\.11"}},"authc":{"kerberos_auth_domain":{"http_enabled":false,"transport_enabled":false,"order":6,"http_authenticator":{"type":"kerberos","challenge":true,"config":{"krb_debug":false,"strip_realm_from_principal":true}},"authentication_backend":{"type":"noop"}},"basic_internal_auth_domain":{"description":"Authenticate "[truncated 2394 chars]; line: 1, column: 488] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration["config"]->org.opensearch.security.securityconf.impl.v6.ConfigV6["dynamic"]->org.opensearch.security.securityconf.impl.v6.ConfigV6$Dynamic["authc"]->org.opensearch.security.securityconf.impl.v6.ConfigV6$Authc["basic_internal_auth_domain"]->org.opensearch.security.securityconf.impl.v6.ConfigV6$AuthcDomain["description"])
Will retrieve '/roles' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/roles.yml (legacy mode)
ERR: Seems roles from cluster is not in legacy format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "cluster_permissions" (class org.opensearch.security.securityconf.impl.v6.RoleV6), not marked as ignorable (5 known properties: "tenants", "readonly", "indices", "hidden", "cluster"])
 at [Source: (String)"{"_meta":{"type":"roles","config_version":2},"kibana_read_only":{"reserved":true},"security_rest_api_access":{"reserved":true},"alerting_read_access":{"reserved":true,"cluster_permissions":["cluster:admin/opendistro/alerting/alerts/get","cluster:admin/opendistro/alerting/destination/get","cluster:admin/opendistro/alerting/monitor/get","cluster:admin/opendistro/alerting/monitor/search"]},"alerting_ack_alerts":{"reserved":true,"cluster_permissions":["cluster:admin/opendistro/alerting/alerts/*"]},""[truncated 4749 chars]; line: 1, column: 191] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration["alerting_read_access"]->org.opensearch.security.securityconf.impl.v6.RoleV6["cluster_permissions"])
Will retrieve '/rolesmapping' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/roles_mapping.yml (legacy mode)
ERR: Seems rolesmapping from cluster is not in legacy format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "backend_roles" (class org.opensearch.security.securityconf.impl.v6.RoleMappingsV6), not marked as ignorable (6 known properties: "and_backendroles", "readonly", "users", "backendroles", "hidden", "hosts"])
 at [Source: (String)"{"_meta":{"type":"rolesmapping","config_version":2},"all_access":{"reserved":false,"backend_roles":["admin"],"description":"Maps admin to all_access"},"own_index":{"reserved":false,"users":["*"],"description":"Allow full access to an index named like the username"},"logstash":{"reserved":false,"backend_roles":["logstash"]},"kibana_user":{"reserved":false,"backend_roles":["kibanauser"],"description":"Maps kibanauser to kibana_user"},"readall":{"reserved":false,"backend_roles":["readall"]},"manage"[truncated 126 chars]; line: 1, column: 101] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration["all_access"]->org.opensearch.security.securityconf.impl.v6.RoleMappingsV6["backend_roles"])
Will retrieve '/internalusers' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/internal_users.yml (legacy mode)
ERR: Seems internalusers from cluster is not in legacy format: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "backend_roles" (class org.opensearch.security.securityconf.impl.v6.InternalUserV6), not marked as ignorable (7 known properties: "readonly", "username", "attributes", "hidden", "password", "roles", "hash"])
 at [Source: (String)"{"_meta":{"type":"internalusers","config_version":2},"admin":{"hash":"$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG","reserved":true,"backend_roles":["admin"],"description":"Demo admin user"},"kibanaserver":{"hash":"$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H.","reserved":true,"description":"Demo OpenSearch Dashboards user"},"kibanaro":{"hash":"$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC","reserved":false,"backend_roles":["kibanauser","readall"],"a"[truncated 648 chars]; line: 1, column: 166] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration["admin"]->org.opensearch.security.securityconf.impl.v6.InternalUserV6["backend_roles"])
Will retrieve '/actiongroups' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/action_groups.yml (legacy mode)
ERR: Seems actiongroups from cluster is not in legacy format: java.io.IOException: A version of 1 can not have a _meta key for ACTIONGROUPS
Will retrieve '/nodesdn' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/nodes_dn.yml (legacy mode)
ERR: Seems nodesdn from cluster is not in legacy format: java.io.IOException: A version of 1 can not have a _meta key for NODESDN
Will retrieve '/whitelist' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/whitelist.yml (legacy mode)
ERR: Seems whitelist from cluster is not in legacy format: java.io.IOException: A version of 1 can not have a _meta key for WHITELIST
Will retrieve '/audit' into /usr/share/opensearch/plugins/opensearch-security/tools/my-backup-directory/audit.yml (legacy mode)
ERR: Seems audit from cluster is not in legacy format: java.io.IOException: A version of 1 can not have a _meta key for AUDIT

```

if anyone can guide me on this ? Thanks and much appreciated.

For reference I am sharing the values.yaml as well:

```auto
---
clusterName: "opensearch-cluster"
nodeGroup: "master"

# The service that non master groups will try to connect to when joining the cluster
# This should be set to clusterName + "-" + nodeGroup for your master group
masterService: "opensearch-cluster-master"

# OpenSearch roles that will be applied to this nodeGroup
# These will be set as environment variable "node.roles". E.g. node.roles=master,ingest,data,remote_cluster_client
roles:
  - master
  - ingest
  - data
  - remote_cluster_client

replicas: 3

# if not set, falls back to parsing .Values.imageTag, then .Chart.appVersion.
majorVersion: ""

global:
  # Set if you want to change the default docker registry, e.g. a private one.
  dockerRegistry: ""

# Allows you to add any config files in {{ .Values.opensearchHome }}/config
opensearchHome: /usr/share/opensearch
# such as opensearch.yml and log4j2.properties
config:
  # Values must be YAML literal style scalar / YAML multiline string.
  # <filename>: |
  # <formatted-value(s)>
  # log4j2.properties: |
  # appender.console.type = Console
  # appender.console.name = console
  # appender.console.layout.type = PatternLayout
  # appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n
  #
  # rootLogger.level = debug
  # rootLogger.appenderRef.console.ref = console
  opensearch.yml: |
    cluster.name: opensearch-cluster

    # Bind to all interfaces because we don't know what IP address Docker will assign to us.
    network.host: 0.0.0.0

    # Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
    # discovery.type: single-node

    # Start OpenSearch Security Demo Configuration
    # WARNING: revise all the lines below before you go into production
    plugins:
      security:
        ssl:
          transport:
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem
            enforce_hostname_verification: false
          http:
            enabled: true
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem
        allow_unsafe_democertificates: true
        allow_default_init_securityindex: true
        authcz:
          admin_dn:
            - CN=kirk,OU=client,O=client,L=test,C=de
        audit.type: internal_opensearch
        enable_snapshot_restore_privilege: true
        check_snapshot_restore_write_privileges: true
        restapi:
          roles_enabled: ["all_access", "security_rest_api_access"]
        system_indices:
          enabled: true
          indices:
            [
              ".opendistro-alerting-config",
              ".opendistro-alerting-alert*",
              ".opendistro-anomaly-results*",
              ".opendistro-anomaly-detector*",
              ".opendistro-anomaly-checkpoints",
              ".opendistro-anomaly-detection-state",
              ".opendistro-reports-*",
              ".opendistro-notifications-*",
              ".opendistro-notebooks",
              ".opendistro-asynchronous-search-response*",
            ]
    ######## End OpenSearch Security Demo Configuration ########
  # log4j2.properties:

# Extra environment variables to append to this nodeGroup
# This will be appended to the current 'env:' key. You can use any of the kubernetes env
# syntax here
extraEnvs: []
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here

# Allows you to load environment variables from kubernetes secret or config map
envFrom: []
# - secretRef:
# name: env-secret
# - configMapRef:
# name: config-map

# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []

hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"

image:
  repository: "opensearchproject/opensearch"
  # override image tag, which is .Chart.AppVersion by default
  tag: ""
  pullPolicy: "IfNotPresent"

podAnnotations: {}
  # iam.amazonaws.com/role: es-cluster

# additionals labels
labels: {}

opensearchJavaOpts: "-Xmx512M -Xms512M"

resources:
  requests:
    cpu: "1000m"
    memory: "100Mi"

initResources: {}
# limits:
# cpu: "25m"
# memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"

sidecarResources: {}
# limits:
# cpu: "25m"
# memory: "128Mi"
# requests:
# cpu: "25m"
# memory: "128Mi"

networkHost: "0.0.0.0"

rbac:
  create: false
  serviceAccountAnnotations: {}
  serviceAccountName: ""

podSecurityPolicy:
  create: false
  name: ""
  spec:
    privileged: true
    fsGroup:
      rule: RunAsAny
    runAsUser:
      rule: RunAsAny
    seLinux:
      rule: RunAsAny
    supplementalGroups:
      rule: RunAsAny
    volumes:
      - secret
      - configMap
      - persistentVolumeClaim
      - emptyDir

persistence:
  enabled: true
  # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
  enableInitChown: true
  # override image, which is busybox by default
  # image: busybox
  # override image tag, which is latest by default
  # imageTag:
  labels:
    # Add default labels for the volumeClaimTemplate of the StatefulSet
    enabled: false
  # OpenSearch Persistent Volume Storage Class
  # If defined, storageClassName: <storageClass>
  # If set to "-", storageClassName: "", which disables dynamic provisioning
  # If undefined (the default) or set to null, no storageClassName spec is
  # set, choosing the default provisioner. (gp2 on AWS, standard on
  # GKE, AWS & OpenStack)
  #
  # storageClass: "-"
  accessModes:
    - ReadWriteOnce
  size: 8Gi
  annotations: {}

extraVolumes: []
  # - name: extras
  # emptyDir: {}

extraVolumeMounts: []
  # - name: extras
  # mountPath: /usr/share/extras
  # readOnly: true

extraContainers: []
  # - name: do-something
  # image: busybox
  # command: ['do', 'something']

extraInitContainers:
  ## Image that performs the sysctl operation to modify Kernel settings (needed sometimes to avoid boot errors)
  - name: sysctl
    image: docker.io/bitnami/bitnami-shell:10-debian-10-r199
    imagePullPolicy: "IfNotPresent"
    command:
      - /bin/bash
      - -ec
      - |
        CURRENT=`sysctl -n vm.max_map_count`;
        DESIRED="262144";
        if ["$DESIRED" -gt "$CURRENT"]; then
            sysctl -w vm.max_map_count=262144;
        fi;
        CURRENT=`sysctl -n fs.file-max`;
        DESIRED="65536";
        if ["$DESIRED" -gt "$CURRENT"]; then
            sysctl -w fs.file-max=65536;
        fi;
    securityContext:
      runAsUser: 0
      privileged: true

# This is the PriorityClass settings as defined in
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
priorityClassName: ""

# By default this will make sure two pods don't end up on the same node
# Changing this to a region would allow you to spread pods across regions
antiAffinityTopologyKey: "kubernetes.io/hostname"

# Hard means that by default pods will only be scheduled if there are enough nodes for them
# and that they will never end up on the same node. Setting this to soft will do this "best effort"
antiAffinity: "soft"

# This is the node affinity settings as defined in
# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
nodeAffinity: {}

# This is the pod topology spread constraints
# https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
topologySpreadConstraints: []

# The default is to deploy all pods serially. By setting this to parallel all pods are started at
# the same time when bootstrapping the cluster
podManagementPolicy: "Parallel"

# The environment variables injected by service links are not used, but can lead to slow OpenSearch boot times when
# there are many services in the current namespace.
# If you experience slow pod startups you probably want to set this to `false`.
enableServiceLinks: true

protocol: http
httpPort: 9200
transportPort: 9300

service:
  labels: {}
  labelsHeadless: {}
  headless:
    annotations: {}
  type: LoadBalancer
  nodePort: ""
  annotations: {}
  httpPortName: http
  transportPortName: transport
  loadBalancerIP: ""
  loadBalancerSourceRanges: []
  externalTrafficPolicy: ""

updateStrategy: RollingUpdate

# This is the max unavailable setting for the pod disruption budget
# The default value of 1 will make sure that kubernetes won't allow more than 1
# of your pods to be unavailable during maintenance
maxUnavailable: 1

podSecurityContext:
  fsGroup: 1000
  runAsUser: 1000

securityContext:
  capabilities:
    drop:
      - ALL
  # readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000

securityConfig:
  enabled: true
  path: "/usr/share/opensearch/plugins/opensearch-security/securityconfig"
  actionGroupsSecret:
  configSecret:
  internalUsersSecret:
  rolesSecret:
  rolesMappingSecret:
  tenantsSecret:
  # The following option simplifies securityConfig by using a single secret and
  # specifying the config files as keys in the secret instead of creating
  # different secrets for for each config file.
  # Note that this is an alternative to the individual secret configuration
  # above and shouldn't be used if the above secrets are used.
  config:
    # There are multiple ways to define the configuration here:
    # * If you define anything under data, the chart will automatically create
    # a secret and mount it.
    # * If you define securityConfigSecret, the chart will assume this secret is
    # created externally and mount it.
    # * It is an error to define both data and securityConfigSecret.
    securityConfigSecret: ""
    dataComplete: true
    data:
      roles_mapping.yml: |-
        ...
        all_access
          reserved: false
          backend_roles:
          - "admin"
          description: "Maps admin to all_access"
        ...
      config.yml: |-
        config:
          dynamic:
            authc: 
              basic_internal_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 0
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  type: internal
              openid_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 1
                http_authenticator:
                  type: openid
                  challenge: false
                  config:
                  # subject_key: preferred_username
                    roles_key: roles
                    openid_connect_url: <url>
                authentication_backend:
                  type: noop

      # internal_users.yml: |-
      # roles.yml: |-
      # action_groups.yml: |-
      # tenants.yml: |-

# How long to wait for opensearch to stop gracefully
terminationGracePeriod: 120

sysctlVmMaxMapCount: 262144

readinessProbe:
  failureThreshold: 3
  initialDelaySeconds: 10
  periodSeconds: 10
  successThreshold: 3
  timeoutSeconds: 2000

## Use an alternate scheduler.
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
schedulerName: ""

imagePullSecrets: []
nodeSelector: {}
tolerations: []

# Enabling this will publically expose your OpenSearch instance.
# Only enable this if you have security enabled on your cluster
ingress:
  enabled: false
  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
  # ingressClassName: nginx

  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - chart-example.local
  tls: []
  # - secretName: chart-example-tls
  # hosts:
  # - chart-example.local

nameOverride: ""
fullnameOverride: ""

masterTerminationFix: false

lifecycle: {}
  # preStop:
  # exec:
  # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"]
  # postStart:
  # exec:
  # command:
  # - bash
  # - -c
  # - |
  # #!/bin/bash
  # # Add a template to adjust number of shards/replicas1
  # TEMPLATE_NAME=my_template
  # INDEX_PATTERN="logstash-*"
  # SHARD_COUNT=8
  # REPLICA_COUNT=1
  # ES_URL=http://localhost:9200
  # while [["$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200"]]; do sleep 1; done
  # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}'

keystore: []
# To add secrets to the keystore:
# - secretName: opensearch-encryption-key

networkPolicy:
  create: false
  ## Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.
  ## In order for a Pod to access OpenSearch, it needs to have the following label:
  ## {{ template "uname" . }}-client: "true"
  ## Example for default configuration to access HTTP port:
  ## opensearch-master-http-client: "true"
  ## Example for default configuration to access transport port:
  ## opensearch-master-transport-client: "true"

  http:
    enabled: false

# Deprecated
# please use the above podSecurityContext.fsGroup instead
fsGroup: ""

## Set optimal sysctl's. This requires privilege. Can be disabled if
## the system has already been preconfigured. (Ex: https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html)
## Also see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
sysctl:
  enabled: false

## Enable to add 3rd Party / Custom plugins not offered in the default OpenSearch image.
plugins:
  enabled: false
  installList: []
  # - example-fake-plugin

# -- Array of extra K8s manifests to deploy
extraObjects: []
  # - apiVersion: secrets-store.csi.x-k8s.io/v1
  # kind: SecretProviderClass
  # metadata:
  # name: argocd-secrets-store
  # spec:
  # provider: aws
  # parameters:
  # objects: |
  # - objectName: "argocd"
  # objectType: "secretsmanager"
  # jmesPath:
  # - path: "client_id"
  # objectAlias: "client_id"
  # - path: "client_secret"
  # objectAlias: "client_secret"
  # secretObjects:
  # - data:
  # - key: client_id
  # objectName: client_id
  # - key: client_secret
  # objectName: client_secret
  # secretName: argocd-secrets-store
  # type: Opaque
  # labels:
  # app.kubernetes.io/part-of: argocd

```

OpenSearch dashboard.yml

```auto
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0

# Default values for opensearch-dashboards.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

opensearchHosts: "https://<IP>:9200"
replicaCount: 3

image:
  repository: "opensearchproject/opensearch-dashboards"
  # override image tag, which is .Chart.AppVersion by default
  tag: ""
  pullPolicy: "IfNotPresent"

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

rbac:
  create: true

# A list of secrets and their paths to mount inside the pod
# This is useful for mounting certificates for security and for mounting
# the X-Pack license
secretMounts: []
# - name: certs
# secretName: dashboard-certs
# path: /usr/share/dashboards/certs

podAnnotations: {}

extraEnvs: []
# - name: "NODE_OPTIONS"
# value: "--max-old-space-size=1800"

envFrom: []

extraVolumes: []
  # - name: extras
  # emptyDir: {}

extraVolumeMounts: []
  # - name: extras
  # mountPath: /usr/share/extras
  # readOnly: true

extraInitContainers: ""

extraContainers: ""

podSecurityContext: {}

securityContext:
  capabilities:
    drop:
      - ALL
  # readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000

config:
  # Default OpenSearch Dashboards configuration from docker image of Dashboards
      opensearch_dashboards.yml: |-
          opensearch_security.auth.type: "openid"
          opensearch_security.openid.connect_url: ""
          opensearch_security.openid.client_id: ""
          opensearch_security.openid.client_secret: ""
          opensearch_security.openid.base_redirect_url: 
          opensearch.username: "admin"
          opensearch.password: "admin"
          opensearch.ssl.verificationMode: none
          opensearch.requestHeadersAllowlist: ["Authorization", "security_tenant"]
          opensearch_security.cookie.secure: true
          logging.verbose: true

  # server:
  # name: dashboards
  # host: 0.0.0.0

  # Dashboards TLS Config (Ensure the cert files are present before enabling SSL
      # ssl:
      # enabled: true
      # key: /usr/share/opensearch-dashboards/certs/dashboards-key.pem
      # certificate: /usr/share/opensearch-dashboards/certs/dashboards-crt.pem

    # determines how dashboards will verify certificates (needs to be none for default opensearch certificates to work)
    # opensearch:
    # ssl:
    # certificateAuthorities: /usr/share/opensearch-dashboards/certs/dashboards-root-ca.pem
    # if utilizing custom CA certs for connection to opensearch, provide the CA here

priorityClassName: ""

opensearchAccount:
  secret: ""
  keyPassphrase:
    enabled: false

labels: {}

hostAliases: []
# - ip: "127.0.0.1"
# hostnames:
# - "foo.local"
# - "bar.local"

serverHost: "0.0.0.0"

service:
  type: LoadBalancer
  port: 5601
  loadBalancerIP: ""
  nodePort: ""
  labels: {}
  annotations: {}
  loadBalancerSourceRanges: []
  # 0.0.0.0/0
  httpPortName: http

ingress:
  enabled: false
  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
  # ingressClassName: nginx
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          backend:
            serviceName: chart-example.local
            servicePort: 80
  tls: []
  # - secretName: chart-example-tls
  # hosts:
  # - chart-example.local

resources:
  requests:
    cpu: "100m"
    memory: "512M"
  limits:
    cpu: "100m"
    memory: "512M"

autoscaling:
  # This requires metrics server to be installed, to install use kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
  # See https://github.com/kubernetes-sigs/metrics-server
  enabled: false
  minReplicas: 1
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

updateStrategy:
  type: "Recreate"

nodeSelector: {}

tolerations: []

affinity: {}

# -- Array of extra K8s manifests to deploy
extraObjects: []
  # - apiVersion: secrets-store.csi.x-k8s.io/v1
  # kind: SecretProviderClass
  # metadata:
  # name: argocd-secrets-store
  # spec:
  # provider: aws
  # parameters:
  # objects: |
  # - objectName: "argocd"
  # objectType: "secretsmanager"
  # jmesPath:
  # - path: "client_id"
  # objectAlias: "client_id"
  # - path: "client_secret"
  # objectAlias: "client_secret"
  # secretObjects:
  # - data:
  # - key: client_id
  # objectName: client_id
  # - key: client_secret
  # objectName: client_secret
  # secretName: argocd-secrets-store
  # type: Opaque
  # labels:
  # app.kubernetes.io/part-of: argocd

```

---

<div class="post-metadata">

### Author: ![Malone](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/malone/32/3588_2.png) [@Malone](https://forum.opensearch.org/u/Malone)
#### Post date: [June 1, 2022, 9:42pm UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/2 "2022-06-01T21:42:38Z")

</div>

UPDATE:

I am able to go pass the initial error 🙂  
Steps:

1. I tried to update issues with my role\_mapping.yml and config.yml, basically defining the api versions corrtecly. So now i have added these to my yaml files

```auto
_meta:
        type: "config"
        config_version: 2

```

1. Re-deployed OpenSearch cluster, access the pod and step 3.
2. I have deleted the .opendistro\_security and re-created it

```auto
DELETE .opendistro_security INDEX
./securityadmin.sh -cd "/usr/share/opensearch/plugins/opensearch-security/securityconfig" -dci -icl -nhnv -key "../../../config/kirk-key.pem" -cert "../../../config/kirk.pem" -cacert "../../../config/root-ca.pem"

RECREATE .opendistro_security INDEX
./securityadmin.sh -cd "/usr/share/opensearch/plugins/opensearch-security/securityconfig" -icl -key "../../../config/kirk-key.pem" -cert "../../../config/kirk.pem" -cacert "../../../config/root-ca.pem" -nhnv

Now I have another error :

{"error":{"root_cause":[{"type":"json_generation_exception","reason":"Can not start an object, expecting field name (context: Object)"}],"type":"json_generation_exception","reason":"Can not start an object, expecting field name (context: Object)"},"status":500}

Interesting !!
```

---

<div class="post-metadata">

### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/9946_2.png) [@pablo](https://forum.opensearch.org/u/pablo)
#### Post date: [June 2, 2022, 11:53am UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/3 "2022-06-02T11:53:08Z")

</div>

@Malone Please confirm that

`opensearch_security.openid.base_redirect_url:` has value  
`https://<OpenSearch_Dashboards_FQDN>:5601` in opensearch\_dashboards.yml

`Redirect URIs` has value `https://<OpenSearch_Dashboards_FQDN>:5601/auth/openid/login` in Azure

Do you use FQDN or localhost in the above options?

---

<div class="post-metadata">

### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/9946_2.png) [@pablo](https://forum.opensearch.org/u/pablo)
#### Post date: [June 2, 2022, 11:54am UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/4 "2022-06-02T11:54:27Z")

</div>

@Malone Also I’d suggest enabling SSL in OpenSearch Dashboards.

---

<div class="post-metadata">

### Author: ![Malone](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/malone/32/3588_2.png) [@Malone](https://forum.opensearch.org/u/Malone)
#### Post date: [June 2, 2022, 1:33pm UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/5 "2022-06-02T13:33:26Z")

</div>

Hi @pablo

Thanks for the support !  
`opensearch_security.openid.base_redirect_url: is mentioned as https://mydomain:5601`  
I am using App gateway to manage SSL.

---

<div class="post-metadata">

### Author: ![Malone](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/malone/32/3588_2.png) [@Malone](https://forum.opensearch.org/u/Malone)
#### Post date: [June 10, 2022, 12:13am UTC](https://forum.opensearch.org/t/integrate-opensearch-with-azure-ad-using-oidc/9800/6 "2022-06-10T00:13:51Z")

</div>

UPDATE:

SOLVED:  
Used SAML 2.0 instead of OIDC for SSO and RBAC using Azure AD. Thanks !!