@pablo Authelia and OpenSearch Dashboards are placed behind HAProxy with Let’s Encrypt certificates.
Haproxy
frontend http_front
bind {{ public-ip }}:443 ssl crt /etc/haproxy/ssl/ strict-sni
http-request deny if { hdr(host) -i authelia.example.com } !{ src -f /etc/haproxy/whitelist.txt }
http-request deny if { hdr(host) -i dashboard.example.com } !{ src -f /etc/haproxy/whitelist.txt }
use_backend backend-tools-opensearch-dashboards if { hdr(host) -i dashboard.example.com }
use_backend backend-tools-authelia if { hdr(host) -i authelia.example.com }
backend backend-tools-opensearch-dashboards
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Proto https
http-request add-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Host %[req.hdr(host)]
server opensearch-dashboards 10.51.0.1:5601 check
backend backend-tools-authelia
balance roundrobin
option forwardfor
http-request add-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-Proto https
option httpchk GET /api/health
server authelia 10.51.0.1:9091 check
Authelia / configuration.yaml
identity_validation:
reset_password:
jwt_secret: "Hp0MyaIrh275cWYq9NCt5ipmJcU0FLOxIo5dMqkc3bQ="
theme: light
default_redirection_url: https://example.com
server:
address: tcp://0.0.0.0:9091/
log:
level: debug
authentication_backend:
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 3
memory: 64
parallelism: 4
salt_length: 16
key_length: 32
session:
name: authelia_session
secret: "saEFQwdQp3M3SGIkKwDT3wn7xTxTGpO2qPhuGR18ARw="
expiration: 1h
inactivity: 5m
domain: example.com
same_site: lax
storage:
local:
path: /config/storage/db.sqlite3
encryption_key: "3UU2UsyXYkTWueUkPix3Kki7jSCFoMVbNpqamThae2Q="
access_control:
default_policy: deny
rules:
- domain: "*.foo.com"
policy: one_factor
- domain: "*.example.com"
policy: two_factor
notifier:
smtp:
address: smtp://mail.example.com:587
username: "user@example.com"
password: "*******"
sender: "Authelia <no-reply@example.com>"
subject: "[Authelia] Notification"
startup_check_address: "user@example.com"
disable_require_tls: false
tls:
skip_verify: false
identity_providers:
oidc:
hmac_secret: "2PRVgcl0y2PMZcD59icamH0vNtoQeqboIvEhKO8Cn1U="
jwks:
- key: |
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
use: sig
algorithm: RS256
claims_policies:
osdashboard:
id_token:
- groups
- preferred_username
clients:
- client_id: "opensearch-dashboard-client"
claims_policy: 'osdashboard'
client_secret: "$argon2id$v=19$m=65536,t=3,p=4$NMVrtX7Mz31jamMESuDaoQ$x+hpxTlTUJT4lqpYUlYvt2hhz6A0FpdcbkXMSymEOXM"
public: false
authorization_policy: one_factor
token_endpoint_auth_method: 'client_secret_post'
redirect_uris:
- "https://dashboard.exemple.com/auth/openid/login"
scopes:
- openid
- profile
- email
- groups
grant_types:
- refresh_token
- authorization_code
response_types:
- code
consent_mode: implicit
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
Authelia/users_database.yml
users:
alice:
displayname: "Admin"
password: "$argon2id$v=19$m=65536,t=3,p=4$wszjeiswsXYGqpZNfLiRKg$DW8Bn7gAq28nHXowpnv4f59exfwpeEketAHpSowX0Vw"
email: vacknov@example.com
groups:
- admins
bob:
displayname: "User"
password: "$argon2id$v=19$m=65536,t=3,p=4$wszjeiswsXYGqpZNfLiRKg$DW8Bn7gAq28nHXowpnv4f59exfwpeEketAHpSowX0Vw"
email: user@example.com
groups:
- users
Opensearch/config.yml
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: "10\\.51\\.0\\.3|112\\.94\\.20\\.78"
authc:
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: "basic"
challenge: false
authentication_backend:
type: "intern"
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: "openid"
challenge: false
config:
subject_key: "preferred_username"
roles_key: "groups"
openid_connect_url: "https://authelia.example.com/.well-known/openid-configuration"
openid_connect_idp.enable_ssl: true
skip_users:
- "kibanaro"
- "kibanaserver"
- "logstash"
- "admin"
- "fliebeat_internal"
- "kibanauser"
Opensearch dasshbord / opensearch_dashbords.yml
server.host: "0.0.0.0"
server.port: 5601
server.ssl.enabled: false
server.customResponseHeaders : { "Access-Control-Allow-Credentials" : "true" }
opensearch.hosts: ["https://opensearch:9200"]
opensearch.ssl.verificationMode: none
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch.ssl.certificate: /usr/share/opensearch-dashboards/config/certs/admin.pem
opensearch.ssl.key: /usr/share/opensearch-dashboards/config/certs/admin.key
opensearch.ssl.certificateAuthorities: [/usr/share/opensearch-dashboards/config/certs/root-ca.pem]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: ["Global","Private"]
opensearch_security.multitenancy.tenants.enable_private: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
opensearch_security.auth.type: ["basicauth","openid"]
opensearch_security.auth.multiple_auth_enabled: true
opensearch_security.openid.connect_url: "https://authelia.example.com/.well-known/openid-configuration"
opensearch_security.openid.client_id: "opensearch-dashboard-client"
opensearch_security.openid.client_secret: "*********"
opensearch_security.openid.base_redirect_url: "https://dashboard.example.com"
opensearch_security.openid.scope: "openid profile email groups"
# Configuration pour éviter les problèmes d'authentification
opensearch_security.openid.logout_url: "https://authelia.example.com/logout"
config/roles_mappings.yml
all_access:
reserved: false
backend_roles:
- "admin"
- "admins"
- "users"
description: "Maps admin to all_access
Opensearch logs after apply changes
2025-08-21T20:39:12,530][WARN ][o.o.s.h.HTTPBasicAuthenticator] [55cfe0eba429] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'
[2025-08-21T20:39:12,531][WARN ][o.o.s.a.BackendRegistry ] [55cfe0eba429] Authentication finally failed for null from 172.25.0.3:35366
I will switch the dashboard to HTTPS for testing.
