# Keycloak with opensearch is not working

**URL:** <https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349>\
**Category:** Security\
**Created:** [January 5, 2024, 9:40pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349 "2024-01-05T21:40:08Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 5, 2024, 9:40pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/1 "2024-01-05T21:40:08Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

2.8.0

**Describe the issue** :  
Keycloak with opensearch is not working.

**Configuration** :  
Hi All,  
We have deployed the below configuration file

```auto
apiVersion: opensearch.opster.io/v1
kind: OpenSearchCluster
metadata:
  name: my-cluster1
  namespace: opensearch
spec:
  initHelper:
    image: "public.ecr.aws/opsterio/busybox"
  security:
    config:
      adminCredentialsSecret:
        name: a-admin-credentials-secret
      securityConfigSecret:
        name: a-securityconfig-secret
    tls:
      transport:
        generate: true
      http:
        generate: true
  general:
    serviceName: my-cluster1
    version: "2.8.0"
    pluginsList: ["repository-s3"]
    drainDataNodes: true
    setVMMaxMapCount: true
    imagePullPolicy: IfNotPresent
    additionalVolumes:
    - name: openid-certs
      path: /usr/share/opensearch/config/certs/
      configMap:
        name: openid-certs
      restartPods: true
      #additionalConfig:
      #plugins.security.allow_default_init_securityindex: "true"
      #plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/opensearch/config/certs/openid-certs
  dashboards:
    additionalConfig:
      logging.verbose: "true"
      opensearch_security.auth.type: '["basicauth","openid"]'
      opensearch_security.auth.multiple_auth_enabled: "True"
      opensearch_security.openid.connect_url: https://efktest.com/auth/realms/os/.well-known/openid-configuration
      opensearch_security.openid.base_redirect_url: https://osdashs.dev26.tatacommunications.com/
      opensearch_security.openid.client_id: grafana
      opensearch_security.openid.client_secret: 4zQdkx7ZSvHxpuiw4SCNTLibmGPElHhr
      opensearch_security.openid.scope: openid profile email
      opensearch_security.openid.header: Authorization
      opensearch_security.openid.trust_dynamic_headers: "true"
      opensearch.optimizedHealthcheckId: "my-cluster1"
      opensearch_security.openid.verify_hostnames: "false"
      opensearch.ssl.verificationMode: none
      opensearch_security.cookie.secure: "false"
      opensearch_security.auth.type: "openid"
      opensearch.requestHeadersWhitelist: |
        ["securitytenant","Authorization","security_tenant"]
      opensearch_security.readonly_mode.roles: '["kibana_user", "readall"]'
    imagePullPolicy: IfNotPresent
    opensearchCredentialsSecret:
      name: a-admin-credentials-secret
    enable: true
    tls:
      enable: true
      generate: true
    version: "2.8.0"
    replicas: 1
    resources:
      requests:
         memory: "512Mi"
         cpu: "200m"
      limits:
         memory: "512Mi"
         cpu: "200m"
  nodePools:
    - component: masters
      replicas: 3
      diskSize: "5Gi"
      jvm: "-Dopensearch.allow_insecure_settings=true"
      resources:
         requests:
            memory: "2Gi"
            cpu: "500m"
         limits:
            memory: "3Gi"
            cpu: "1000m"
      roles:
        - "data"
        - "master"
        - "ingest"
      persistence:
        pvc:
          storageClass: efk
          accessModes: # You can change the accessMode
          - ReadWriteOnce

```

Following is the security config.

```auto
apiVersion: v1
kind: Secret
metadata:
  name: a-securityconfig-secret
  namespace: opensearch
type: Opaque
stringData:
      internal_users.yml: |-
        _meta:
          type: "internalusers"
          config_version: 2
        admin:
          hash: "$2a$12$JyfMv0Rsd9W0wjZWQGFi5udp7MPoNiacQ0b3Zzoh7rq219QU4fCLu"
          reserved: true
          backend_roles:
          - "admin"
          description: "Demo admin user"

        anomalyadmin:
          hash: "$2y$12$TRwAAJgnNo67w3rVUz4FIeLx9Dy/llB79zf9I15CKJ9vkM4ZzAd3."
          reserved: false
          opendistro_security_roles:
          - "anomaly_full_access"
          description: "Demo anomaly admin user, using internal role"

        kibanaserver:
          hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
          reserved: true
          description: "Demo OpenSearch Dashboards user"

        kibanaro:
          hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
          reserved: false
          backend_roles:
          - "kibanauser"
          - "readall"
          attributes:
            attribute1: "value1"
            attribute2: "value2"
            attribute3: "value3"
          description: "Demo OpenSearch Dashboards read only user, using external role mapping"

        logstash:
          hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
          reserved: false
          backend_roles:
          - "logstash"
          description: "Demo logstash user, using external role mapping"

        readall:
          hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
          reserved: false
          backend_roles:
          - "readall"
          description: "Demo readall user, using external role mapping"

        snapshotrestore:
          hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
          reserved: false
          backend_roles:
          - "snapshotrestore"
          description: "Demo snapshotrestore user, using external role mapping"
      config.yml: |-
        _meta:
          type: "config"
          config_version: 2
        config:
          dynamic:
            authz: {}
            authc:
              basic_internal_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 0
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  type: internal

              openid_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 1
                http_authenticator:
                  type: openid
                  challenge: false
                  config:
                    openid_connect_idp:
                      enable_ssl: true
                      verify_hostnames: false
                      pemtrustedcas_filepath: /usr/share/opensearch/config/certs/openid-certs
                    subject_key: preferred_username
                    roles_key: roles
                    openid_connect_url: "https://efktest.com/auth/realms/os/.well-known/openid-configuration"
                authentication_backend:
                  type: noop
      roles_mapping.yml: |-
        _meta:
          type: "rolesmapping"
          config_version: 2

        # Define your roles mapping here

        ## Demo roles mapping

        all_access:
          reserved: false
          backend_roles:
          - "admin"
          - "roles"
          description: "Maps admin to all_access"

        own_index:
          reserved: false
          users:
          - "*"
          description: "Allow full access to an index named like the username"

        logstash:
          reserved: false
          backend_roles:
          - "logstash"

        kibana_user:
          reserved: false
          backend_roles:
          - "kibanauser"
          description: "Maps kibanauser to kibana_user"

        readall:
          reserved: false
          backend_roles:
          - "readall"

        manage_snapshots:
          reserved: false
          backend_roles:
          - "snapshotrestore"

        kibana_server:
          reserved: true
          users:
          - "kibanaserver"

```

**Relevant Logs or Screenshots** :  
We have configured the keycloak configuration correctly. Also, the session id also provided to opensearch from keycloak. But we are getting the authorization error.

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 8, 2024, 10:34am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/2 "2024-01-08T10:34:02Z")

</div>

> [@kannan](#):
>
> But we are getting the authorization error.

Hi @kannan,

Could you please share the error message?

Thanks,  
mj

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 8, 2024, 10:56am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/3 "2024-01-08T10:56:02Z")

</div>

> [@kannan](#):
>
> `pemtrustedcas_filepath: /usr/share/opensearch/config/certs/openid-certs`

This should be an “Absolute path to the **PEM** file containing the root CAs of your IdP.”

> **[OpenID Connect](https://opensearch.org/docs/latest/security/authentication-backends/openid-connect/#certificate-validation)**
>
> OpenID Connect

Is the file extension (.pem) missing?

best,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 8, 2024, 11:24am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/4 "2024-01-08T11:24:08Z")

</div>

Hi @Mantas ,

```auto
kubectl get cm -n opensearch openid-certs -o yaml
apiVersion: v1
data:
  openid-certs: '{"keys":[

```

Our file name is without extensions. Even if we keep \*.crt as extension, it is not working

Thanks,  
Kannan V

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 8, 2024, 11:27am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/5 "2024-01-08T11:27:28Z")

</div>

HI @Mantas ,  
Following is the error messages in opensearch dashboard

{“type”:“ops”,“@timestamp”:“2024-01-08T11:25:26Z”,“tags”:,“pid”:1,“os”:{“load”:[1.18,1.49,1.64],“mem”:{“total”:16690663424,“free”:7230930944},“uptime”:688592.29},“proc”:{“uptime”:511335.865961632,“mem”:{“rss”:137912320,“heapTotal”:106000384,“heapUsed”:94563832,“external”:20752615,“arrayBuffers”:1649894},“delay”:0.12295293807983398},“load”:{“requests”:{“5601”:{“total”:1,“disconnects”:0,“statusCodes”:{“200”:1}}},“responseTimes”:{“5601”:{“avg”:2,“max”:2}},“sockets”:{“http”:{“total”:0},“https”:{“total”:0}}},“message”:“memory: 90.2MB uptime: 142:02:16 load: [1.18 1.49 1.64] delay: 0.123”}  
{“type”:“log”,“@timestamp”:“2024-01-08T11:25:26Z”,“tags”:[“debug”,“metrics”],“pid”:1,“message”:“Refreshing metrics”}  
{“type”:“ops”,“@timestamp”:“2024-01-08T11:25:31Z”,“tags”:,“pid”:1,“os”:{“load”:[1.24,1.5,1.64],“mem”:{“total”:16690663424,“free”:7252758528},“uptime”:688597.29},“proc”:{“uptime”:511340.867510952,“mem”:{“rss”:137269248,“heapTotal”:106000384,“heapUsed”:93918536,“external”:21280151,“arrayBuffers”:594874},“delay”:0.2468470335006714},“load”:{“requests”:{“5601”:{“total”:0,“disconnects”:0,“statusCodes”:{}}},“responseTimes”:{“5601”:{“avg”:null,“max”:0}},“sockets”:{“http”:{“total”:0},“https”:{“total”:0}}},“message”:“memory: 89.6MB uptime: 142:02:21 load: [1.24 1.50 1.64] delay: 0.247”}  
{“type”:“log”,“@timestamp”:“2024-01-08T11:25:31Z”,“tags”:[“debug”,“metrics”],“pid”:1,“message”:“Refreshing metrics”}  
{“type”:“ops”,“@timestamp”:“2024-01-08T11:25:36Z”,“tags”:,“pid”:1,“os”:{“load”:[1.22,1.49,1.64],“mem”:{“total”:16690663424,“free”:7216771072},“uptime”:688602.29},“proc”:{“uptime”:511345.867303809,“mem”:{“rss”:137539584,“heapTotal”:106000384,“heapUsed”:94182088,“external”:21815879,“arrayBuffers”:1130602},“delay”:0.13360393047332764},“load”:{“requests”:{“5601”:{“total”:0,“disconnects”:0,“statusCodes”:{}}},“responseTimes”:{“5601”:{“avg”:null,“max”:0}},“sockets”:{“http”:{“total”:0},“https”:{“total”:0}}},“message”:“memory: 89.8MB uptime: 142:02:26 load: [1.22 1.49 1.64] delay: 0.134”}  
{“type”:“log”,“@timestamp”:“2024-01-08T11:25:36Z”,“tags”:[“debug”,“metrics”],“pid”:1,“message”:“Refreshing metrics”}  
{“type”:“error”,“@timestamp”:“2024-01-08T11:25:41Z”,“tags”:[“connection”,“client”,“error”],“pid”:1,“level”:“error”,“error”:{“message”:“140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”,“name”:“Error”,“stack”:“Error: 140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”,“code”:“ERR\_SSL\_SSLV3\_ALERT\_CERTIFICATE\_UNKNOWN”},“message”:“140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”}  
{“type”:“error”,“@timestamp”:“2024-01-08T11:25:41Z”,“tags”:[“connection”,“client”,“error”],“pid”:1,“level”:“error”,“error”:{“message”:“140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”,“name”:“Error”,“stack”:“Error: 140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”,“code”:“ERR\_SSL\_SSLV3\_ALERT\_CERTIFICATE\_UNKNOWN”},“message”:“140479110416320:error:14094416:SSL routines:ssl3\_read\_bytes:sslv3 alert certificate unknown:…/deps/openssl/openssl/ssl/record/rec\_layer\_s3.c:1565:SSL alert number 46\n”}  
{“type”:“log”,“@timestamp”:“2024-01-08T11:25:41Z”,“tags”:[“debug”,“http”,“server”,“OpenSearchDashboards”,“cookie-session-storage”],“pid”:1,“message”:“Error: Unauthorized”}

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 8, 2024, 12:29pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/6 "2024-01-08T12:29:47Z")

</div>

Could you please share the output of the below command:

`ls -l /usr/share/opensearch/config/certs/`

Best,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 8, 2024, 12:53pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/7 "2024-01-08T12:53:42Z")

</div>

> [@Mantas](#):
>
> `ls -l /usr/share/opensearch/config/certs/`

[opensearch@my-cluster1-masters-0 ~]$ ls -l /usr/share/opensearch/config/certs/  
total 0  
lrwxrwxrwx 1 root root 19 Jan 8 12:49 openid-certs → …data/openid-certs  
[opensearch@my-cluster1-masters-0 ~]$

Above is the output from my-cluster1-masters-0

Above data is present only on master node. Not on dashboard pod

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 8, 2024, 1:41pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/8 "2024-01-08T13:41:52Z")

</div>

> [@kannan](#):
>
> [opensearch@my-cluster1-masters-0 ~]$ ls -l /usr/share/opensearch/config/certs/  
> total 0

Is the directory empty?

best,  
mj

---

<div class="post-metadata">

**Author:** ![rmssath](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@rmssath](https://forum.opensearch.org/u/rmssath)\
**Post date:** [January 9, 2024, 6:49am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/9 "2024-01-09T06:49:44Z")

</div>

Hi @Mantas,

Since the file is linked it is showing 0. Kindly find the below.

```auto
[opensearch@my-cluster1-masters-0 certs]$ ls -l /usr/share/opensearch/config/certs/
total 0
lrwxrwxrwx 1 root root 19 Jan 8 12:49 openid-certs -> ..data/openid-certs

[opensearch@my-cluster1-masters-0 certs]$ ls -l /usr/share/opensearch/config/certs/..data/
total 4
-rw-r--r-- 1 root root 2901 Jan 8 12:49 openid-certs

[opensearch@my-cluster1-masters-0 certs]$ cat /usr/share/opensearch/config/certs/..data/openid-certs
{"keys":[{"kid":"1qGlXsK7PC-H6-EFQ8fP69uJMpfXh_EP1TTP4xtuIrw","kty":"RSA","alg":"RSA-OAEP","use":"enc","n":"rykU_GBbcZ7PJM5hHviq3Modu-7iuRImn2aubVp_l2ShMBLwC6E91DVvLSTD73V37FCHvxPEn98OcUmHME-CK80JxrYHK4dPQ1Ho0e9WFgQL5GUKTfIqZabP1rnFvncYHvnHJGh6Jyts98

```

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 9, 2024, 12:38pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/10 "2024-01-09T12:38:27Z")

</div>

Hi @Mantas ,  
What is the possible cause for this issue ?  
Thanks,  
Kannan V

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 9, 2024, 1:18pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/11 "2024-01-09T13:18:54Z")

</div>

> [@kannan](#):
>
> What is the possible cause for this issue ?

Hi @kannan,

Could you share your keycloak **Token Claim Name** from `Client scopes/roles/Meppers(tab)/realm roles` should look similar to belov:

![96a3f34bd971e2dae4a096e7008274b3082a01db_2_689x392](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/aad2c3b17760a091313f33ceb0bdebf6a6c97f9f.png)

Thanks,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 9, 2024, 1:58pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/12 "2024-01-09T13:58:00Z")

</div>

Hi @Mantas ,  
Following is my token Claim keycloak details

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/09523af5e45ff8f58edfc535a30a58620f8cf335.png)

Below one is the mapping with client

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/fafa522078baca38b60a9d56457945e3ad27d676.png)

Let us know your suggestion to us.

Thanks,  
Kannan V

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 9, 2024, 2:18pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/13 "2024-01-09T14:18:59Z")

</div>

What is the `Token Claim Name`?

step #1  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/3d8d9a27198c3b893172ada9bb18f19a1b074adc.png)

step #2

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/c7b4358eaa580061a3a9d61c251da92a0cf25988.png)

step #3  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d9c0c551fe2e69532f54c89ea4b9bbec9eea0649.png)

step #4  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/bcc60257f97bd2446a2bdf05d4622189867ef02b.png)

Can you share the full (all values) screenshot of the step #4 ?

best,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 10, 2024, 5:04am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/14 "2024-01-10T05:04:41Z")

</div>

Hi @Mantas,

Refer the below token claim name in client scope - mapper - realm roles.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/cf9a07d686f939e39cbd6ce66dca708513bfb7e2.png)

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 10, 2024, 11:52am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/15 "2024-01-10T11:52:51Z")

</div>

Hi @kannan,

I see, missed the first screenshot somehow.

Could you share the JWT token that Keycloak generates?  
I can see that you are trying to map `roles: roles` to `all_access` (quotes below), is that correct (meaning you have a `realm role` called `roles` with a user you are logging in?)?

> [@kannan](#):
>
> ```auto
> all_access:
> reserved: false
> backend_roles:
> - "admin"
> - "roles"
> 
> ```

> [@kannan](#):
>
> `roles_key: roles`

Best,  
mj

---

<div class="post-metadata">

**Author:** ![rmssath](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@rmssath](https://forum.opensearch.org/u/rmssath)\
**Post date:** [January 10, 2024, 1:16pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/16 "2024-01-10T13:16:04Z")

</div>

Hi @Mantas,

Keycloak generated JWT Token - Are you referring this /usr/share/opensearch/config/certs/openid-certs pem file which is mounted in the pods?

Yes… we are providing all\_access to the roles.

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 11, 2024, 3:55pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/17 "2024-01-11T15:55:29Z")

</div>

Could you please share the list of your Realm roles:  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/aff30778fc0e007a29c7f5b698cc745f0442444d.png)

> [@rmssath](#):
>
> Keycloak generated JWT Token

JWT is _JSON Web Token_ Keycloak will send JWT to OpenSearch, this token is used for authentication.  
You can get the token by using something like (some adjustments might be required:

`curl -k --insecure --noproxy '*' -d 'client_id=grafana' -d 'username=[**username**]' -d 'password=[**password**]' -d 'grant_type=password' -d 'client_secret=4zQdkx7ZSvHxpuiw4SCNTLibmGPElHhr' -d 'scope=openid' -XPOST 'https://efktest.com:8080/realms/os/protocol/openid-connect/token'`

best,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 12, 2024, 5:07am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/18 "2024-01-12T05:07:41Z")

</div>

Hi @Mantas ,

Refer the list of realm roles.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/e/e6c2b07cf6323a668c2d9eade6e7bb98f028b049.png)

---

<div class="post-metadata">

**Author:** ![rmssath](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@rmssath](https://forum.opensearch.org/u/rmssath)\
**Post date:** [January 12, 2024, 6:11am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/19 "2024-01-12T06:11:29Z")

</div>

Hi @Mantas,

We got the JWT access token by above curl command.

Refer the below access\_token after decode:

```auto
{
  "exp": 1705037246,
  "iat": 1705036946,
  "jti": "dbc8ffbe-65d5-4f62-9f1b-6065fcba8249",
  "iss": "https://efktest.com/auth/realms/os",
  "aud": [
    "grafana",
    "kubernetes"
  ],
  "sub": "582aa0ee-08a6-4eea-96a5-6f024dbf4b1b",
  "typ": "Bearer",
  "azp": "grafana",
  "session_state": "fbaff75d-c1a5-484f-9980-36b7b14bb194",
  "acr": "1",
  "allowed-origins": [
    "*"
  ],
  "resource_access": {
    "grafana": {
      "roles": [
        "roles"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid email profile my-good-service",
  "sid": "fbaff75d-c1a5-484f-9980-36b7b14bb194",
  "email_verified": true,
  "roles": [
    "default-roles-nha",
    "offline_access",
    "opensearch-secure",
    "uma_authorization",
    "specialuser",
    "default-roles-nha",
    "offline_access",
    "opensearch-secure",
    "uma_authorization",
    "specialuser"
  ],
  "name": "Kannan V",
  "preferred_username": "kannan",
  "given_name": "Kannan",
  "family_name": "V",
  "email": "kannan@test.com"
}

```

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 12, 2024, 11:45am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/20 "2024-01-12T11:45:07Z")

</div>

Hi @rmssath,

it does not look like you have a `realm role` called **roles** , can you `Add Role` called **roles** and add your user ( `kannan`) to it and test it again, please?

You are mapping a role called **roles** to **all\_access** in your config but you are not sending it in your JWT.

thanks,  
Mantas

> [@kannan](#):
>
> ` roles_key: roles`

> [@kannan](#):
>
> ```auto
> all_access:
> reserved: false
> backend_roles:
> - "admin"
> - "roles"
> 
> ```

[Next page](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349.md?page=2)