# Keycloak with opensearch is not working

**URL:** <https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349>\
**Category:** Security\
**Created:** [January 5, 2024, 9:40pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349 "2024-01-05T21:40:08Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 17, 2024, 4:56am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/21 "2024-01-17T04:56:21Z")

</div>

Hi @Mantas,

Created new realm role called **roles** and user kannan is mapped to that role. Still getting the same error.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/7/718fbdd1358b39e687e5e0acd17831cb5cba6f32.png)

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/147a41fac50f585080ca846ea08cccbe8950145a.png)

Refer the below access\_token after decode:

```auto
{
  "exp": 1705467439,
  "iat": 1705467139,
  "jti": "fac630d2-1821-4366-8d60-195a0574d8af",
  "iss": "https://efktest.com/auth/realms/os",
  "aud": [
    "grafana",
    "kubernetes"
  ],
  "sub": "582aa0ee-08a6-4eea-96a5-6f024dbf4b1b",
  "typ": "Bearer",
  "azp": "grafana",
  "session_state": "946fa32d-cb73-42bf-96d3-5a855c4bd5d5",
  "acr": "1",
  "allowed-origins": [
    "*"
  ],
  "resource_access": {
    "grafana": {
      "roles": [
        "roles"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid email profile my-good-service",
  "sid": "946fa32d-cb73-42bf-96d3-5a855c4bd5d5",
  "email_verified": true,
  "roles": [
    "default-roles-nha",
    "offline_access",
    "roles",
    "opensearch-secure",
    "uma_authorization",
    "specialuser",
    "default-roles-nha",
    "offline_access",
    "roles",
    "opensearch-secure",
    "uma_authorization",
    "specialuser"
  ],
  "name": "Kannan V",
  "preferred_username": "kannan",
  "given_name": "Kannan",
  "family_name": "V",
  "email": "kannan@test.com"
}

```

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 22, 2024, 3:47pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/22 "2024-01-22T15:47:28Z")

</div>

Hi @kannan,

Could you please run the below and share the output:

`curl --insecure -u admin:admin -XGET https://<OS_node>:9200/_plugins/_security/api/rolesmapping/all_access?pretty`

thanks,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 23, 2024, 4:16pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/23 "2024-01-23T16:16:26Z")

</div>

Hi @Mantas ,  
Refer the output for the above command  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/488167fbbba4f9c9133a7e260f064aacf1f3e44c.png)

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 24, 2024, 12:04pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/24 "2024-01-24T12:04:22Z")

</div>

Hi @kannan,

One more thing I`ve just noticed you’ll need to switch “Add to ID token” to ON:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/f0b210ee99d1f52c484fb161dc3d009398fda903.png)

Can you test that and let me know?

Thanks,  
mj

---

<div class="post-metadata">

**Author:** ![kannan](https://avatars.discourse-cdn.com/v4/letter/k/7ba0ec/32.png) [@kannan](https://forum.opensearch.org/u/kannan)\
**Post date:** [January 30, 2024, 12:18pm UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/25 "2024-01-30T12:18:04Z")

</div>

Hi @Mantas ,

Still getting the same error.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/c181904f2ff35cd9abb638f4226148e4e7afe2d3.png)

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [February 9, 2024, 11:21am UTC](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349/26 "2024-02-09T11:21:11Z")

</div>

Hi @kannan ,

Have you found a solution yet?  
If not, could you share your the latest:

- error
- jwt token
- config.yml

Thanks,  
Mantas

[Previous page](https://forum.opensearch.org/t/keycloak-with-opensearch-is-not-working/17349.md?page=1)