# Kibana sso+ keycloak

**URL:** <https://forum.opensearch.org/t/kibana-sso-keycloak/4953>\
**Category:** Security\
**Created:** [February 11, 2021, 2:27pm UTC](https://forum.opensearch.org/t/kibana-sso-keycloak/4953 "2021-02-11T14:27:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravindra](https://avatars.discourse-cdn.com/v4/letter/r/35a633/32.png) [@ravindra](https://forum.opensearch.org/u/ravindra)\
**Post date:** [February 11, 2021, 2:27pm UTC](https://forum.opensearch.org/t/kibana-sso-keycloak/4953/1 "2021-02-11T14:27:37Z")

</div>

I am trying to do kibana sso with keycloak using opendistro plugin and SAML. iam facing  
following  
when I hit kibana url it is redirecting to customerror?type=samlConfigError#/

**when i inspect in chrome, in console i have error like this**

INFO: 2021-02-12T09:33:28Z  
Adding connection to [http://localhost:5601/elasticsearch](http://localhost:5601/elasticsearch)

kbn-ui-shared-deps.js:381:106453  
Detected an unhandled Promise rejection.  
Error: Unauthorized commons.bundle.js:11:3982088  
Detected an unhandled Promise rejection.  
Error: Unauthorized

**my elasticsearch.yml**

opendistro\_security.ssl.transport.pemcert\_filepath: esnode.pem  
opendistro\_security.ssl.transport.pemkey\_filepath: esnode-key.pem  
opendistro\_security.ssl.transport.pemtrustedcas\_filepath: root-ca.pem  
opendistro\_security.ssl.transport.enforce\_hostname\_verification: false  
opendistro\_security.ssl.http.enabled: true  
opendistro\_security.ssl.http.pemcert\_filepath: esnode.pem  
opendistro\_security.ssl.http.pemkey\_filepath: esnode-key.pem  
opendistro\_security.ssl.http.pemtrustedcas\_filepath: root-ca.pem  
opendistro\_security.allow\_unsafe\_democertificates: true  
opendistro\_security.allow\_default\_init\_securityindex: true  
opendistro\_security.authcz.admin\_dn:

- CN=kirk,OU=client,O=client,L=test, C=de

opendistro\_security.audit.type: internal\_elasticsearch  
opendistro\_security.enable\_snapshot\_restore\_privilege: true  
opendistro\_security.check\_snapshot\_restore\_write\_privileges: true  
opendistro\_security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”]  
cluster.routing.allocation.disk.threshold\_enabled: false  
node.max\_local\_storage\_nodes: 3

**mykibana.yml**

elasticsearch.hosts:   
elasticsearch.ssl.verificationMode: none  
elasticsearch.username: kibanaserver  
elasticsearch.password: kibanaserver  
elasticsearch.requestHeadersWhitelist: [“securitytenant”,“Authorization”]

opendistro\_security.multitenancy.enabled: true  
opendistro\_security.multitenancy.tenants.preferred: [“Private”, “Global”]  
opendistro\_security.readonly\_mode.roles: [“kibana\_read\_only”]  
opendistro\_security.auth.type: “saml”  
server.xsrf.whitelist: [/\_opendistro/\_security/saml/acs,/\_opendistro/\_security/saml/acs/idpinitiated,/\_opendistro/\_security/saml/logout]

**my config.yml**  
\_meta:  
type: “config”  
config\_version: 2

config:  
dynamic:  
http:  
anonymous\_auth\_enabled: false  
authc:  
basic\_internal\_auth\_domain:  
description: “Authenticate via HTTP Basic against internal users database”  
http\_enabled: true  
transport\_enabled: true  
order: 1  
http\_authenticator:  
type: basic  
challenge: true  
authentication\_backend:  
type: intern  
saml\_auth:  
order: 0  
description: “SAML provider”  
http\_enabled: true  
transport\_enabled: false  
http\_authenticator:  
type: saml  
challenge: true  
config:  
idp:  
metadata\_file: metadata.xml #SAML’s metadata url, provided by your IdP  
entity\_id: #SAML’s IdP entity ID, provided by your IdP  
sp:  
entity\_id: kibana-sso  
forceAuthn: true  
kibana\_url: [http://localhost:5601](http://localhost:5601)  
roles\_key: Role  
exchange\_key: e124a508-1e75-4238-b742-1452382f451b  
authentication\_backend:  
type: noop

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [February 15, 2021, 4:46pm UTC](https://forum.opensearch.org/t/kibana-sso-keycloak/4953/2 "2021-02-15T16:46:39Z")

</div>

@ravindra both of your authc’s are marked as “challenge: true” but only last one should be true.  
Try changing the sequence to basic auth first (challenge false), SAML 2nd (challenge true).

Also does your “#SAML’s IdP entity ID, provided by your IdP” look something like this: [http://keycloak/auth/realms/](http://keycloak/auth/realms/)\<your\_realm\>