Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Describe the issue:
I recently enabled oidc for user authentication using MS entra id, it was successful, however i notice i am not seeing my email or preffered name showup on the dashboard when i login instead i get a long string as username
Configuration:
I have a two nodes cluster
manager node and warm node both are running on a onsite k3s server.
This is my dashboard yaml
opensearch_dashboards.yml: |
server.name: opensearch-dashboards
server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: [“https://opensearch-manager:9200”,“https://opensearch-warm:9200”]
opensearch.ssl.verificationMode: none
opensearch.ssl.certificateAuthorities: “/usr/share/opensearch-dashboards/certs/root-ca.pem”
server.ssl.enabled: false
opensearch_security.cookie.secure: false
opensearch.requestHeadersWhitelist: [“Authorization”, “securitytenant”]
opensearch_security.readonly_mode.roles: [“kibana_read_only”]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [“Private”, “Global”]
opensearch_security.auth.multiple_auth_enabled: false
opensearch_security.auth.type: [“openid”]
opensearch_security.openid.connect_url: “entra id url”
opensearch_security.openid.client_id: “”
opensearch_security.openid.client_secret: “”
opensearch_security.openid.scope: “openid email profile User.Read”
opensearch_security.openid.base_redirect_url: “opensearch.xxxxxxx”
opensearch_security.openid.verify_hostnames: false
opensearch_security.openid.refresh_tokens: false
logging.verbose: true
Running securityadmin shows cluster is green with no issues
kubectl exec -it ti-opensearch-cluster-manager-node-0 -- sh plugins/opensearch-security/tools/securityadmin.sh \
-cd /usr/share/opensearch/config/opensearch-security/ \
-icl -nhnv \
-cert /usr/share/opensearch/config/certs/admin.pem \
-cacert /usr/share/opensearch/config/certs/root-ca.pem \
-key /usr/share/opensearch/config/certs/admin-key.pem \
-t config
output
Security Admin v7
Will connect to localhost:9200 … done
Connected as “EMAILADDRESS=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
OpenSearch Version: 3.0.0
Contacting opensearch cluster ‘opensearch’ and wait for YELLOW clusterstate …
Clustername: main-opensearch-cluster
Clusterstate: GREEN
Number of nodes: 2
Number of data nodes: 2
.opendistro_security index already exists, so we do not need to create one.
Populate config from /usr/share/opensearch/config/opensearch-security/
Will update ‘/config’ with /usr/share/opensearch/config/opensearch-security/config.yml
SUCC: Configuration for ‘config’ created or updated
Will update ‘/roles’ with /usr/share/opensearch/config/opensearch-security/roles.yml
SUCC: Configuration for ‘roles’ created or updated
Will update ‘/rolesmapping’ with /usr/share/opensearch/config/opensearch-security/roles_mapping.yml
SUCC: Configuration for ‘rolesmapping’ created or updated
Will update ‘/internalusers’ with /usr/share/opensearch/config/opensearch-security/internal_users.yml
SUCC: Configuration for ‘internalusers’ created or updated
Will update ‘/actiongroups’ with /usr/share/opensearch/config/opensearch-security/action_groups.yml
SUCC: Configuration for ‘actiongroups’ created or updated
Will update ‘/tenants’ with /usr/share/opensearch/config/opensearch-security/tenants.yml
SUCC: Configuration for ‘tenants’ created or updated
Will update ‘/nodesdn’ with /usr/share/opensearch/config/opensearch-security/nodes_dn.yml
SUCC: Configuration for ‘nodesdn’ created or updated
Will update ‘/audit’ with /usr/share/opensearch/config/opensearch-security/audit.yml
SUCC: Configuration for ‘audit’ created or updated
Will update ‘/allowlist’ with /usr/share/opensearch/config/opensearch-security/allowlist.yml
SUCC: Configuration for ‘allowlist’ created or updated
SUCC: Expected 9 config types for node {“updated_config_types”:[“allowlist”,“tenants”,“rolesmapping”,“nodesdn”,“audit”,“roles”,“actiongroups”,“config”,“internalusers”],“updated_config_size”:9,“message”:null} is 9 ([“allowlist”,“tenants”,“rolesmapping”,“nodesdn”,“audit”,“roles”,“actiongroups”,“config”,“internalusers”]) due to: null
SUCC: Expected 9 config types for node {“updated_config_types”:[“allowlist”,“tenants”,“rolesmapping”,“nodesdn”,“audit”,“roles”,“actiongroups”,“config”,“internalusers”],“updated_config_size”:9,“message”:null} is 9 ([“allowlist”,“tenants”,“rolesmapping”,“nodesdn”,“audit”,“roles”,“actiongroups”,“config”,“internalusers”]) due to: null
Done with success
This is my config.yml on the nodes
config.yml: |
_meta:
type: “config”
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: ‘192.168.0.10|192.168.0.11’
remoteIpHeader: ‘x-forwarded-for’
do_not_fail_on_forbidden: true
do_not_fail_on_forbidden_empty: true
authc:
basic_internal_auth_domain:
description: “Authenticate via HTTP Basic against internal users database”
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: internal
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
openid_connect_idp:
enable_ssl: true
pemtrustedcas_filepath: /usr/share/opensearch/config/certs/root-ca.pem
verify_hostnames: false
subject_key: preferred_username
roles_key: roles
openid_connect_url: entra url
authentication_backend:
type: noop
on the subject key, i have used email and preffered name none worked.
on the azure side i have enabled app roles on the registered application
admin and read_only
i also have the following enabled for token configuration
- prefered_username
what am i missing. i have been on this for weeks, i couldget my username or email to popup on the dashboard. Kindly assist
