Versions (): v 3.1.0
Describe the issue:
Hello, i have lot of following logs (~15) during the auth (active directory) with opensearch dashboards behind NGINX. The auth is in success and the authorization is OK also.
[2025-10-01T17:05:40,804][WARN ][o.o.s.a.BackendRegistry ] [toto.com] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
[2025-10-01T17:05:40,804][INFO ][audit ] [toto.com] {"audit_cluster_name":"cluster-01","audit_node_name":"toto.com","audit_rest_request_method":"HEAD","audit_category":"FAILED_LOGIN","audit_request_origin":"REST","audit_node_id":"Wz0p-N_mTICnKbf3pUpjMQ","audit_request_layer":"REST","audit_rest_request_path":"/","@timestamp":"2025-10-01T15:05:40.804+00:00","audit_request_effective_user_is_admin":false,"audit_format_version":4,"audit_request_remote_address":"10.XX.XX.XX","audit_node_host_address":"10.XX.XX.XX","audit_rest_request_headers":{"Connection":["keep-alive"],"Host":["toto.com:9200"],"Content-Length":["0"],"x-opensearch-product-origin":["opensearch-dashboards"]},"audit_request_effective_user":"<NONE>","audit_node_host_name":"10.XX.XX.XX"}
Without NGINX, it’s OK
I tried to change
- order between ldap and internal,
- http_authenticator challenge true and false
Configuration:
config opensearch
config:
dynamic:
http:
xff:
enabled: true
internalProxies: '.*'
remoteIpHeader: "X-Forwarded-For"
authc:
basic_internal_auth_domain:
order: 1
description: "HTTP basic authentication using the internal user database"
http_enabled: true
transport_enabled: true
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: internal
ldap:
http_enabled: true
transport_enabled: false
order: 0
http_authenticator:
type: basic
challenge: true
authentication_backend:
type: ldap
config:
...
authz:
ldap:
http_enabled: true
transport_enabled: true
authorization_backend:
type: ldap
config:
...
config NGINX
...
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://opensearch_dashboards;
proxy_ssl_verify off;
# Response buffer settings
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
...