# Open Search and Azure AD integration issue

**URL:** <https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102>\
**Category:** OpenSearch\
**Tags:** configure, security-issue\
**Created:** [April 11, 2025, 8:49pm UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102 "2025-04-11T20:49:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![malyadri](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@malyadri](https://forum.opensearch.org/u/malyadri)\
**Post date:** [April 11, 2025, 8:49pm UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102/1 "2025-04-11T20:49:23Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
version: 2.32.0  
appVersion: “2.19.1”

**Describe the issue** :  
I am trying to integrate with azure ad using OpenID.  
but once adding configuration OpenSearch pod is continuously restarted

**Configuration** :  
[values](https://goldenfuture1-my.sharepoint.com/:u:/g/personal/santhosh_tiriveedhi_goldenfuturetechnologies_com_au/ESzL8BdoxiVKkhaBiBBSu-QBlUl6hRVpACLMnYDxTH0-Sg?e=jeeaWX)

```auto
securityConfig:
  enabled: true
  path: "/usr/share/opensearch/config/opensearch-security"
  actionGroupsSecret:
  configSecret:
  internalUsersSecret:
  rolesSecret:
  rolesMappingSecret:
  tenantsSecret: # The following option simplifies securityConfig by using a single secret and
  config:
    # There are multiple ways to define the configuration here:
    # * If you define anything under data, the chart will automatically create
    # a secret and mount it. This is best option to choose if you want to override all the
    # existing yml files at once.
    # * If you define securityConfigSecret, the chart will assume this secret is
    # created externally and mount it. This is best option to choose if your intention is to
    # only update a single yml file.
    # * It is an error to define both data and securityConfigSecret.
    securityConfigSecret: ""
    dataComplete: true
    data: 
      config.yml: |-
        _meta:
          type: "config"
          config_version: 2
        config:
          dynamic:
            http:
              anonymous_auth_enabled: false
            authc:
              basic_internal_auth_domain:
                description: "Authenticate via HTTP Basic against internal users database"
                http_enabled: true
                transport_enabled: true
                order: 0
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  type: intern
              openid_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 1
                http_authenticator:
                  type: openid
                  challenge: false
                  config:
                    subject_key: preferred_username
                    roles_key: roles
                    openid_connect_url: https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration
                authentication_backend:
                  type: noop    
   
      # internal_users.yml: |-
      # roles.yml: |-
      # roles_mapping.yml: |-
      # action_groups.yml: |-
      # tenants.yml: |-

```

# How long to wait for opensearch to stop gracefully

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9dc1ff1a843ccb0d23f323902eee4b6076c270e1.png)

---

<div class="post-metadata">

**Author:** ![malyadri](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@malyadri](https://forum.opensearch.org/u/malyadri)\
**Post date:** [April 11, 2025, 8:51pm UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102/2 "2025-04-11T20:51:28Z")

</div>

@pablo please help me on this

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 14, 2025, 9:26am UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102/3 "2025-04-14T09:26:09Z")

</div>

@malyadri, I’ve checked your original post for values.yml content and see that you’ve only set the OpenSearch admin password in extraEnvs.  
You’ll need to disable the OpenSearch demo security configuration to use your custom files.

```auto
- name: DISABLE_INSTALL_DEMO_CONFIG
  value: true

```

Also, you must provide content for the remaining files.

> [@malyadri](#):
>
> ```auto
> # internal_users.yml: |-
> # roles.yml: |-
> # roles_mapping.yml: |-
> # action_groups.yml: |-
> # tenants.yml: |-
> 
> ```

See my working example.

> [@How to change the default kibanaserver password for OpenSearch Dashboards?](https://forum.opensearch.org/t/how-to-change-the-default-kibanaserver-password-for-opensearch-dashboards/23952/11):
>
> @Hung Please find my OpenSearch and OpenSearch Dashboards values.yml below. OpenSearch values.yml --- clusterName: "opensearch-cluster" nodeGroup: "master" # If discovery.type in the opensearch configuration is set to "single-node", # this should be set to "true" # If "true", replicas will be forced to 1 singleNode: false # The service that non master groups will try to connect to when joining the cluster # This should be set to clusterName + "-" + nodeGroup for your master group masterServi…

---

<div class="post-metadata">

**Author:** ![malyadri](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@malyadri](https://forum.opensearch.org/u/malyadri)\
**Post date:** [April 14, 2025, 10:27am UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102/4 "2025-04-14T10:27:16Z")

</div>

- name: DISABLE\_INSTALL\_DEMO\_CONFIG  
value: true

if i keep it this do i need to genarate certifactes ,  
if requred then how to genarate using cert manager

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 15, 2025, 9:17am UTC](https://forum.opensearch.org/t/open-search-and-azure-ad-integration-issue/24102/5 "2025-04-15T09:17:14Z")

</div>

@malyadri Yes, you must generate new SSL certificates.  
You can use OpenSSL to achieve that.

> **[Generating self-signed certificates](https://docs.opensearch.org/latest/security/configuration/generate-certificates/)**
>
> If you don’t have access to a certificate authority (CA) for your organization and want to use OpenSearch for non-demo purposes, you can generate your own...

Then mount certificates as a secret.

> [@How to change the default kibanaserver password for OpenSearch Dashboards?](https://forum.opensearch.org/t/how-to-change-the-default-kibanaserver-password-for-opensearch-dashboards/23952/11):
>
> ```auto
> secretMounts: 
> - name: opensearch-certs
> secretName: opensearch-certs
> path: /usr/share/opensearch/config/customSSL
> 
> ```