# OpenId authentication failing with Certificate issue

**URL:** <https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580>\
**Category:** Security\
**Created:** [September 23, 2019, 3:52pm UTC](https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580 "2019-09-23T15:52:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivani](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@shivani](https://forum.opensearch.org/u/shivani)\
**Post date:** [September 23, 2019, 3:52pm UTC](https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580/1 "2019-09-23T15:52:57Z")

</div>

Hi,

I am using elasticsearch-oss 7.0.1 rpm and installed opendistro\_security(1.0.0.2) standalone plugin.  
I am trying to authenticate access to elasticsearch via keycloak by enabling openid authentication.  
Authentication is failing with the error: `sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target`

The keycloak server is configured with a self signed certificate and I have added this certificate to JAVA truststore where elasticsearch is running. I have also configured this certificate in pemtrustedcas\_filepath parameter as shown below.

Attaching the relevant section of the config file.

> ```
> basic_internal_auth_domain:
> description: "Authenticate via HTTP Basic against internal users database"
> http_enabled: true
> transport_enabled: true
> order: 0
> http_authenticator:
> type: basic
> challenge: false
> authentication_backend:
> type: intern
> openid_auth_domain:
> http_enabled: true
> order: 1
> http_authenticator:
> type: openid
> challenge: false
> config:
> subject_key: preferred_username
> roles_key: roles
> openid_connect_url: https://<keycloak-server>/auth/realms/elk/.well-known/openid-configuration
> pemtrustedcas_filepath: /home/tls.pem
> authentication_backend:
> type: noop
> 
> ```

Can you please look into this and help me resolve this error?

Thanks,  
Shivani

---

<div class="post-metadata">

**Author:** ![miro-grapeup](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@miro-grapeup](https://forum.opensearch.org/u/miro-grapeup)\
**Post date:** [December 12, 2019, 8:43am UTC](https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580/2 "2019-12-12T08:43:59Z")

</div>

Hi, I know this topic was created some time ago but if the problem is there please take a look here: [Incorrect documentation on OpenID config](https://forum.opensearch.org/t/incorrect-documentation-on-openid-config/2003)

Probably you have an incorrect configuration with `pemtrustedcas_filepath` as it requires `openid_connect_idp` prefix.

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [May 14, 2021, 1:53pm UTC](https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580/3 "2021-05-14T13:53:00Z")

</div>

@shivani did you get this resolved? If not which version of odfe are you running?

---

<div class="post-metadata">

**Author:** ![shivani](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@shivani](https://forum.opensearch.org/u/shivani)\
**Post date:** [May 18, 2021, 8:29am UTC](https://forum.opensearch.org/t/openid-authentication-failing-with-certificate-issue/1580/4 "2021-05-18T08:29:21Z")

</div>

@Anthony, yes it did get resolved after adding openid\_connect\_idp in the configuration for ssl parameters. Seems like a documentation bug in the openid page that needs to be fixed 🙂 - [OpenID Connect - Open Distro Documentation](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/openid-connect/#enabling-tls) :

> ```
> openid_auth_domain:
> http_enabled: true             
> order: 1
> http_authenticator:
> type: openid
> challenge: false
> config:
> subject_key: preferred_username
> roles_key: roles
> openid_connect_url: https://<keycloak-server>/auth/realms/elk/.well-known/openid-configuration
> openid_connect_idp:
> enable_ssl: true
> verify_hostnames: false
> pemtrustedcas_filepath: /home/tls.pem
> 
> ```