# OpenID Connect. Authentication finally failed

**URL:** <https://forum.opensearch.org/t/openid-connect-authentication-finally-failed/736>\
**Category:** Security\
**Created:** [May 22, 2019, 2:17pm UTC](https://forum.opensearch.org/t/openid-connect-authentication-finally-failed/736 "2019-05-22T14:17:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![daniel.calvo](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@daniel.calvo](https://forum.opensearch.org/u/daniel.calvo)\
**Post date:** [May 22, 2019, 2:17pm UTC](https://forum.opensearch.org/t/openid-connect-authentication-finally-failed/736/1 "2019-05-22T14:17:16Z")

</div>

Hi,

I am trying to follow what it is explained in [https://opendistro.github.io/for-elasticsearch-docs/docs/security/openid-connect/](https://opendistro.github.io/for-elasticsearch-docs/docs/security/openid-connect/).

My complete configuration file is:

```auto
opendistro_security:
  dynamic:
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
    authc:
      basic_internal_auth_domain:
        http_enabled: true
        transport_enabled: true
        enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: internal
      openid_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: openid
          challenge: false
          config:
            subject_key: preferred_username
            roles_key: roles
            openid_connect_url: http://keycloak:8080/auth/realms/master/.well-known/openid-configuration
        authentication_backend:
          type: noop

```

Elasticsearch seems to start properly but when I try to call to the API using a token obtained from Keycloak, I get the following error:

```auto
elasticsearch_1 | [2019-05-22T14:11:26,089][WARN][c.a.o.s.h.HTTPBasicAuthenticator] [4nyZqQ2] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'
elasticsearch_1 | [2019-05-22T14:11:26,091][WARN][c.a.d.a.h.j.AbstractHTTPJwtAuthenticator] [4nyZqQ2] Failed to get roles from JWT claims with roles_key 'roles'. Check if this key is correct and available in the JWT payload.
elasticsearch_1 | [2019-05-22T14:11:26,094][INFO][c.a.o.s.p.PrivilegesEvaluator] [4nyZqQ2] No cluster-level perm match for User [name=test, roles=[], requestedTenant=null] Resolved [aliases=[*], indices=[*], allIndices=[*], types=[*], originalRequested=[], remoteIndices=[]] [Action [cluster:monitor/main]] [RolesChecked [own_index]]
elasticsearch_1 | [2019-05-22T14:11:26,096][INFO][c.a.o.s.p.PrivilegesEvaluator] [4nyZqQ2] No permissions for [cluster:monitor/main]
elasticsearch_1 | [2019-05-22T14:14:33,729][WARN][c.a.o.s.h.HTTPBasicAuthenticator] [4nyZqQ2] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic'
elasticsearch_1 | [2019-05-22T14:14:33,730][WARN][c.a.o.s.a.BackendRegistry] [4nyZqQ2] Authentication finally failed for null from 172.21.0.1:34012

```

---

<div class="post-metadata">

**Author:** ![lpourrat](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/lpourrat/32/241_2.png) [@lpourrat](https://forum.opensearch.org/u/lpourrat)\
**Post date:** [July 29, 2019, 3:04pm UTC](https://forum.opensearch.org/t/openid-connect-authentication-finally-failed/736/2 "2019-07-29T15:04:08Z")

</div>

The JWT token you are using does not have a valid structure (roles\_key ‘roles’) means it expect to have a claim field named “roles” at the root of your JWT token.

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [April 16, 2021, 11:21am UTC](https://forum.opensearch.org/t/openid-connect-authentication-finally-failed/736/3 "2021-04-16T11:21:14Z")

</div>

@daniel.calvo Did you get this resolved?