# OpenID connect in Opensearch dashboard: too\_many\_redirects

**URL:** <https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609>\
**Category:** OpenDistro\
**Created:** [November 16, 2021, 9:37am UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609 "2021-11-16T09:37:24Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![skopen](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@skopen](https://forum.opensearch.org/u/skopen)\
**Post date:** [November 16, 2021, 9:37am UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/1 "2021-11-16T09:37:24Z")

</div>

opensearch\_security:  
auth:  
type: “openid”  
openid:  
connect\_url: “xxxxxx.well-known/openid-configuration”  
client\_id: “xxx”  
client\_secret: “xxxxx”  
scope: “openid”  
#base\_redirect\_url: “[http://xxxxhost:5601](http://xxxxhost:5601/)”  
multitenancy:  
enabled: true  
tenants:  
preferred:

- Private
- Global  
readonly\_mode:  
roles:
- kibana\_read\_only  
cookie:  
secure: true  
opensearch:  
hosts:
- [https://xxxxxhost:9200](https://xxxxxhost:9200/)  
ssl:  
verificationMode: none  
username: “kibanaserver”  
password: “kibanaserver”  
requestHeadersWhitelist:
- authorization
- securitytenant

Able to authenticate with user and pwd , but after that its throws too\_many\_directs…kindly help me on this issue please.

---

<div class="post-metadata">

**Author:** ![GnarlyCapricorne](https://avatars.discourse-cdn.com/v4/letter/g/ad7895/32.png) [@GnarlyCapricorne](https://forum.opensearch.org/u/GnarlyCapricorne)\
**Post date:** [November 16, 2021, 2:15pm UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/2 "2021-11-16T14:15:54Z")

</div>

hello,

Cookie secure a false please ? and tell me

---

<div class="post-metadata">

**Author:** ![skopen](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@skopen](https://forum.opensearch.org/u/skopen)\
**Post date:** [November 17, 2021, 8:14am UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/3 "2021-11-17T08:14:18Z")

</div>

Hi GnarlyCapricorne, Thanks for the reply . please find the below error after set secure: false

“tags”:[“info”,“plugins-service”],“pid”:1,“message”:“Plugin "visTypeXy" is disabled.”}  
{“type”:“log”,“@timestamp”:“2021-11-17T06:26:56Z”,“tags”:[“warning”,“config”,“deprecation”],“pid”:1,“message”:“"cpu.cgroup.path.override" is deprecated and has been replaced by "ops.cGroupOverrides.cpuPath"”}  
{“type”:“log”,“@timestamp”:“2021-11-17T06:26:56Z”,“tags”:[“warning”,“config”,“deprecation”],“pid”:1,“message”:“"cpuacct.cgroup.path.override" is deprecated and has been replaced by "ops.cGroupOverrides.cpuAcctPath"”}  
{“type”:“log”,“@timestamp”:“2021-11-17T06:26:57Z”,“tags”:[“info”,“plugins-system”],“pid”:1,“message”:“Setting up [45] plugins: [alertingDashboards,usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,home,console,apmOss,management,indexPatternManagement,advancedSettings,savedObjects,securityDashboards,indexManagementDashboards,anomalyDetectionDashboards,dashboard,notebooksDashboards,visualizations,visTypeVega,visTypeTimeline,timeline,visTypeTable,visTypeMarkdown,tileMap,regionMap,inputControlVis,ganttChartDashboards,visualize,traceAnalyticsDashboards,reportsDashboards,queryWorkbenchDashboards,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,bfetch]”}  
{“type”:“log”,“@timestamp”:“2021-11-17T06,“tags”:[“fatal”,“root”],“pid”:1,“message”:“Error: "SameSite: None" requires Secure connection\n at validateOptions (/usr/share/opensearch-dashboards/src/core/server/http/cookie\_session\_storage.js:92:11)\n at createCookieSessionStorageFactory (/usr/share/opensearch-dashboards/src/core/server/http/cookie\_session\_storage.js:107:3)\n at HttpServer.createCookieSessionStorageFactory (/usr/share/opensearch-dashboards/src/core/server/http/http\_server.js:409:103)\n at Object.createCookieSessionStorageFactory (/usr/share/opensearch-dashboards/src/core/server/http/http\_server.js:110:64)\n at SecurityPlugin.setup (/usr/share/opensearch-dashboards/plugins/securityDashboards/server/plugin.ts:97:105)”}  
{“type”:“log”,”@timestamp":“2021-11-17T06:26:59Z”,“tags”:[“info”,“plugins-system”],“pid”:1,“message”:“Stopping all plugins.”}

---

<div class="post-metadata">

**Author:** ![igonzalez](https://avatars.discourse-cdn.com/v4/letter/i/53a042/32.png) [@igonzalez](https://forum.opensearch.org/u/igonzalez)\
**Post date:** [November 17, 2021, 1:55pm UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/4 "2021-11-17T13:55:34Z")

</div>

Hi @skopen  
I have the same problem (too\_many\_redirects) with OpenDistro + Kibana. Here is the thread: [OpenID Connect in Kibana Open Distro: too\_many\_redirects](https://forum.opensearch.org/t/openid-connect-in-kibana-open-distro-too-many-redirects/7377)  
I see that you are testing with OpenSearch. Let’s see if you can make it work for you.

---

<div class="post-metadata">

**Author:** ![skopen](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@skopen](https://forum.opensearch.org/u/skopen)\
**Post date:** [November 29, 2021, 7:59am UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/5 "2021-11-29T07:59:38Z")

</div>

config:  
# There are multiple ways to define the configuration here:  
# \* If you define anything under data, the chart will automatically create  
# a secret and mount it.  
# \* If you define securityConfigSecret, the chart will assume this secret is  
# created externally and mount it.  
# \* It is an error to define both data and securityConfigSecret.  
#securityConfigSecret:  
data:  
config.yml: |-  
dynamic:  
authc:  
basic\_internal\_auth\_domain:  
description: “Authenticate via HTTP Basic against internal users database”  
http\_enabled: true  
transport\_enabled: true  
order:  
http\_authenticator:  
type: basic  
challenge: false  
authentication\_backend:  
type: internal  
openid\_auth\_domain:  
http\_enabled: true  
transport\_enabled: true  
order: 1  
http\_authenticator:  
type: openid  
challenge: false  
config:  
subject\_key: preferred\_username  
roles\_key: roles  
openid\_connect\_url: xxxx  
skip\_users:  
- kibanaro  
- kibanaserver  
- logstash  
- adminp  
- admin  
- filebeat\_internal  
- kibanauser  
authentication\_backend:  
type: noop

```
  # internal_users.yml: |-

```

Its mandatory to mention internal user and role mapping ?  
And also authc mentioned above yaml is correct. please find log as well

[2021-11-29T07:22:30,795][INFO][o.o.s.c.ConfigurationRepository] [opensearch-cluster-master-0] Node started, try to initialize it. Wait for at least yellow cluster state…  
[2021-11-29T07:22:33,335][INFO][o.o.s.s.ConfigHelper] [opensearch-cluster-master-0] Will update ‘config’ with /usr/share/opensearch/plugins/opensearch-security/securityconfig/config.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false  
[2021-11-29T07:22:33,388][ERROR][o.o.s.c.ConfigurationRepository] [opensearch-cluster-master-0] Cannot apply default config (this is maybe not an error!)  
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field “authc” (class org.opensearch.security.securityconf.impl.v7.ConfigV7), not marked as ignorable (one known property: “dynamic”])  
at [Source: (String)"{“dynamic”:{“authc”:{“basic\_internal\_auth\_domain”:{“description”:“Authenticate via HTTP Basic against internal users database”,“http\_enabled”:true,“transport\_enabled”:true,“order”:null,“http\_authenticator”:{“type”:“basic”,“challenge”:false},“authentication\_backend”:{“type”:“internal”}},“openid\_auth\_domain”:{“http\_enabled”:true,“transport\_enabled”:true,“order”:1,“http\_authenticator”:{“type”:“openid”,“challenge”:false,“config”:{“subject\_key”:“preferred\_username”,“roles\_key”:“roles”,“openid\_connect”[truncated 265 chars]; line: 1, column: 22] (through reference chain: org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration[“dynamic”]-\>org.opensearch.security.securityconf.impl.v7.ConfigV7[“authc”])  
at com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:61) ~[jackson-databind-2.11.2.jar:2.11.2]  
at com.fasterxml.jackson.databind.DeserializationContext.handleUnknownProperty(DeserializationContext.java:855) ~[jackson-databind-2.11.2.jar:2.11.2]  
at com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:1212) ~[jackson-databind-2.11.2.jar:2.11.2]

---

<div class="post-metadata">

**Author:** ![skopen](https://avatars.discourse-cdn.com/v4/letter/s/e95f7d/32.png) [@skopen](https://forum.opensearch.org/u/skopen)\
**Post date:** [December 6, 2021, 3:26pm UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/6 "2021-12-06T15:26:08Z")

</div>

Hi @igonzalez  
please find the below config  
config:

# Default OpenSearch Dashboards configuration from docker image of Dashboards

opensearch\_dashboards.yml:  
server:  
name: kibana  
host: [xxxxxx.com](http://xxxxxx.com)  
port: 5601

# Dashboards TLS Config (Ensure the cert files are present before enabling SSL

```
  ssl:
    enabled: true
    key: /usr/share/opensearch-dashboards/config/test-key.pem
    certificate: /usr/share/opensearch-dashboards/config/test.pem

# determines how dashboards will verify certificates (needs to be none for default opensearch certificates to work)
opensearch_security:
  auth:
    type: "openid"
  openid:
    connect_url: "https://login.microsoftonline.com/xxxxxx/v2.0/.well-known/openid-configuration"
    client_id: "xxx"
    client_secret: "x"
    scope: "openid"
    base_redirect_url: "https://xxxxx.com/"
  multitenancy:
    enabled: true
    tenants:
      preferred:
        - Private
        - Global
  readonly_mode:
    roles:
      - kibana_read_only
  cookie:
    secure: false
opensearch:
  hosts: "https://localhost:9200"
  ssl:
    verificationMode: none
    #certificateAuthorities: ["/usr/share/opensearch/config/root-ca.pem"]
  username: "kibanaserver"
  password: "kibanaserver"
  requestHeadersWhitelist:
    - Authorization
    - security_tenant
    - securitytenant
  logQueries: true
logging:
  verbose: true

```

If i enable the #certificateAuthorities: [“/usr/share/opensearch/config/root-ca.pem”] , getting directory not found even pem file is there.  
With above configuration,able to access the dns url but its ends up with TOO\_many redirects.

---

<div class="post-metadata">

**Author:** ![igonzalez](https://avatars.discourse-cdn.com/v4/letter/i/53a042/32.png) [@igonzalez](https://forum.opensearch.org/u/igonzalez)\
**Post date:** [December 8, 2021, 10:27am UTC](https://forum.opensearch.org/t/openid-connect-in-opensearch-dashboard-too-many-redirects/7609/7 "2021-12-08T10:27:52Z")

</div>

Thanks to all for the help.  
We finally got it to work :-).  
In some changes, although we rebooted the system, we did not execute “securityadmin.sh” and the changes had no effect.

> **[Apply Changes with securityadmin.sh](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/security-admin/)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.

Perhaps the same thing is happening to many people …