Hey - maybe someone can point out what I have wrong regarding my OpenID Connect setup with AWS Cognito. Any help greatly appreciated!
I am using OpenDistro For Elasticsearch v1.13.2 (amazon/opendistro-for-elasticsearch:1.13.2) but I just cannot get it to connect via OpenID to Amazon Cognito - no matter what I seem to do it appears to be stuck in a login loop. For avoidance of doubt, I am not using AWS Elasticsearch Service - this is just some simple containers.
I’ve included a picture below indicating the network activity. Kibana and Elasticsearch are configured for OpenID. I think the Cognito half is fine and it is going wrong when navigating back to Kibana, but I am not sure. I believe the user being logged in to has the admin role
When accessing Kibana, I believe the following occurs (based on the image below):
- Kibana is accessed, which redirects to
/auth/openid/login?nextUrl=/ - This next page then redirects to my AWS OAuth endpoint as seen in the “location” HTTP response hader
https://<aws-auth-endpoint-id>.auth.eu-west-2.amazoncognito.com/oauth2/authorize?client_id=<clientid>&response_type=code&redirect_uri=https://<hostname>-elk.dev.internal:5601/auth/openid/login&state=beBx_3sG9xjezfgOHHFyfR&scope=openid
- Login completes on Cognito (user completes auth flow if no saved session already). Cognito redirects back to the
redirect_urilocation, back on Kibana along with thecodeURI parameter (which I have no reason to believe isn’t valid). -
Kibana redirects again to
/auth/openid/login. Infinite loop begins. - Browser detects and breaks loop after approx 5 iterations with a “The page isn’t redirecting properly” warning.
I have attempted to enable more logging but have not been able to find any useful logs. Not sure if I’ve done it wrong.
I have read quite a lot of the OpenID related posts on the forum. I see there have been others with infinite loops but I have not been able to verify if it is the same issue. In some cases Kibana did not have rights to login as kibana/kibanaserver into Elasticsearch but I don’t believe this is the case. Regardless, I’ve posted my security config files below.
Can anyone see what I’ve done wrong? Or any way I can get increased logging? The Cognito auth flow looks like it should be valid, I just can’t work out why Kibana rejects it and goes back into a loop!
Network Connectivity upon Login
/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/config.yml
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
xff:
enabled: false
internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
authc:
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
subject_key: preferred_username
roles_key: roles
openid_connect_url: "https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_$$REDACTED_ID$$/.well-known/openid-configuration"
skip_users:
- kibanaro
- kibanaserver
- admin
authentication_backend:
type: noop
basic_internal_auth_domain:
description: "Authenticate via HTTP Basic against internal users database"
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: internal # Original value was "intern" but docs say "internal"?
# No authz entries actually set up -these are the defaults
authz:
roles_from_myldap:
description: "Authorize via LDAP or Active Directory"
http_enabled: false
transport_enabled: false
authorization_backend:
type: ldap
config:
# enable ldaps
enable_ssl: false
# enable start tls, enable_ssl should be false
enable_start_tls: false
# send client certificate
enable_ssl_client_auth: false
# verify ldap hostname
verify_hostnames: true
hosts:
- localhost:8389
bind_dn: null
password: null
rolebase: 'ou=groups,dc=example,dc=com'
# Filter to search for roles (currently in the whole subtree beneath rolebase)
# {0} is substituted with the DN of the user
# {1} is substituted with the username
# {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
rolesearch: '(member={0})'
# Specify the name of the attribute which value should be substituted with {2} above
userroleattribute: null
# Roles as an attribute of the user entry
userrolename: disabled
#userrolename: memberOf
# The attribute in a role entry containing the name of that role, Default is "name".
# Can also be "dn" to use the full DN as rolename.
rolename: cn
# Resolve nested roles transitive (roles which are members of other roles and so on ...)
resolve_nested_roles: true
userbase: 'ou=people,dc=example,dc=com'
# Filter to search for users (currently in the whole subtree beneath userbase)
# {0} is substituted with the username
usersearch: '(uid={0})'
# Skip users matching a user name, a wildcard or a regex pattern
#skip_users:
# - 'cn=Michael Jackson,ou*people,o=TEST'
# - '/\S*/'
roles_from_another_ldap:
description: "Authorize via another Active Directory"
http_enabled: false
transport_enabled: false
authorization_backend:
type: ldap
kibana.yml
server.host: "<kibanahostname>-elk.dev.internal"
elasticsearch.hosts: http://<elasticsearchhostname>-elk.dev.internal:9200
elasticsearch.ssl.verificationMode: none
elasticsearch.username: kibanaserver
elasticsearch.password: kibanaserver
elasticsearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
server.ssl.enabled: true
server.ssl.certificate: "/usr/share/kibana/config/server.pem.crt" # PEM
server.ssl.key: "/usr/share/kibana/config/server.pem.key" # PEM
# Use OpenIDConnect (OIDC) logon
opendistro_security.auth.type: "openid"
opendistro_security.openid.connect_url: "https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_$$REDACTED_ID$$/.well-known/openid-configuration"
opendistro_security.openid.client_id: "$$REDACTED_CLIENT_ID$$"
opendistro_security.openid.client_secret: "$$REDACTED_CLIENT_SECRET$$"
opendistro_security.openid.scope: "openid" # Also tested with default of "openid profile email address phone"
#opendistro_security.openid.header: "Authorization" # Defaults to "Authorization"
opendistro_security.openid.base_redirect_url: "https://<hostname>-elk.dev.internal:5601"
opendistro_security.multitenancy.enabled: true
opendistro_security.multitenancy.tenants.preferred: ["Private", "Global"]
opendistro_security.readonly_mode.roles: ["kibana_read_only"]
# Use this setting if you are running kibana without https
opendistro_security.cookie.secure: true
newsfeed.enabled: false
telemetry.optIn: false
telemetry.enabled: false
security.showInsecureClusterWarning: false
map.includeElasticMapsService: false
