# OpenID with Auth0 **URL:** \ **Category:** Security\ **Tags:** troubleshoot\ **Created:** [November 28, 2024, 6:33am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595 "2024-11-28T06:33:51Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 6:33am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/1 "2024-11-28T06:33:51Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch & Dashboard 2.18.0 Cluster deployed using the Ansible playbook Dashboard is behind Nginx proxy **Describe the issue** : `I can't get OpenID working using Auth0 as IDP`. Response Error: 403 Forbidden OpenId authentication failed: Error: Authentication Exception I can log in fine using the internal user DB. I do get to the Auth0 login page, have verified the login is success. After login I get redirected back to OpenSearch dashboard but OpenSearch fails with 403. # Dashboard Settings ``` opensearch.requestHeadersWhitelist: [authorization,securitytenant] opensearch_security.multitenancy.enabled: false opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"] opensearch_security.readonly_mode.roles: ["kibana_read_only"] opensearch_security.cookie.secure: false opensearch_security.auth.type: openid opensearch_security.openid.base_redirect_url: "https://my-domain.au/opensearch" opensearch_security.openid.client_id: "??????????????????????" opensearch_security.openid.scope: "openid profile email" opensearch_security.openid.client_secret: "??????????????????????????????" opensearch_security.openid.connect_url: "https://something.auth0.com/.well-known/openid-configuration" opensearch_security.openid.verify_hostnames: true server.basePath: "/opensearch" ``` # Security Config ``` http: anonymous_auth_enabled: false xff: enabled: false internalProxies: ".*" remoteIpHeader: "x-forwarded-for" authc: basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: false order: 0 http_authenticator: type: basic challenge: false authentication_backend: type: internal openid_auth_domain: description: "Authenticate via OpenID" http_enabled: true transport_enabled: true order: 1 http_authenticator: type: openid challenge: false config: enable_ssl: false verify_hostnames: false subject_key: name roles_key: opensearch_roles openid_connect_url: https://something.auth0.com/.well-known/openid-configuration kibana_url: https://mydomain.com.au/opensearch authentication_backend: type: noop authz: {} ``` I tested the Auth0 application using **OpenID Connect Playground** and a JWT similar to this is produced: ``` { "opensearch_roles": "admin", "nickname": "clint", "name": "clint@somewhere.com.au", "picture": "https://s.gravatar.com/avatar/ec9c1e2bb19a819807314c91ac41c872?s=480&r=pg&d=https%3A%2F%2Fcdn.auth0.com%2Favatars%2Fcl.png", "updated_at": "2024-11-27T03:33:47.558Z", "email": "guy@somewhere.com.au", "email_verified": false, "iss": "https://something.auth0.com/", "aud": "????????", "iat": 1732680292, "exp": 1732716292, "sub": "auth0|????????", "sid": "???????" } ``` # Use the ADMIN role to get full access The flow is shown in the screen shot. - https:///my-domain/opensearch/auth/openid/login - shows OpenSearch login page - https:///domain.auth0.com/authorize? - OpenSearch redirects to Auth0 - User logs into Auth0 - https:///my-domain/opensearch/auth/openid/login - Auth0 redirects back to OpenSearch - BACKEND - OpenSearch calls Auth0 to convert code into token and get JWT - ??? - IT BREAKS I assume that OpenSearch is sending POST request to Auth0 to convert code into token and failing to process the response from Auth0 but I can’t see any detailed logs. # Tried to enable DEBUG logs in OpenSearch I can’t see how to enable DEBUG logs for the dashboard. I tried setting DEBUG level on a core node but don’t see any logs that relate to this issue. **Relevant Logs or Screenshots** : ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/4fe4375b0a9fda095302b88b5479d952a3e8d11a.png) ---
**Author:** ![mgelszinnis](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mgelszinnis](https://forum.opensearch.org/u/mgelszinnis)\ **Post date:** [November 28, 2024, 8:31am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/2 "2024-11-28T08:31:23Z")
Not 100% sure if thats the issue, but the the Authorization header starts with a capital A [Authorization - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [November 28, 2024, 1:18pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/3 "2024-11-28T13:18:09Z")
> [@cvdb](#): > > ` subject_key: name` > [@cvdb](#): > > `"name": "clint@somewhere.com.au",` Hi @cvdb, Could you run a quick test by mapping your user to all\_access directly and try logging in via OpenID: ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/bae026974a8b78c50f25ae3672c91c512aefa156.png) If successful please run the following (in Dev Tools) and share the output: `GET /_plugins/_security/authinfo?pretty` Best, mj ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:32pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/4 "2024-11-28T22:32:49Z")
Hi mj, I did not create an internal user: ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/fe96211c26bc2effd127861cfa1063c813de1df4.png) ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:35pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/5 "2024-11-28T22:35:06Z")
but I added the user as a CUSTOM property ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/91a31925c73fdb7baea1b074777bd3916e6a23f9.png) Same error… ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:36pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/6 "2024-11-28T22:36:10Z")
> [@Mantas](#): > > GET /\_plugins/\_security/authinfo?pretty { “user”: “User [name=admin, backend\_roles=[admin], requestedTenant=null]”, “user\_name”: “admin”, “user\_requested\_tenant”: null, “remote\_address”: “10.100.3.8:59786”, “backend\_roles”: [ “admin” ], “custom\_attribute\_names”: , “roles”: [ “own\_index”, “all\_access” ], “tenants”: { “global\_tenant”: true, “admin”: true }, “principal”: null, “peer\_certificates”: “0”, “sso\_logout\_url”: null } ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:48pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/7 "2024-11-28T22:48:54Z")
unfortunately all I can see in the dashboard logs: ```auto Nov 28 22:45:18 dashboard1 opensearch-dashboards[27785]: {"type":"log","@timestamp":"2024-11-28T22:45:18Z","tags":["error","plugins","securityDashboards"],"pid":27785,"message":"OpenId authentication failed: Error: Authentication Exception"} ``` ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:50pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/8 "2024-11-28T22:50:57Z")
I see this on a core node, not sure if its related: ```auto [2024-11-28T22:45:18,104][WARN][o.o.s.h.HTTPBasicAuthenticator] [core1] No 'Basic Authorization' header, send 401 and 'WWW-Authenticate Basic' ``` ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [November 28, 2024, 10:56pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/9 "2024-11-28T22:56:48Z")
I did also adjust this, same error: ```auto opensearch.requestHeadersWhitelist: [Authorization,securitytenant] ``` ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [December 5, 2024, 1:48pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/10 "2024-12-05T13:48:59Z")
Have you tied setting log level to debug/trace? more here: [Troubleshoot OpenID Connect - OpenSearch Documentation](https://opensearch.org/docs/latest/troubleshoot/openid-connect/#set-log-level-to-debug) Best, mj ---
**Author:** ![ochavan](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@ochavan](https://forum.opensearch.org/u/ochavan)\ **Post date:** [December 5, 2024, 4:22pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/11 "2024-12-05T16:22:02Z")
I am also facing same issue ---
**Author:** ![cwperks](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/cwperks/32/4968_2.png) [@cwperks](https://forum.opensearch.org/u/cwperks)\ **Post date:** [December 6, 2024, 4:14am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/12 "2024-12-06T04:14:02Z")
Do you see any errors in the opensearch logs? AFAIK `kibana_url` is not a setting of openid authenticator (it is for SAML). It may be failing to instantiate an OpenID authenticator on the backend. ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [December 6, 2024, 5:37pm UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/13 "2024-12-06T17:37:32Z")
> [@cvdb](#): > > `opensearch_security.openid.base_redirect_url: "https://my-domain.au/opensearch"` > [@cvdb](#): > > `kibana_url: https://mydomain.com.au/opensearch` Could you please confirm if the Kibana URLs are correct (please see above)? best, mj ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [December 17, 2024, 3:09am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/14 "2024-12-17T03:09:58Z")
Hi Mantas & cwperks, I was deploying my cluster using the Ansible playbook so I suspect most of my issues are related to that. It seems that the playbook does not deal with some things well. I had been running the playbook multiple times to apply changes while testing. I started out using BASIC auth and then later changed to OpenID. I checked my security config: `_plugins/_security/api/securityconfig?pretty` and it was not correct. Was still setup using BASIC auth. I started with a clean ENV and ran the playbook FIRST-TIME using OpenID settings and it then worked. One other thing, I was initially trying to use MULTIPLE-AUTH-BACKENDS. I wanted to fall back to the basic auth. Once I tried without multiple, and only using OpenID it worked. ---
**Author:** ![cvdb](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cvdb](https://forum.opensearch.org/u/cvdb)\ **Post date:** [December 17, 2024, 3:17am UTC](https://forum.opensearch.org/t/openid-with-auth0/22595/15 "2024-12-17T03:17:24Z")
One thing I must point out where there is room for improvement is ERROR or DEBUG logging. I tried to enable more detailed logs and this was not easy to do. Also once I managed to enable DEBUG logs they did not provide much detail to help me understand the cause of the issue. Something that may help others… if you try set `logging.verbose: true` in the dashboard config this does not work. What I eventually got working was to modify the systemctl service config. if you run `sudo systemctl cat dashboards.service` you will see where the service config file is located. I modified the line: `ExecStart=/usr/share/opensearch-dashboards/bin/opensearch-dashboards -q` remove `-q` and replace with `--verbose` Obviously you need to restart the `dashboards.service` after this.