OpenSearch 3.5 ignores verify_hostnames: false in OpenID config and fails with SAN hostname validation error

Security
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.5

Describe the issue:

We are configuring OpenSearch 3.5 to use OpenID authentication with Keycloak as the IdP. Our OpenSearch security configuration includes the following OpenID settings:

"authc": {
  "openid_auth_domain": {
    "http_enabled": true,
    "order": 1,
    "http_authenticator": {
      "challenge": false,
      "type": "openid",
      "config": {
        "subject_key": "preferred_username",
        "roles_key": "roles",
        "openid_connect_url": "https://ckey-ckey.xyz-ckey.svc.cluster.local:8443/access/realms/xyz-realm/.well-known/openid-configuration",
        "openid_connect_idp": {
          "enable_ssl": true,
          "verify_hostnames": false,
          "trust_all": false,
          "pemtrustedcas_filepath": "/etc/opensearch/config/certs/keycloakRootCaPem"
        }
      }
    }
  }
}

Despite setting:

"verify_hostnames": false

OpenSearch still performs hostname verification and fails with the following error:

org.opensearch.security.auth.http.jwt.keybyoidc.AuthenticatorUnavailableException: Error while getting https://ckey-ckey.xyz-ckey.svc.cluster.local:8443/access/realms/xyz-realm/.well-known/openid-configuration: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching ckey-ckey.xyz-ckey.svc.cluster.local found

Stack trace shows failure originating from:

org.opensearch.security.auth.http.jwt.keybyoidc.KeySetRetriever org.opensearch.security.auth.http.jwt.keybyoidc.SelfRefreshingKeySet

Observed Behaviour:

OpenSearch attempts to validate hostname against certificate SAN even though:

verify_hostnames: false

is configured.

Expected Behaviour:

When:

verify_hostnames: false

is set, OpenSearch should skip hostname verification for the IdP TLS connection, similar to behavior in OpenSearch 2.x.

Observation:

This exact configuration works correctly in OpenSearch 2.x, where hostname verification is properly skipped when verify_hostnames is set to false.

The issue only appears in OpenSearch 3.x.

  1. Is this expected behavior in OpenSearch 3.x?
  2. Is this a known limitation or regression compared to OpenSearch 2.x?
  3. Is there any supported way to disable hostname verification for OpenID IdP connections in OpenSearch 3.x?
  4. Or is it mandatory that IdP certificate SAN must match the exact hostname?

Thanks!

2

@shubtiwa Which version of 2.x you had that configuration working?

3

Opensearch version 2.19.4

4

Hi @pablo
Any update on this?
Kindly look into this asap.

5

@Pratiksha @shubtiwa I can confirm that the verify_hostnames option in the OpenID configuration is always set to true. Security plugin ignores these settings.
According to my test, the latest working version was 2.19.4. The issue started in 3.0.0

I’ve updated this GitHub issue with my findings.