# Opensearch and OpenID (Azure) issue

**URL:** <https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741>\
**Category:** Security\
**Created:** [August 9, 2021, 10:02pm UTC](https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741 "2021-08-09T22:02:59Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![JackBlack](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@JackBlack](https://forum.opensearch.org/u/JackBlack)\
**Post date:** [November 25, 2021, 7:56am UTC](https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741/22 "2021-11-25T07:56:45Z")

</div>

@Anthony thanks for your support!  
@sastorsl I’m running OS and OSDashboards with Docker. Do I need to apply changes to securityadmin.sh?  
I did change the configuration like yours, but still got the error ☹

---

<div class="post-metadata">

**Author:** ![sastorsl](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sastorsl](https://forum.opensearch.org/u/sastorsl)\
**Post date:** [November 25, 2021, 9:58am UTC](https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741/23 "2021-11-25T09:58:46Z")

</div>

@JackBlack yes indeed, you need to apply the config. Have to admit i tripped on this as well for an extreme amount of reconfiguration-attempts.

Double check the `openid_connect_url`  
Also double check the secret key in OpenSearch Dashboards.

I’m on kubernetes and ended up defining it in a k8s “secret” as an environment variable, referencing the environment in my properties file.

Next thing is to double check that you get the proper “claims” from Azure.  
You need API permissions on “openid”, “profile”, “User.Read”. I also have “email” and “GroupMember.Read”.

Under token configuration i have “email”, “groups”, “preferred\_username”. You _can_ have “upn” but that has been deprecated in the later Azure versions.

In Azure you will also need to configure the correct redirect URL as a “Web” application.  
[https://your-openshift-dashboards-url/auth/openid/login](https://your-openshift-dashboards-url/auth/openid/login)

Save in Azure.  
Check and restart OpenSearch Dashboards.  
Apply any config changes to the security module in OpenSearch (se my last post).

---

<div class="post-metadata">

**Author:** ![ogulman](https://avatars.discourse-cdn.com/v4/letter/o/9fc29f/32.png) [@ogulman](https://forum.opensearch.org/u/ogulman)\
**Post date:** [November 10, 2023, 4:30pm UTC](https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741/24 "2023-11-10T16:30:38Z")

</div>

I do have the same issue, how have you solved it?

[Previous page](https://forum.opensearch.org/t/opensearch-and-openid-azure-issue/6741.md?page=1)