Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch: 2.2.1
OpenSearch Dashboards: 2.2.1
Keycloak: 20.0.0
Ubuntu-20.04
Describe the issue:
Set up OpenSearch, OpenSearch Dashboards and Keycloak inside of a kubernetes cluster. Opensearch, and Dashboards run in one cluster, whereas Keycloak run on a different cluster. When trying to access Opensearch Dashboards I get redirected to Keycloaks login page. After inputting the credentials I get redirected back to opensearch dashboards, but am meet with a white page saying:
{āstatusCodeā:401,āerrorā:āUnauthorizedā,āmessageā:āUnauthorizedā}
The url in the browser at this point looks like this:
Keycloak has no logs (which usually means there is no error). It seems I was Authenticated with Keycloak but not Authorized. OpenSearch Dashboards has a generic 401 exception in its logs. The only log in OpenSearch is the following:
No āBasic Authorizationā header, send 401 and āWWW-Authenticate Basicā
Configuration:
The configurations are loaded in using Helm Charts. The following are the relevant configurations for OpenSearch and OpenSearch Dashboards:
image:
repository: opensearch-dashboards
pullPolicy: Never
tag: latest
config:
opensearch_dashboards.yml: |
opensearch.hosts: [http://opensearch-master-cluster:9200]
opensearch.ssl.verificationMode: none
opensearch.username: admin
opensearch.password: admin
opensearch.requestHeadersWhitelist: [Authorization, securitytenant]
server.ssl.enabled: false
opensearch_security.openid.base_redirect_url: 'http://dashboards:5601/'
opensearch_security.auth.type: "openid"
opensearch_security.openid.connect_url: "https://keycloak.example/realms/opensearch/.well-known/openid-configuration"
opensearch_security.openid.client_id: "opensearch"
opensearch_security.openid.client_secret: REDACTED
opensearch_security.openid.scope: openid profile email
opensearch_security.openid.header: "Authorization"
opensearch_security.multitenancy.enable_filter: false
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.enable_global: true
opensearch_security.multitenancy.tenants.enable_private: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: true
server.host: 'http://dashboards:5601'
sysctlInit:
enabled: true
sysctlVmMaxMapCount: 262144
securityConfig:
enabled: true
config:
dataComplete: false
data:
config.yml: |
_meta:
type: "config"
config_version: 2
config:
dynamic:
http:
anonymous_auth_enabled: false
authc:
basic_internal_auth_domain:
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: internal
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
openid_connect_idp:
enable_ssl: true
verify_hostnames: false
roles_key: roles
subject_key: preferred_username
openid_connect_url: "https://keycloak.example/realms/opensearch/.well-known/openid-configuration"
authentication_backend:
type: noop
authz: {}
opensearch.yml: |
cluster.name: opensearch-cluster
logger.level: debug
network.host: 0.0.0.0
plugins:
security:
ssl:
transport:
enabled: true
pemcert_filepath: esnode.pem
pemkey_filepath: esnode-key.pem
pemtrustedcas_filepath: root-ca.pem
enforce_hostname_verification: false
http:
enabled: true
pemcert_filepath: esnode.pem
pemkey_filepath: esnode-key.pem
pemtrustedcas_filepath: root-ca.pem
allow_unsafe_democertificates: true
allow_default_init_securityindex: true
authcz:
admin_dn:
- CN=kirk,OU=client,O=client,L=test,C=de
audit.type: internal_opensearch
enable_snapshot_restore_privilege: true
check_snapshot_restore_write_privileges: true
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]
######## End OpenSearch Security Demo Configuration ########
Relevant Logs or Screenshots:
Keycloak Role Mappings:
