**On behalf of a user of Slack ** "Hi Team, Am trying to integrate keycloak with opensearch using k8s opster operator. I have added the dashboards.additionconfig and config.yaml(openid_auth_domain). dashboards.additionconfig: logging.verbose: "true" server.name: my-cluster1-dashboar…

Would you mind sharing your Opster config file with the node configuration or the full cluster configuration?

Hi @pablo , Please refer the below yaml files. opensearch.yaml apiVersion: opensearch.opster.io/v1 kind: OpenSearchCluster metadata: name: my-cluster1 namespace: opensearch spec: security: config: adminCredentialsSecret: name: a-admin-credentials-secret securityConfi…

[image] rmssath: pemtrustedcas_filepath: "https://x.x.x.x/protocol/openid-connect/certs" This must point to the keycloak’s SSL certificate file, not the URL.

[image] rmssath: opensearch.hosts: "https://<opensearch-svc-ip>:9200" Also, you don’t need this part.

@pablo , Kindly suggest the ways/method to copy the Keycloak ssl cert file into opensearch pod and point the same to pemtrustedcas_filepath. Since it is opster operator, not sure how to copy it. Will this operator supports for adding custom init containers?

@rmssath I’m not an Opster expert, however, have you tried additional volumes? Opster/opensearch-k8s-operator/blob/main/docs/userguide/main.md#additional-volumes # Opensearch Operator User Guide This guide is intended for users of the Opensearch Operator. If you want to contribute …

@pablo , It is working now after adding the additional volumes. But the keycloak user is not having the privileges to view the logs/dashboard. This user is mapped to the role “own_index”. How to map roles for the users those who authenticated from keycloak.

@rmssath You need to map Keycloak’s roles assigned to the user and map as backend roles in roles_mapping.yml file. Could you share your current roles_mapping.yml?

@pablo , Please find the role_mapping.yaml roles_mapping.yml: |- _meta: type: "rolesmapping" config_version: 2 # Define your roles mapping here ## Demo roles mapping all_access: reserved: false backend_roles: - "admin" description: "Maps admin to all_access" o…

@rmssath As per the shared file, there are no Keycloak’s roles configured. The reason why users get own_index assigned in OpenSearch is that all authenticated users are mapped to that role. [image] rmssath: own_index: reserved: false users: - "*" If you’d like to add your Keyc…

OpenSearch integration with keycloak using k8s opster operator

Security

pablo August 3, 2023, 2:19pm 5

Also, you don’t need this part.

Topic		Replies	Views
401 Unauthorized - Integrating with Keycloak using opster operator Security troubleshoot	17	1586	December 13, 2023
Keycloak with opensearch is not working Security	25	1292	February 9, 2024
OpenSearch Dashboards 401 Unauthorized using OIDC with Keycloak Security	12	7489	February 15, 2023
OpenSearch Dashboards returning 401 error when using Keycloak as IDP Security	11	4485	August 15, 2023
Opensearch not able to connect with openid keycloak Security troubleshoot , configure	25	4735	September 22, 2022

OpenSearch integration with keycloak using k8s opster operator

Related topics