Hello, I am unable to connect with OpenSearch with keycloak. Below is the config.yml _meta: type: "config" config_version: 2 config: dynamic: # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index # Set filtered_alias_mode to 'warn' to allow more …

[image] Here 10.196.18.85 is my node IP

@Vivek123 I’m not sure why the node ip is there. Can you try http://<kibana_ip>:32001 instead? Or better yet, perhaps try ‘*’ as a starting point and work from there?

I have also tried with ‘*’ option in redirect url then to getting same issue. It is getting redirected again and again and not showing any error log in opensearch elasticsearch [image] I am also able to check, the session is getting created in keycloak [image] So I think issue is opensearch kib…

@Vivek123 in my experience the infinite redirect is a result of misconfiguration from either side. Can you ensure that openid_connect_url in config.yml matches the opensearch_security.openid.connect_url in opensearch_dashboards.yml (and includes the port) Please also remove the verify_hostnames: f…

Here is my opensearch.yml cluster.name: opensearch-cluster # Bind to all interfaces because we don't know what IP address Docker will assign to us. network.host: 0.0.0.0 # # minimum_master_nodes need to be explicitly set when bound on a public IP # # set to 1 to allow single node clusters # disco…

Could you please open Developer tools in browser, reproduce the error and see the error, that might give a pointer or two.

Here is the network option of developer tool [image] After login it is going to hit below api http://10.196.18.106:32001/auth/openid/login?state=ym7HLky7hk0Y_2JRrxiOsF&session_state=3fd75767-016a-49a0-8b22-758ecba28532&code=513d71d2-ec52-42aa-8d2a-c522f891a6d8.3fd75767-016a-49a0-8b22-758ecba2853…

@Vivek123 I see that you have changed to https for keycloak, I’ve seen cases where mixing http and https causes issues. Can you set up https on OpenSearch Dashboards and update both of the config files (config.yml and opensearch_dashboards.yml). Also, to ensure the certificate is not causing any is…

Hello Anthony, After a lot of debugging I put some logger in opensearch-security code and got some below logs [image] It is showing No ‘Basic Authorization’ header. That means it is taking the auth type is basic auth instead of OAuth(openid). So suggest to me what I am doing wrong here. Here is…

[image] Anthony: Can you also change basic_internal_auth_domain to order 0, with challenge kept as false and set this flag to true on the openid_auth_domain. @Vivek123 can you update the config as per above? basic_auth order 0, challenge false, openID order 1, challenge true. Once this is …

Opensearch not able to connect with openid keycloak

Security

Raki August 5, 2022, 5:20pm 25

@pablo basically this thread follows it up, also with the same issues

Topic		Replies	Views
Keycloak OpenID 401 Unauthorized Security	22	8125	September 21, 2022
401 Unauthorized - Integrating with Keycloak using opster operator Security troubleshoot	17	1584	December 13, 2023
OpenSearch Dashboards 401 Unauthorized using OIDC with Keycloak Security	12	7483	February 15, 2023
OpenID 401 Unauthorized with Keycloak Security troubleshoot , configure	14	4428	August 3, 2022
Infinite redirect loop when trying to secure Opensearch with a keycloak located in the same cluster Security	9	2063	May 31, 2024

Opensearch not able to connect with openid keycloak

Related topics