# OpenSearch OpenID Connect Integration with Azure AD not working

**URL:** <https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570>\
**Category:** Security\
**Tags:** configure, security-issue\
**Created:** [March 26, 2024, 11:39am UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570 "2024-03-26T11:39:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nawaz](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nawaz](https://forum.opensearch.org/u/nawaz)\
**Post date:** [March 26, 2024, 11:39am UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/1 "2024-03-26T11:39:15Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

Helm Chart version: opensearch-2.17.3 and opensearch-dashboards-2.15.1

OpenSearch version: 2.11.1

**Describe the issue** :

I am trying to do Opensearch integration with Azure AD but getting below error.

meta":{“affectedServices”:{“opensearch”:{“level”:“critical”,“summary”:“Unable to retrieve version information from OpenSearch nodes.”,“meta”:{“warningNodes”:,“incompatibleNodes”:}}}},“detail”:“See the status page for more information”}}}},“message”:“Recalculated overall status”}

{“type”:“log”,“@timestamp”:“2024-03-26T11:26:59Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:1,“message”:“[ConnectionError]: socket hang up”}

**Configuration** :

I followed below link for configuration.

> **[OpenSearch OpenID Connect Integration with Azure AD](https://medium.com/@Brightly_BMGH/opensearch-openid-connect-integration-with-azure-ad-165056f976e4)**
>
> Dashboards and Visualization of transactions, especially in real-time platforms, are essential for providing clear and transparent costs…

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 26, 2024, 11:49am UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/2 "2024-03-26T11:49:19Z")

</div>

Hi @nawaz,

Could you share your `config.yml` and `opensearch_dashboards.yml`?

Thanks,  
mj

---

<div class="post-metadata">

**Author:** ![nawaz](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nawaz](https://forum.opensearch.org/u/nawaz)\
**Post date:** [March 26, 2024, 3:16pm UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/3 "2024-03-26T15:16:45Z")

</div>

Hi @Mantas

**Config.yml**

```auto
      config.yml: |-
        _meta:
          type: "config"
          config_version: 2
        config:
          dynamic:
            http:
              anonymous_auth_enabled: false
              xff:
                enabled: false
                internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
                remoteIpHeader: 'x-forwarded-for'
            authc:
              basic_internal_auth_domain:
                description: "Authenticate via HTTP Basic against internal users database"
                http_enabled: true
                transport_enabled: true
                order: 1 # Must set to 1 to prevent logs flooding with warnings
                http_authenticator:
                  type: basic
                  challenge: false
                authentication_backend:
                  type: internal
              openid_auth_domain:
                http_enabled: true
                transport_enabled: true
                order: 0 # Must set to 0 to precede basic authentication or logs will flood with warnings
                http_authenticator:
                  type: openid
                  challenge: false
                  config:
                    openid_connect_idp:
                      enable_ssl: true # Without this JWT cookie will fail and token won't be passed to engine
                      pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca.pem # Full chain pem file for you HTTPS certificate
                      verify_hostnames: false # If SNI certificate is used and hostnames match, set to true
                      subject_key: email # Users will be able to login with email and show it as username
                      roles_key: roles # Use roles from App registrations, do not set to groups.
                    openid_connect_url: https://login.microsoftonline.com/<OPENSEARCH_TENANT_ID>/v2.0/.well-known/openid-configuration # App registration IDP metadata file URL
                authentication_backend:
                  type: noop # Here we disable authentication backend since we will be using Azure AD for that
      

```

**dashboard config**

```auto
  opensearch_dashboards.yml: |
    server:
      name: opensearch-dashboards
      host: "0.0.0.0"
      ssl:
        enabled: false
          opensearch_security:
      cookie:
        secure: false
      readonly_mode:
        roles: ["kibana_read_only"]
      multitenancy:
        enabled: true
        tenants:
          preferred: ["Private", "Global"]            
      auth:
        multiple_auth_enabled: true
        type: ["openid", "basicauth"]
      openid:
        connect_url: "https://login.microsoftonline.com/<OPENSEARCH_TENANT_ID>/v2.0/.well-known/openid-configuration"
        client_id: "123"
        client_secret: "123"
        base_redirect_url: "https://dashboard-url/"

    opensearch:
      ssl:
        verificationMode: certificate
        certificateAuthorities: /usr/share/opensearch-dashboards/config/root-ca.pem
      hosts: ["https://master-cluster-ip:9200"]
      username: "admin"
      password: "password"
      requestHeadersWhitelist: ["Authorization", "securitytenant"]

    logging:
      verbose: true

```

```auto
  root-ca.pem: |
    -----BEGIN CERTIFICATE-----
  
    -----END CERTIFICATE-----
```

---

<div class="post-metadata">

**Author:** ![nawaz](https://avatars.discourse-cdn.com/v4/letter/n/df705f/32.png) [@nawaz](https://forum.opensearch.org/u/nawaz)\
**Post date:** [March 27, 2024, 11:10am UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/4 "2024-03-27T11:10:11Z")

</div>

Hi @Mantas and @pablo,

I have created a my own ssl certificate following below URL.

> **[Generating self-signed certificates](https://opensearch.org/docs/latest/security/configuration/generate-certificates/)**
>
> Generating self-signed certificates

I am getting below error while executing “./securityadmin.sh -f /usr/share/opensearch/config/opensearch-security/config.yml -icl -nhnv -cert …/…/…/config/admin.pem -cacert …/…/…/config/root-ca.pem -key …/…/…/config/admin-key.pem -t config”  
command.

Error:

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

See [Java high-level REST client - OpenSearch Documentation](https://opensearch.org/docs/latest/clients/java-rest-high-level/) for troubleshooting.

at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:948)

at org.opensearch.client.RestClient.performRequest(RestClient.java:333)

at org.opensearch.client.RestClient.performRequest(RestClient.java:321)

at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:573)

at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:163)

Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)

at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)

at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)

at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)

at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)

at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)

at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)

at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)

at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)

at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)

at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)

at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)

at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)

at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:289)

at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:357)

at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:545)

at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)

at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)

FYI, I added root-ca.pem admin.pemadmin-key.pem in java Keystore.

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 27, 2024, 1:42pm UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/5 "2024-03-27T13:42:45Z")

</div>

Hi @nawaz,

> [@nawaz](#):
>
> “Unable to retrieve version information from OpenSearch nodes.”

This indicates that there is a connection problem in your cluster.

> [@nawaz](#):
>
> `hosts: ["https://master-cluster-ip:9200"]`

You will need to you svc as `opensearch.hosts` something like: ` opensearch.hosts: ["https://master-cluster-ip.default.svc:9200"]` or `"https://master-cluster-ip.default.svc.cluster.local:9200"`  
You can find more info here: [DNS for Services and Pods | Kubernetes](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/)

Please let me know if this helped to resolve the error.

Best,  
mj

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [March 27, 2024, 2:00pm UTC](https://forum.opensearch.org/t/opensearch-openid-connect-integration-with-azure-ad-not-working/18570/6 "2024-03-27T14:00:32Z")

</div>

> [@nawaz](#):
>
> javax.net.ssl.SSLHandshakeException: PKIX path building failed:

To generate a new self-signed admin certificate you will need to generate a new root ca (and key) this means that you will have to replace all the certificates on your cluster with new generated using the new root ca/key. (note: once you generate new certs, please check kubernetes docs on how to create a TLS secret from the given public/private key pair)  
Alternatively, you can find admin certificates in your OpenSearch node` ../../../config` directory to use with` securityadmin.sh`.

If you would like to discuss this topic in more detail please create a new forum as this is an unrelated issue to the original one, so it is more beneficial to the rest of the community.

best,  
mj