# Q: How do I configure OpenID using the Helm chart?

**URL:** <https://forum.opensearch.org/t/q-how-do-i-configure-openid-using-the-helm-chart/12131>\
**Category:** General Feedback\
**Tags:** configure, install\
**Created:** [January 17, 2023, 12:19am UTC](https://forum.opensearch.org/t/q-how-do-i-configure-openid-using-the-helm-chart/12131 "2023-01-17T00:19:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikeyGlitz](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@mikeyGlitz](https://forum.opensearch.org/u/mikeyGlitz)\
**Post date:** [January 17, 2023, 12:19am UTC](https://forum.opensearch.org/t/q-how-do-i-configure-openid-using-the-helm-chart/12131/1 "2023-01-17T00:19:51Z")

</div>

Versions:

- 2.3
- 2.4

I’m trying to use the [OpenSearch Helm Chart](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/helm/) to connect my OpenSearch cluster to a Keycloak identity provider. How would I go about setting the [OpenID security configuration](https://opensearch.org/docs/latest/security-plugin/configuration/openid-connect/) so that I may authenticate against my IDP?

Would I still be able to use local accounts with OpenSearch (i.e. kibana, admin) even with OpenID configured?

---

<div class="post-metadata">

**Author:** ![mikeyGlitz](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@mikeyGlitz](https://forum.opensearch.org/u/mikeyGlitz)\
**Post date:** [February 10, 2023, 8:30pm UTC](https://forum.opensearch.org/t/q-how-do-i-configure-openid-using-the-helm-chart/12131/2 "2023-02-10T20:30:53Z")

</div>

I figured out how to get the OpenID configuration using the helm chart. In `values.yaml` you have to set `securityConfig.config`. You could either create a [Kubernetes Secret](https://kubernetes.io/docs/concepts/configuration/secret/) or provide plain YAML into `securityConfig.config.data`.

This is my `config.yaml`:

```plaintext
_meta:
  type: config
  config_version: 2
config
  dynamic:
    authc:
      openid_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: openid
          challenge: false
          config:
            subject_key: preferred_username
            roles_key: roles
            openid_connect_idp:
              enable_ssl: true
              verify_hostnames: false
              pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca/root.ca.crt
            openid_connect_url: "https://{{ keycloak_server }}/auth/realms/{{ realm_name }}/.well-known/openid-configuration"
        authentication_backend:
          type: noop

```

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [February 15, 2023, 1:01am UTC](https://forum.opensearch.org/t/q-how-do-i-configure-openid-using-the-helm-chart/12131/3 "2023-02-15T01:01:10Z")

</div>

thanks for coming back to post what you learned @mikeyGlitz - the community appreciates it!